Edit tour

Windows Analysis Report
FaZM14kDMN.exe

Overview

General Information

Sample name:	FaZM14kDMN.exe renamed because original name is a hash value
Original sample name:	09c4be56897be7d01a78f8136e738fb0783f30da4d640a0384fff68434764e74.exe
Analysis ID:	1554434
MD5:	97ed8de2b68681e9e8269683438d9178
SHA1:	e3bb7435fb4dd4e46eb5846cd4e2dcc12ed3cc7a
SHA256:	09c4be56897be7d01a78f8136e738fb0783f30da4d640a0384fff68434764e74
Tags:	4-251-123-83exeuser-JAMESWT_MHT
Infos:

Detection

Meduza Stealer, PureLog Stealer, RedLine, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

FaZM14kDMN.exe (PID: 3756 cmdline: "C:\Users\user\Desktop\FaZM14kDMN.exe" MD5: 97ED8DE2B68681E9E8269683438D9178)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: RedLine

{"C2 url": "4.251.123.83:6677"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
FaZM14kDMN.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
FaZM14kDMN.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
FaZM14kDMN.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
FaZM14kDMN.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c27:$s1: file:/// 0x45b5f:$s2: {11111-22222-10009-11112} 0x45bb7:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c39:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FaZM14kDMN.exe PID: 3756	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: FaZM14kDMN.exe PID: 3756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FaZM14kDMN.exe PID: 3756	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.FaZM14kDMN.exe.460000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.FaZM14kDMN.exe.460000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.FaZM14kDMN.exe.460000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.FaZM14kDMN.exe.460000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45c27:$s1: file:/// 0x45b5f:$s2: {11111-22222-10009-11112} 0x45bb7:$s3: {11111-22222-50001-00000} 0x423fa:$s4: get_Module 0x42864:$s5: Reverse 0x45226:$s6: BlockCopy 0x42c23:$s7: ReadByte 0x45c39:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:51:36.528220+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.3	49710	TCP
2024-11-12T14:52:16.488549+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.3	51280	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:51:25.960199+0100	2046056	1	A Network Trojan was detected	4.251.123.83	6677	192.168.2.3	49709	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T14:51:25.314866+0100	2046045	1	A Network Trojan was detected	192.168.2.3	49709	4.251.123.83	6677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FaZM14kDMN.exe

Avira: detected

Found malware configuration

Source: FaZM14kDMN.exe.3756.0.memstrmin

Malware Configuration Extractor: RedLine {"C2 url": "4.251.123.83:6677"}

Multi AV Scanner detection for submitted file

Source: FaZM14kDMN.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: FaZM14kDMN.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Code function: 0_2_00007FFB118C1AC5 LdrLoadDll,CryptUnprotectData,

0_2_00007FFB118C1AC5

Source: FaZM14kDMN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FaZM14kDMN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.3:49709 -> 4.251.123.83:6677
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 4.251.123.83:6677 -> 192.168.2.3:49709

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 4.251.123.83:6677

Source: global traffic

TCP traffic: 192.168.2.3:49709 -> 4.251.123.83:6677

Source: Joe Sandbox View

ASN Name: LEVEL3US LEVEL3US

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.3:51280
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.3:49710

Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83
Source: unknown	TCP traffic detected without corresponding DNS query: 4.251.123.83

Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: FaZM14kDMN.exe, 00000000.00000002.1547609195.000000001C0BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldbl equals www.youtube.com (Youtube)
Source: FaZM14kDMN.exe, 00000000.00000002.1547609195.000000001C0BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field1Response
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field2Response
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002FFB000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/example/Field3Response
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002FFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002FFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.oh
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: FaZM14kDMN.exe, type: SAMPLE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: FaZM14kDMN.exe, Strings.cs

Large array initialization: Strings: array initializer size 6160

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB1138AEF0	0_2_00007FFB1138AEF0
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB113811A0	0_2_00007FFB113811A0
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB11388A58	0_2_00007FFB11388A58
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB115A1660	0_2_00007FFB115A1660
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB115AC4CA	0_2_00007FFB115AC4CA
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB115A945D	0_2_00007FFB115A945D
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB115AA59F	0_2_00007FFB115AA59F
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116AD245	0_2_00007FFB116AD245
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116A8910	0_2_00007FFB116A8910
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116AB810	0_2_00007FFB116AB810
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB11695B15	0_2_00007FFB11695B15
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116A6B18	0_2_00007FFB116A6B18
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116AD2C0	0_2_00007FFB116AD2C0
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116AD86D	0_2_00007FFB116AD86D
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB1169A77B	0_2_00007FFB1169A77B
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116AAF40	0_2_00007FFB116AAF40
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118B9A1D	0_2_00007FFB118B9A1D
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118C9B30	0_2_00007FFB118C9B30
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118B35EC	0_2_00007FFB118B35EC
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118B8D6B	0_2_00007FFB118B8D6B
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118BA6F9	0_2_00007FFB118BA6F9
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118CA628	0_2_00007FFB118CA628
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118C65AA	0_2_00007FFB118C65AA

Source: FaZM14kDMN.exe, 00000000.00000000.1452433037.00000000004EE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGristles.exe" vs FaZM14kDMN.exe
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs FaZM14kDMN.exe
Source: FaZM14kDMN.exe	Binary or memory string: OriginalFilenameGristles.exe" vs FaZM14kDMN.exe

Source: FaZM14kDMN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FaZM14kDMN.exe, type: SAMPLE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: FaZM14kDMN.exe, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: FaZM14kDMN.exe, Class4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: FaZM14kDMN.exe, Class4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

File created: C:\Users\user\AppData\Local\Microsoft\Wind?ws

Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Mutant created: NULL

Source: FaZM14kDMN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FaZM14kDMN.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FaZM14kDMN.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: FaZM14kDMN.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: FaZM14kDMN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: FaZM14kDMN.exe, Class4.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: FaZM14kDMN.exe

Static PE information: 0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB11381DA3 push FFFFFFE8h; retf	0_2_00007FFB11381DC1
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB1138806E push eax; ret	0_2_00007FFB1138807D
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB1138803E pushad ; ret	0_2_00007FFB1138806D
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB116B7A50 push ebx; retn 5F19h	0_2_00007FFB116B823A
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118C6110 push cs; ret	0_2_00007FFB118C622F
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118C61FB push cs; ret	0_2_00007FFB118C622F
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Code function: 0_2_00007FFB118B5FE0 push ebx; ret	0_2_00007FFB118B61EA

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Memory allocated: 2600000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Memory allocated: 1A8A0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Window / User API: threadDelayed 2166			Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Window / User API: threadDelayed 3154			Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe TID: 4824	Thread sleep time: -18446744073709540s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe TID: 2204	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: FaZM14kDMN.exe, 00000000.00000002.1547609195.000000001C0BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Code function: 0_2_00007FFB118C1AC5 LdrLoadDll,CryptUnprotectData,

0_2_00007FFB118C1AC5

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Users\user\Desktop\FaZM14kDMN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: FaZM14kDMN.exe PID: 3756, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: FaZM14kDMN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: FaZM14kDMN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FaZM14kDMN.exe PID: 3756, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: FaZM14kDMN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: hieplnfojfccegoloniefimmbfjdgcgp\|Electrum
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCashE#
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: idkppnahnmmggbmfkjhiakkbkdpnmnon\|Exodus
Source: FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: FaZM14kDMN.exe, 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xte0v1np.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\FaZM14kDMN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FaZM14kDMN.exe PID: 3756, type: MEMORYSTR

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: FaZM14kDMN.exe PID: 3756, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: FaZM14kDMN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: FaZM14kDMN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FaZM14kDMN.exe PID: 3756, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: FaZM14kDMN.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FaZM14kDMN.exe.460000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	321 Security Software Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
FaZM14kDMN.exe	63%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
FaZM14kDMN.exe	100%	Avira	HEUR/AGEN.1312138
FaZM14kDMN.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
4.251.123.83:6677	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
4.251.123.83:6677	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discord.com/api/v9/users/	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1Response	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FaZM14kDMN.exe, 00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.oh	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002FFB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field1	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field2	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.w3.o	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002FFB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/example/Field3Response	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002FFB000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012A6A000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.00000000128DF000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012AC3000.00000004.00000800.00020000.00000000.sdmp, FaZM14kDMN.exe, 00000000.00000002.1541573154.0000000012CD6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	FaZM14kDMN.exe, 00000000.00000002.1536174338.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2002/12/policy	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit	FaZM14kDMN.exe, 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
4.251.123.83	unknown	United States		3356	LEVEL3US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554434
Start date and time:	2024-11-12 14:50:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FaZM14kDMN.exe renamed because original name is a hash value
Original Sample Name:	09c4be56897be7d01a78f8136e738fb0783f30da4d640a0384fff68434764e74.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: FaZM14kDMN.exe

Simulations

Behavior and APIs

Time	Type	Description
08:51:27	API Interceptor	25x Sleep call for process: FaZM14kDMN.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
4.251.123.83	file.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEVEL3US	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	65.90.191.211
	sora.arm.elf	Get hash	malicious	Mirai	Browse	4.98.147.155
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	4.150.155.223
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	7.167.215.90
	amen.x86.elf	Get hash	malicious	Mirai	Browse	11.22.83.104
	amen.arm.elf	Get hash	malicious	Unknown	Browse	6.17.53.0
	zgp.elf	Get hash	malicious	Mirai	Browse	9.168.203.84
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	7.229.51.211
	amen.sh4.elf	Get hash	malicious	Mirai	Browse	8.91.25.183
	amen.spc.elf	Get hash	malicious	Mirai	Browse	65.59.28.22

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.180205229034727
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	FaZM14kDMN.exe
File size:	743'424 bytes
MD5:	97ed8de2b68681e9e8269683438d9178
SHA1:	e3bb7435fb4dd4e46eb5846cd4e2dcc12ed3cc7a
SHA256:	09c4be56897be7d01a78f8136e738fb0783f30da4d640a0384fff68434764e74
SHA512:	b745d6ad3472c6b9c301d906ac4dd1ed6ecc1a1d40fcbe3640987f749459b6036c6b7fb2b86e15dd1c6239800dcb742e1d8c61a8cae69d9fedc1c55297f607cc
SSDEEP:	12288:xDKYDzqxpXBNt1BrivR0V4TBjgYxs1wl206gBawFV2ceSb0BQ/GfM/4QiAzojgJI:xDKY3qxp1NvXw
TLSH:	8AF4701C5BBC058CEC8CD531BE20C9326EA04E08919FCB49A569FA151EB6277B3F5BD1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	0e9696961617e982

Static PE Info

General

Entrypoint:	0x44d0fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE3FEC0F4 [Mon Mar 19 06:19:32 2091 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d0a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x6a022	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4b104	0x4b200	94b3a2b22f5565100fcbd73711ba03e5	False	0.4180239964642263	data	6.528753978747002	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4e000	0x6a022	0x6a200	65e4195d76e2641b30f5c060426a53b1	False	0.04090059997055359	data	3.4733020781588206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	fdd16811f82542ac94c2824c17d00617	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4e2b0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	0.019047548598988075
RT_ICON	0x902d8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.03903939429788241
RT_ICON	0xa0b00	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.0580460374185411
RT_ICON	0xa9fa8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.08243992606284659
RT_ICON	0xaf430	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.0987836561171469
RT_ICON	0xb3658	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.14284232365145227
RT_ICON	0xb5c00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.22537523452157598
RT_ICON	0xb6ca8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.30901639344262294
RT_ICON	0xb7630	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4530141843971631
RT_GROUP_ICON	0xb7a98	0x84	data	0.7196969696969697
RT_VERSION	0xb7b1c	0x31c	data	0.4535175879396985
RT_MANIFEST	0xb7e38	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T14:51:25.314866+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.3	49709	4.251.123.83	6677	TCP
2024-11-12T14:51:25.960199+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	4.251.123.83	6677	192.168.2.3	49709	TCP
2024-11-12T14:51:36.528220+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.3	49710	TCP
2024-11-12T14:52:16.488549+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.3	51280	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 14:51:24.293557882 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:24.298794031 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:24.298981905 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:24.302030087 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:24.306826115 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.113239050 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.166188002 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.314866066 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.319751024 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.707472086 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.715624094 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.720983028 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960031033 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960062981 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960074902 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960095882 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960108042 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960119963 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960141897 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.960181952 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.960199118 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960213900 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960263014 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.960298061 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960310936 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960345030 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.960741043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960906029 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.960952997 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:25.965059996 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.965114117 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.965127945 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:25.965159893 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:26.010081053 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:26.075768948 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:26.075798035 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:26.075810909 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:26.075881958 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:26.075917006 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:26.075931072 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:26.075982094 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:26.076082945 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:26.076134920 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:29.180856943 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:29.478885889 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.079612970 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.231964111 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232040882 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232073069 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232153893 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232184887 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232207060 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232218981 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232258081 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232283115 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232295036 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232328892 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232331991 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232345104 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232368946 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232378006 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232412100 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232456923 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.232603073 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.232812881 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.233093023 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239291906 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239301920 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239358902 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239360094 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239378929 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239394903 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239442110 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239456892 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239470959 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239511013 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239521027 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239521980 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239552975 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239579916 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239599943 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239607096 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239644051 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239680052 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239690065 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239701986 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.239727974 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.239748001 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.240000010 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.240014076 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.240058899 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.240147114 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.240209103 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244550943 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244605064 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244618893 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244671106 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244784117 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244801044 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244833946 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244853973 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244884014 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244894028 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244940996 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244951963 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.244981050 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.244988918 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.245002985 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.245017052 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.245034933 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.245055914 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.245081902 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.245127916 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.245151043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.245215893 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.246545076 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.246592999 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.246681929 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.246694088 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.246742964 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.246745110 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.246753931 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.246843100 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.251682043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251732111 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.251739025 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251749039 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251799107 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.251833916 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251843929 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251859903 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251872063 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251887083 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.251903057 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.251924992 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.251935959 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.251945972 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252000093 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252049923 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252059937 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252110004 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252115965 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252120972 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252147913 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252165079 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252170086 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252213955 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252240896 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252269983 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252279043 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252301931 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252336979 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252350092 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252397060 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252427101 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252438068 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252471924 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252486944 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.252506018 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252516985 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252543926 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252558947 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252624989 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252679110 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252726078 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252775908 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252808094 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252816916 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252887011 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252897024 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252907991 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252944946 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.252999067 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.253007889 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.253057003 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.253066063 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.253098011 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254234076 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254247904 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254412889 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254425049 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254522085 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254532099 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254551888 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254563093 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254605055 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254616022 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254683971 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254697084 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254745007 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.254756927 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254770041 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254790068 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.254796028 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.254802942 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258734941 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258744955 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258778095 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258786917 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258860111 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258868933 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258914948 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258924007 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258990049 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.258999109 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259038925 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259048939 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259094954 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259110928 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259128094 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259166956 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259222031 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259232044 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259299994 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259309053 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259346008 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259356022 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259407043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259417057 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259453058 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259463072 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259525061 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259535074 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259638071 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259646893 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259706020 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259716034 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259793043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259804010 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259850979 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259860039 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259891987 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.259953022 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260054111 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260070086 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260078907 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260091066 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260123968 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260149002 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260230064 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260240078 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260318041 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260329008 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260346889 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260358095 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260459900 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260472059 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260482073 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260494947 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260518074 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.260549068 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260560989 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260565042 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.260572910 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260592937 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260603905 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260632038 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260680914 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260693073 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260726929 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260737896 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260824919 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260835886 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260859966 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260869980 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260917902 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260929108 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260972977 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.260983944 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261015892 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261025906 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261113882 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261126041 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261137009 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261162043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261261940 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261271954 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261311054 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261322021 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261378050 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261388063 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261435032 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261445999 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261518955 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261529922 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261562109 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261573076 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261595011 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261605978 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261660099 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261671066 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.261697054 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265528917 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265541077 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265563011 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265573025 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265642881 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265686989 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265808105 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.265830994 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265841961 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265877962 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.265887022 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265908957 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265944004 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.265964031 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266043901 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266058922 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266097069 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266107082 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266124010 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266140938 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266235113 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266244888 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266261101 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266271114 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266293049 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266303062 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266350031 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266408920 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266417980 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266428947 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266478062 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266486883 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266526937 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266536951 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266575098 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266585112 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266601086 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266609907 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266657114 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266665936 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266705036 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266725063 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266765118 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266773939 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266793966 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266803980 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266819954 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266829967 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266864061 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266874075 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266915083 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266925097 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266957998 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266968012 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.266999006 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270710945 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270725012 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270755053 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270766020 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270807028 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270817995 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270859957 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270872116 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270891905 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270893097 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.270901918 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270944118 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270956993 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.270961046 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.270996094 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271008968 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271024942 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271071911 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271111965 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271122932 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271142960 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271153927 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271173000 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271183968 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271255016 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271265984 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271276951 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271296024 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271308899 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271330118 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271348953 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271362066 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271429062 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271439075 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271450043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271461964 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271491051 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271501064 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271533012 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271543980 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271563053 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271574974 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271621943 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271632910 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271651983 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271688938 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271699905 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271711111 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271739960 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271750927 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271770000 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271780968 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271827936 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271838903 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.271881104 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275739908 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275844097 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275854111 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275892973 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275903940 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275927067 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.275943041 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.275981903 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.275984049 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276002884 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276012897 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276036024 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276046038 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276153088 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276163101 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276174068 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276221037 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276230097 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276283026 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276292086 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276376009 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276386023 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276408911 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276417971 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276444912 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276459932 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276510954 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276520014 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276570082 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276580095 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276602030 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276612043 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276664019 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276674986 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276693106 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276702881 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276746988 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276757002 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276802063 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276812077 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276839972 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276849031 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276859045 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276926041 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276936054 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276945114 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.276997089 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277007103 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277018070 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277028084 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277046919 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277057886 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277076960 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277086973 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.277107954 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280848026 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280863047 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280883074 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280894041 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280905008 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280915976 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280936003 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280946016 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.280997992 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281009912 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281055927 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281055927 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.281066895 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281107903 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.281116009 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281126022 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281152964 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281208992 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281219006 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281229019 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281248093 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281256914 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.281297922 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.321985006 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.322228909 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.322341919 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.322341919 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.322400093 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.347960949 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.348113060 CET	49709	6677	192.168.2.3	4.251.123.83
Nov 12, 2024 14:51:30.353008986 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:30.380223989 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:31.082053900 CET	6677	49709	4.251.123.83	192.168.2.3
Nov 12, 2024 14:51:31.096847057 CET	49709	6677	192.168.2.3	4.251.123.83

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 14:51:38.188911915 CET	53	63433	1.1.1.1	192.168.2.3

Target ID:	0
Start time:	08:51:21
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\FaZM14kDMN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\FaZM14kDMN.exe"
Imagebase:	0x460000
File size:	743'424 bytes
MD5 hash:	97ED8DE2B68681E9E8269683438D9178
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1452433037.0000000000462000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1536174338.0000000002934000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1536174338.000000000294D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	23.5%
Total number of Nodes:	17
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB118B8D6B Relevance: 12.4, Strings: 9, Instructions: 1123COMMON

Download Yara Rule

Strings

6gn, xrefs: 00007FFB118B8FA7
0Wqn, xrefs: 00007FFB118B8FCB
8hin, xrefs: 00007FFB118B9565
8hin, xrefs: 00007FFB118B9551
0Wqn, xrefs: 00007FFB118B94C7
0Wqn, xrefs: 00007FFB118B93F6
0Wqn, xrefs: 00007FFB118B9431
{, xrefs: 00007FFB118B8F7C
0Wqn, xrefs: 00007FFB118B946C

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 6gn$0Wqn$0Wqn$0Wqn$0Wqn$0Wqn$8hin$8hin${
API String ID: 0-859329970
Opcode ID: 44ad566131e4bd8f0eda82ff161d729da0529d1531c3a5a2ffbf461b338d39aa
Instruction ID: 534cf02eba889bd478ab355f4ab9255b24d0f6eaa45e1d592ba6e0e96bb27837
Opcode Fuzzy Hash: 44ad566131e4bd8f0eda82ff161d729da0529d1531c3a5a2ffbf461b338d39aa
Instruction Fuzzy Hash: 34621AE1E1CE5A4FE7589A3CD4552B977D6EF95320F14807EE48EC32C3EE19A8428385

Function 00007FFB118B9A1D Relevance: 10.9, Strings: 8, Instructions: 879
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(Qhn, xrefs: 00007FFB118B9E48
(Qhn, xrefs: 00007FFB118B9EE5
6gn, xrefs: 00007FFB118B9FC4
6gn, xrefs: 00007FFB118BA079
6gn, xrefs: 00007FFB118BA0ED
(Qhn, xrefs: 00007FFB118B9DD6
Xjn, xrefs: 00007FFB118B9C2D
(Qhn, xrefs: 00007FFB118B9F37

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 6gn$6gn$6gn$(Qhn$(Qhn$(Qhn$(Qhn$Xjn
API String ID: 0-1334992946
Opcode ID: 6d0efe817b69ddf1c8e63c2d53208fef5874f60db1d0b041e3e9aa5eaa3a7e36
Instruction ID: 3f14e327f4689008a15011b7da7266b8e1838ec32d11862af73dc34df0f78a2e
Opcode Fuzzy Hash: 6d0efe817b69ddf1c8e63c2d53208fef5874f60db1d0b041e3e9aa5eaa3a7e36
Instruction Fuzzy Hash: C74207B1E1CE494FEB98DB7CC8556B877D2EF59320F0481BAD44DC7292EE24AC428785

Function 00007FFB115A945D Relevance: 6.4, Strings: 4, Instructions: 1385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(Qhn, xrefs: 00007FFB115AB62B
qn, xrefs: 00007FFB115ABB99
Xjn, xrefs: 00007FFB115AB582
(Qhn, xrefs: 00007FFB115AB5F6

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: (Qhn$(Qhn$Xjn$qn
API String ID: 0-4129160544
Opcode ID: e2d6008198987e3d06f713c43a3deab813da58ac3b9cf936f4f4ee8f9256963e
Instruction ID: 4cfc31c375e9c15936f21e7c9dcd90a9e07ce9bdee9ba1c3d54ea65485a73312
Opcode Fuzzy Hash: e2d6008198987e3d06f713c43a3deab813da58ac3b9cf936f4f4ee8f9256963e
Instruction Fuzzy Hash: D482D371A0DE494FD798DB2CE455A697BD2FF99310B4505BFE08AC72A3DE24EC018781

Function 00007FFB118C1AC5 Relevance: 3.4, APIs: 2, Instructions: 425libraryencryptionloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 00007FFB118C1B88
CryptUnprotectData.CRYPT32 ref: 00007FFB118C1DE5

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID: CryptDataLoadUnprotect
String ID:
API String ID: 4125700225-0
Opcode ID: cc002224a181add9f44a0ee61e4fc308124180c42765e7718a821eeca3a0a02e
Instruction ID: 6f0679b36c99c3c0b19b527dac539c8cf85060c1ee824a9c9377e8694e55d5ed
Opcode Fuzzy Hash: cc002224a181add9f44a0ee61e4fc308124180c42765e7718a821eeca3a0a02e
Instruction Fuzzy Hash: 65D1D47191CB8D8FDB68DF28D8457E97BE1FB55320F00826AE84DC7281DB74A9458BC1

Function 00007FFB11695B15 Relevance: 3.3, Strings: 2, Instructions: 837COMMON

Download Yara Rule

Strings

0#qn, xrefs: 00007FFB11695DB5
/gn, xrefs: 00007FFB116961D0

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn$/gn
API String ID: 0-3623234180
Opcode ID: 0d73ed543b3f39ffde9d841138d264dadeafa58784abef8aac1369ab24dbc1ff
Instruction ID: 1c5c092e24e318a19b0915b82bd0e99c435cc490a5ee422b282ec199321269e0
Opcode Fuzzy Hash: 0d73ed543b3f39ffde9d841138d264dadeafa58784abef8aac1369ab24dbc1ff
Instruction Fuzzy Hash: 1842C6B1A18E4D8FEB94EF2CD854A6977E2FF58320B0401BAE44DC729ADE25EC41C741

Function 00007FFB118BA6F9 Relevance: 3.2, Strings: 2, Instructions: 734COMMON

Download Yara Rule

Strings

6gn, xrefs: 00007FFB118BAB2A
6gn, xrefs: 00007FFB118BABA8

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 6gn$6gn
API String ID: 0-3083245878
Opcode ID: 7c2f4c1b0496728318373f053181e273f1c3f98dc3c8e99758c8184ff148f747
Instruction ID: 98a04e31c821088b3e3677e2fa562702328405286fb7efbbdd5b6bc196af2bce
Opcode Fuzzy Hash: 7c2f4c1b0496728318373f053181e273f1c3f98dc3c8e99758c8184ff148f747
Instruction Fuzzy Hash: C222D661B1CE494FE798A73CD8556B8B7D6EF99321F0880BAE48DC72D3DD186C428385

Function 00007FFB116A8910 Relevance: 3.2, Instructions: 3215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd2ff307e2eced80d8a627427bb56aa339b9008c2b22d5ff2fcf14ba048699c
Instruction ID: ef11682e5f3ec55b9ea1be247590a36ee9bb56411fb27cf4a301ec65169fe14f
Opcode Fuzzy Hash: cdd2ff307e2eced80d8a627427bb56aa339b9008c2b22d5ff2fcf14ba048699c
Instruction Fuzzy Hash: 7F438270A1DB858FD7B8DB28D4856AAB7E6FF98310F10457ED48DC3291DE35A841C782

Function 00007FFB115AA59F Relevance: 2.4, Strings: 1, Instructions: 1175COMMON

Download Yara Rule

Strings

qn, xrefs: 00007FFB115AACEC

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: qn
API String ID: 0-4052135983
Opcode ID: 9f33fd19d709a8c59e20c47170139cdf45f84e442affa85b8297ff31117a6552
Instruction ID: ac340d0d9cbf7a59093be42a3ee6f4b62d2ddc944b3db5410009a397b71868ea
Opcode Fuzzy Hash: 9f33fd19d709a8c59e20c47170139cdf45f84e442affa85b8297ff31117a6552
Instruction Fuzzy Hash: EC82C371B1DE498FD7A9EB2CD450A28B7E3FF94310B5444BAE04EC72A6DE25EC058781

Function 00007FFB115A1660 Relevance: 2.3, Strings: 1, Instructions: 1026COMMON

Download Yara Rule

Strings

Xjn, xrefs: 00007FFB115A174D

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: Xjn
API String ID: 0-306029680
Opcode ID: 763b5055a50568f8cd5296faa96a24c9332c7cdc277ec29e6072c1f930e64abf
Instruction ID: dc858b6e082215e8d0c3180645dc29b7246d3f8349bef0b704575ccf018a3028
Opcode Fuzzy Hash: 763b5055a50568f8cd5296faa96a24c9332c7cdc277ec29e6072c1f930e64abf
Instruction Fuzzy Hash: BE52B461B0DE894FE759D63CD8A56747BE2EF96360B1401BBD04EC72E3DE18AC428781

Function 00007FFB115AC4CA Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

LF_H, xrefs: 00007FFB115AC62F

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: LF_H
API String ID: 0-3249881554
Opcode ID: f0e27d9d1892ed2e169bf5a62eb4c9249ef30b5d7714ad65587bdd6ccd966b47
Instruction ID: 1b861c4b810f93233a7cb7d49c65f5e313b3f6b0c817186b41e5ef44a7573bd9
Opcode Fuzzy Hash: f0e27d9d1892ed2e169bf5a62eb4c9249ef30b5d7714ad65587bdd6ccd966b47
Instruction Fuzzy Hash: 5E2293A1B1DE494FE798DB2CE85567877D2FF95320B5801BEE04EC72A7DE24AC018781

Function 00007FFB118C9B30 Relevance: 2.0, Strings: 1, Instructions: 763COMMON

Download Yara Rule

Strings

"9gn, xrefs: 00007FFB118C9BDF

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: "9gn
API String ID: 0-2155075465
Opcode ID: 3941f062c26718bd572d5f8472ac14f0633d2bae0e57d720889a1072f33988be
Instruction ID: e3910f09577eeddf228cf833578f077dfe4bd1e9a7596e060fc42cf46cac79c9
Opcode Fuzzy Hash: 3941f062c26718bd572d5f8472ac14f0633d2bae0e57d720889a1072f33988be
Instruction Fuzzy Hash: ED529470918A4D8FDB45EF68C495AEDBBB2FF58300F1481EAD40AD7286DB35B841CB91

Function 00007FFB1138AEF0 Relevance: 2.0, Strings: 1, Instructions: 743COMMON

Download Yara Rule

Strings

r6gn, xrefs: 00007FFB1138B184

Memory Dump Source

Source File: 00000000.00000002.1550722126.00007FFB11380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11380000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: r6gn
API String ID: 0-1076010774
Opcode ID: 73bc9044186cdeaf937f34e8fd6dac4124cdd30e3a370ce68f8991849e964121
Instruction ID: a6e63a35bdf526a8ddeae8730975fe786cc9336126ec1d5c487f59d8966577e7
Opcode Fuzzy Hash: 73bc9044186cdeaf937f34e8fd6dac4124cdd30e3a370ce68f8991849e964121
Instruction Fuzzy Hash: 9562C5B0E0462D8FDBA8DF68D895BACB7B2FF58310F1041A9D44DE7255DA34AA81CF40

Function 00007FFB116A6B18 Relevance: 1.0, Instructions: 976COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30810df91d9ed7f70fd620cf1ec06bb87cc71d0452bfa3d2c9499db610516331
Instruction ID: cc490020cb3912dc9ea712ffe8b95b03e9b31d27d9d0615ef1cee36d93ff24ca
Opcode Fuzzy Hash: 30810df91d9ed7f70fd620cf1ec06bb87cc71d0452bfa3d2c9499db610516331
Instruction Fuzzy Hash: B762B271A18E498FDB98DB28C851A75B7E2FF98310B54067ED08AC3696DF35F842CB41

Function 00007FFB118C65AA Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8bd28bdff8dc2ae6c435f99402b3a305c42b8838df1f506a57427f948ef027
Instruction ID: 0d4f13a6775553a631ce852d57f0e6938d7a88713c3d19cb352232befb82cca2
Opcode Fuzzy Hash: 3c8bd28bdff8dc2ae6c435f99402b3a305c42b8838df1f506a57427f948ef027
Instruction Fuzzy Hash: 55629670914A1A8FDB48DF18C481BB9B7B2FF88300F5485AAD41AD7686CB34F991CF91

Function 00007FFB116AD245 Relevance: .8, Instructions: 750COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ce1d19ccfb6ca5c54b9b7f915f5ebb8ed5a0ce10c53031a7eadc2818c28ac9
Instruction ID: eb306d3d578d6e2818ab99df908d7b67d3ce170246d284945593d67de742a00b
Opcode Fuzzy Hash: 05ce1d19ccfb6ca5c54b9b7f915f5ebb8ed5a0ce10c53031a7eadc2818c28ac9
Instruction Fuzzy Hash: 2C424F70A18A098FEB98DB68D894BA9B7E6FF54310F1081BDD44EC7291DE35F881CB45

Function 00007FFB118B35EC Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a820889fdb08e2be1e523302c75364b698015a16ff11fbb3d574ce3bc250ae
Instruction ID: 7ebe054317d09e7a76e00ccdd5da46a399e7093af19ffc50d7f3bac6f643102c
Opcode Fuzzy Hash: 29a820889fdb08e2be1e523302c75364b698015a16ff11fbb3d574ce3bc250ae
Instruction Fuzzy Hash: 3E42F47091CE8A4FEB68DB28C8157A47BE1FF55310F1481BEDC4DCB292DA38A945C786

Function 00007FFB116AB810 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b6c98d79abbb19c718f0f11f47b499a77cda491330a79f63362b82a0e45c54
Instruction ID: c72b5c67cd36eacc3ac9ca4219007576db56f3bf43fb0b0a41c4dcb7f2653b81
Opcode Fuzzy Hash: 26b6c98d79abbb19c718f0f11f47b499a77cda491330a79f63362b82a0e45c54
Instruction Fuzzy Hash: E112E7B1A1DE464BE75CAB3CE85667973D6FF84360F44057DE44EC32C7DE2AA8428281

Function 00007FFB116AD2C0 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907cc3d1e7e217164270363d73c9c41f399d45a08b297cca635f67073894c9ec
Instruction ID: 4602f8925c75172c469e4a3448730492a433de924161562c2d44000a792ac852
Opcode Fuzzy Hash: 907cc3d1e7e217164270363d73c9c41f399d45a08b297cca635f67073894c9ec
Instruction Fuzzy Hash: C3029471B1CE064FDB99EA68C481A71B3E2FFA4320B14817DD44EC3686DE26F846C785

Function 00007FFB116A41DD Relevance: 8.0, Strings: 6, Instructions: 535
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0Xqn, xrefs: 00007FFB116A431B
0#qn, xrefs: 00007FFB116A42B0
x!qn, xrefs: 00007FFB116A42E2
x!qn, xrefs: 00007FFB116A42CB
0Xqn, xrefs: 00007FFB116A42FD
0#qn, xrefs: 00007FFB116A4299

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn$0#qn$0Xqn$0Xqn$x!qn$x!qn
API String ID: 0-3000527940
Opcode ID: e73fc94e42623e9d38966a1574a3265362c33663ce145cbbc7a127d7c94b537e
Instruction ID: d5fc10df98f290791f96c979b29bccbc9f137e55d7e43bdad28940e17031b2d4
Opcode Fuzzy Hash: e73fc94e42623e9d38966a1574a3265362c33663ce145cbbc7a127d7c94b537e
Instruction Fuzzy Hash: F8F1AE61719D494FEB94EB3CE894B757BD6FF99310B0940BAD04DC72A6DE26EC428380

Function 00007FFB116A42C2 Relevance: 7.8, Strings: 6, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0Xqn, xrefs: 00007FFB116A431B
0#qn, xrefs: 00007FFB116A42B0
x!qn, xrefs: 00007FFB116A42E2
x!qn, xrefs: 00007FFB116A42CB
0Xqn, xrefs: 00007FFB116A42FD
0#qn, xrefs: 00007FFB116A4299

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn$0#qn$0Xqn$0Xqn$x!qn$x!qn
API String ID: 0-3000527940
Opcode ID: 4e14e09d0131288d5608feefb55c2d9bbe489dcbec5224025cd0a070bb568c71
Instruction ID: db5b6c91ceb98b929207d2567a45f63c566edcc5bd9c7bfc77b4b73cf71ad2f5
Opcode Fuzzy Hash: 4e14e09d0131288d5608feefb55c2d9bbe489dcbec5224025cd0a070bb568c71
Instruction Fuzzy Hash: 62712870719D494FEBE4EB3CD898B7567D6EF98310B4A00B5E44EC72A6DE25EC428740

Function 00007FFB116A4DDE Relevance: 7.3, Strings: 5, Instructions: 1012
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6_I;, xrefs: 00007FFB116A541B
}in, xrefs: 00007FFB116A543A
Xkmn, xrefs: 00007FFB116A51C9
Xkmn, xrefs: 00007FFB116A517E
}in, xrefs: 00007FFB116A5410

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: }in$ }in$6_I;$Xkmn$Xkmn
API String ID: 0-3633421761
Opcode ID: 683ceb3bed6dbd33087c5c0a53b6210cf6a5e9d786bb158f539066e4226be3ec
Instruction ID: 50c5f726abdf97369ec0eabbf0ab303536218f0d8f8c7bf67d427b44966d9750
Opcode Fuzzy Hash: 683ceb3bed6dbd33087c5c0a53b6210cf6a5e9d786bb158f539066e4226be3ec
Instruction Fuzzy Hash: 5862E571A09E098FEB98EB3CD855AB477E6FF95314B1441B9D049C72A2DF26EC42C780

Function 00007FFB115AD3C9 Relevance: 5.2, Strings: 3, Instructions: 1462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_*_H, xrefs: 00007FFB115ADD5E
, xrefs: 00007FFB115ADA72
h*_H, xrefs: 00007FFB115AD460

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: $_*_H$h*_H
API String ID: 0-3796591056
Opcode ID: abfabce4a1edb131a8b297df2a695548fdf9326d57aba8244afa7fce68e170ef
Instruction ID: d2f06f86791a5fef1122623fd74a571e5bf08a829efc851f5a9e290631031e36
Opcode Fuzzy Hash: abfabce4a1edb131a8b297df2a695548fdf9326d57aba8244afa7fce68e170ef
Instruction Fuzzy Hash: 8592E4A1A0EBC94FE795EB3CD8556687FE2EF56320B0901FFD089C71A3D919AC458381

Function 00007FFB11695175 Relevance: 4.5, Strings: 3, Instructions: 725
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b4gn, xrefs: 00007FFB11695570
d, xrefs: 00007FFB116953DE
b4gn, xrefs: 00007FFB116954AA

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: b4gn$b4gn$d
API String ID: 0-2326012508
Opcode ID: 95aff77bda521cde2893980910971dfbbd3cdc4c40a72a1d3ab98e5cb8a0e897
Instruction ID: 2ebe67f82a0d97cafab72761d3bf34b2187f4b27b2bcb4f1c14fbec2643c45ea
Opcode Fuzzy Hash: 95aff77bda521cde2893980910971dfbbd3cdc4c40a72a1d3ab98e5cb8a0e897
Instruction Fuzzy Hash: F222D1B0A1CF498FD758DF2CD881575B7E2FF95320B14467ED08AC7296DA26F8428B81

Function 00007FFB116A101C Relevance: 4.2, Strings: 3, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0Xqn, xrefs: 00007FFB116A11A5
x!qn, xrefs: 00007FFB116A1176
0#qn, xrefs: 00007FFB116A10C8

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn$0Xqn$x!qn
API String ID: 0-1616543195
Opcode ID: 594b46ebde60beefe0870a3dd529494e6d7a40ed858e20fbb47c637c9c203dd7
Instruction ID: 2b895744162f43b649a10e2a97c9447aae911f0ccd506ffc525d67f809742332
Opcode Fuzzy Hash: 594b46ebde60beefe0870a3dd529494e6d7a40ed858e20fbb47c637c9c203dd7
Instruction Fuzzy Hash: 67F1B5B1B1DE4A8FEB94DA7CE895AA837E6FF58350B1401B9D04DC7296DE25EC02C740

Function 00007FFB116AFD1B Relevance: 3.2, Strings: 2, Instructions: 725COMMON

Download Yara Rule

Strings

Q$_H, xrefs: 00007FFB116B03EF
/gn, xrefs: 00007FFB116AFF51

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: Q$_H$/gn
API String ID: 0-3512355557
Opcode ID: 477e6e2d57f6f166b28f473ad0dcd2f47f3976e600b1071d2194fbf824fe2670
Instruction ID: 0f2071935474156b186a3df24505bac65e538ff3ca23dcdb8b87a56d6db8985d
Opcode Fuzzy Hash: 477e6e2d57f6f166b28f473ad0dcd2f47f3976e600b1071d2194fbf824fe2670
Instruction Fuzzy Hash: 2832E3B1B1CE494FEB98DB7898556687BE2FF98310F5441B9D04DC32C2DE29AC428786

Function 00007FFB116A143D Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

0#qn, xrefs: 00007FFB116A1480
x!qn, xrefs: 00007FFB116A1495

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn$x!qn
API String ID: 0-4165676532
Opcode ID: dacc7a70a4ff588d115a2b10cb99437aa7640022ee955e8df53177cb8e76f547
Instruction ID: 25f2633e51ff9448926f5f7b9e50f60cb3dac9a3dc755ce34f387e6548c7484a
Opcode Fuzzy Hash: dacc7a70a4ff588d115a2b10cb99437aa7640022ee955e8df53177cb8e76f547
Instruction Fuzzy Hash: 7C126A7061C9458FEB6CAB2CE855BB937D2EF58350F0401BEE44EC72A7DE25EC428685

Function 00007FFB11697E56 Relevance: 3.1, Strings: 2, Instructions: 572COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFB116981D9
b4gn, xrefs: 00007FFB116982AA

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: b4gn$d
API String ID: 0-4291853507
Opcode ID: 584e2a056e5d0386dd3b61dae1c5d58fd172de6008e587e2a0ad9b1904ab4484
Instruction ID: 7a2690c6edfdd72e68f1b2f4c723a32f69085d109ace6bc5dedd163ae521f6a0
Opcode Fuzzy Hash: 584e2a056e5d0386dd3b61dae1c5d58fd172de6008e587e2a0ad9b1904ab4484
Instruction Fuzzy Hash: 9E02A070A18F498FD768DF28D485665B3E6FF94310F14457ED08EC3696DA36B842CB81

Function 00007FFB11696480 Relevance: 2.9, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

/gn, xrefs: 00007FFB116964B2
0pqn, xrefs: 00007FFB116967A0

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0pqn$/gn
API String ID: 0-2245334991
Opcode ID: 443f4bcc19f0dc1996b9e9fff21f8c38675d3e1862c3a4486cd6871e5b665562
Instruction ID: 975fcdbd9488490da18884ff221755b431e9b72b4dd5ab308549ed9aee5ef671
Opcode Fuzzy Hash: 443f4bcc19f0dc1996b9e9fff21f8c38675d3e1862c3a4486cd6871e5b665562
Instruction Fuzzy Hash: 9BA16A70B18E094FDBA4EB2CD858B7977D2FF99321B5401BAD04DC72AADE25AC41C781

Function 00007FFB116A08F5 Relevance: 2.8, Strings: 2, Instructions: 272COMMON

Download Yara Rule

Strings

x!qn, xrefs: 00007FFB116A0AAF
0#qn, xrefs: 00007FFB116A0A59

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn$x!qn
API String ID: 0-4165676532
Opcode ID: 8d2b54c37d873b27cf6d5bfbdf82e56552c3c76a78e2f5438596252399617862
Instruction ID: bfbf38c81539a4ea9c981e0c63c910524a506aa405c7ab9ea58409f4495e1fa4
Opcode Fuzzy Hash: 8d2b54c37d873b27cf6d5bfbdf82e56552c3c76a78e2f5438596252399617862
Instruction Fuzzy Hash: 9981B4B1A0DE494FEB94DF28EC946A937D6FF99314B0500B9E44DC7292DE2AAC01C751

Function 00007FFB115A04FD Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

Xjn, xrefs: 00007FFB115A054B
Xjn, xrefs: 00007FFB115A04FE

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: Xjn$Xjn
API String ID: 0-2928045368
Opcode ID: 3abf6e93550436de94d561cda357833f5ab3f9b88ded86a0f2c10fcf01c1e35a
Instruction ID: 846c5eb5978837981e2ba416378010e064aea920ad0437ba2d318bca66ae250f
Opcode Fuzzy Hash: 3abf6e93550436de94d561cda357833f5ab3f9b88ded86a0f2c10fcf01c1e35a
Instruction Fuzzy Hash: EC1194A2A5DF850FE399DA2C94552257BD2EF99720B5900BFE0CDC73A2DE28AC458341

Function 00007FFB116A004D Relevance: 2.1, Strings: 1, Instructions: 817COMMON

Download Yara Rule

Strings

|n, xrefs: 00007FFB116A08CD

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: |n
API String ID: 0-1143524962
Opcode ID: eaaa6afe7c3078788ecc67748e94b9328ae0cee9e22f2d81b9c92b4fcb8d6aab
Instruction ID: 5f87e66cfd3b7fa42a445cbed545e7fba4fb19c51e02c0a7fd903ad9c3248b75
Opcode Fuzzy Hash: eaaa6afe7c3078788ecc67748e94b9328ae0cee9e22f2d81b9c92b4fcb8d6aab
Instruction Fuzzy Hash: 09322AA2A0EE4A4FE799D63CE8552757BD2EF95320B4801BED44DC71D7DE26EC068380

Function 00007FFB1169F9BA Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

b4gn, xrefs: 00007FFB1169FA0C

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: b4gn
API String ID: 0-331291879
Opcode ID: f6bf00a1539d7ec316c9da3ecb31db8d4ed930e1a1964013b4aeed5f5c47a83e
Instruction ID: 02403b44ca37773fa1c4fc1e650c83677b8b951fe6d47e24596e34a54f281bcb
Opcode Fuzzy Hash: f6bf00a1539d7ec316c9da3ecb31db8d4ed930e1a1964013b4aeed5f5c47a83e
Instruction Fuzzy Hash: DB121671A1CF0A4FE7589E3CD8855757BD6FF94320F1406BED44AC329ADE26E8428782

Function 00007FFB116A30D0 Relevance: 1.9, Strings: 1, Instructions: 638COMMON

Download Yara Rule

Strings

b4gn, xrefs: 00007FFB116A355A

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: b4gn
API String ID: 0-331291879
Opcode ID: 871733fc55275d8fc2f43ff8e681c4cf7096044e7ed3f3fa5a6ff422ec584111
Instruction ID: bc85eb99955d840fd13c07483ad0770fe9f82351b10eeefbd978425895f7799a
Opcode Fuzzy Hash: 871733fc55275d8fc2f43ff8e681c4cf7096044e7ed3f3fa5a6ff422ec584111
Instruction Fuzzy Hash: 341243B190DF854FE728DB38E841571B7E2FF95320B1445BED08AC7293DA6AB846C781

Function 00007FFB11389228 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32 ref: 00007FFB11389364

Memory Dump Source

Source File: 00000000.00000002.1550722126.00007FFB11380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11380000_FaZM14kDMN.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 13db72b840b5b0bd0f966133bac96dac461f8b061e004cb043c7a02221effa50
Instruction ID: 0521885e1953410e31b1a924d00af67b0a6c243cd4ffe1d786e2981ea44a67a9
Opcode Fuzzy Hash: 13db72b840b5b0bd0f966133bac96dac461f8b061e004cb043c7a02221effa50
Instruction Fuzzy Hash: C35105B1908A5D8FEBA8DB18DC457E9B7E1FB95320F1042AAD04DD3181DF74A986CF81

Function 00007FFB11386BCA Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE ref: 00007FFB1139FFA2

Memory Dump Source

Source File: 00000000.00000002.1550722126.00007FFB11380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11380000_FaZM14kDMN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ddc8d54c5370b3dc098eb81e180aea134123d7d9da611d62e3d0b1f3c7405c4d
Instruction ID: 99483a70ac43d31db05a75b1f98682bbf42fe01b6ef14d08993966f22eea6f5a
Opcode Fuzzy Hash: ddc8d54c5370b3dc098eb81e180aea134123d7d9da611d62e3d0b1f3c7405c4d
Instruction Fuzzy Hash: F831B37191CA0C9FDB18DF5CD849AB9BBE0FB69311F00422FE44AD3651DB70B8568B85

Function 00007FFB118B1098 Relevance: 1.6, APIs: 1, Instructions: 112libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFB118B113E

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e7295a3bb8cfaec6585277336502c6b43a04415804f4744a97a6ac07b8d25d24
Instruction ID: 4f4bc34dbaf54aeba24aed22368e90b16fa03cba808e80f5165000d8c99e6cb4
Opcode Fuzzy Hash: e7295a3bb8cfaec6585277336502c6b43a04415804f4744a97a6ac07b8d25d24
Instruction Fuzzy Hash: FE31D37190CA4C8FDB59DB6CD849BE9BBE1EF55320F04826BD049D3242DB74A4168B91

Function 00007FFB11385EAA Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE ref: 00007FFB1139D35E

Memory Dump Source

Source File: 00000000.00000002.1550722126.00007FFB11380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11380000_FaZM14kDMN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5365a69d3fde88f16b0e80d4bf2a531e82a15f034cdb215957e917358370d524
Instruction ID: fb9e88596d9d474cc897d87aa5b8085070118ff0e3c57e8d433420b6585165c3
Opcode Fuzzy Hash: 5365a69d3fde88f16b0e80d4bf2a531e82a15f034cdb215957e917358370d524
Instruction Fuzzy Hash: 34219F71908A1C9FDB58DF58D449AF9BBE1FB69321F00822FD04AD3655DB70A4068B91

Function 00007FFB116A3929 Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

b4gn, xrefs: 00007FFB116A397F

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: b4gn
API String ID: 0-331291879
Opcode ID: 8e199017d9f8e553bf5af694855fda421fa16b78bfe8f1c516c62f2bb709a47d
Instruction ID: 66d6ae4cd296e6c544da17d84213f46a00d57a01c4d7951dcd807c447709902f
Opcode Fuzzy Hash: 8e199017d9f8e553bf5af694855fda421fa16b78bfe8f1c516c62f2bb709a47d
Instruction Fuzzy Hash: 068145B1D1DF8A4FE368DA38E8515B1B7D5EF51320B1402BDD89AC3593EA66F8428380

Function 00007FFB1169E749 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

0Wqn, xrefs: 00007FFB1169E90E

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0Wqn
API String ID: 0-615652192
Opcode ID: c13cdde8c76cc1ab7c0239223dd4c1edd4228916dac15feae3a493bdd35ac23e
Instruction ID: 9c357046385fee90f1a268fd0cc77f56d3871d5b6b4b1811a9ac11b76737eb37
Opcode Fuzzy Hash: c13cdde8c76cc1ab7c0239223dd4c1edd4228916dac15feae3a493bdd35ac23e
Instruction Fuzzy Hash: 7181E561B0CF584FE798AA3CD85567977D2EF95620B4402BFD049C729BDD29AC028382

Function 00007FFB116A50CE Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

Xkmn, xrefs: 00007FFB116A51C9

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: Xkmn
API String ID: 0-287737125
Opcode ID: 8386f8721dbf084c97181b10311b0be41e6b180271058332e8c3d51417a7265f
Instruction ID: 1b329dfe406a72b581f461f879c8278100d03167831433ca07f9f5402f53267d
Opcode Fuzzy Hash: 8386f8721dbf084c97181b10311b0be41e6b180271058332e8c3d51417a7265f
Instruction Fuzzy Hash: 8681E7B1A0EE068FEB58DA38D85567477D2FF95320B5440BED449C7292EF26EC46C780

Function 00007FFB115AC028 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

|*_H, xrefs: 00007FFB115AC05E

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: |*_H
API String ID: 0-1884523319
Opcode ID: a40355424de0d7ac64d962e149995e79d8882b18b54c0aba54dcd03444956052
Instruction ID: 5f35d919bce732a6822ba7044e7c8f8f14e1dca7c6b8799680bb3058cbcf9a3f
Opcode Fuzzy Hash: a40355424de0d7ac64d962e149995e79d8882b18b54c0aba54dcd03444956052
Instruction Fuzzy Hash: F671E5A2A4DBC54FE795DB7CD8956287BE2FF56210B0801FFD089C71A3D919AC45C381

Function 00007FFB115ADD20 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

_*_H, xrefs: 00007FFB115ADD5E

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: _*_H
API String ID: 0-3268709351
Opcode ID: e13b1b8786ddaf3b22f6527aca993db636ada002c08736e0b16359c7c126aa33
Instruction ID: 7fa634dc321fcb625844dd7021a8251fe802c77b3936d0a5c48fd884973f0720
Opcode Fuzzy Hash: e13b1b8786ddaf3b22f6527aca993db636ada002c08736e0b16359c7c126aa33
Instruction Fuzzy Hash: 1971C2A1A5EF894FE3A5EB28D8556287BD6FF55320B4401BFD08DC71A3CD24AC448381

Function 00007FFB1169000A Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

}in, xrefs: 00007FFB116900F0

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: }in
API String ID: 0-3278509968
Opcode ID: 532ac5c5b056f60c62df5a34be903c8476a018ce11570fb06b4e2a92962d2769
Instruction ID: 2d48223ee5d92d022f55a2a361acb62e9ac9ee0f60955b3c39fcc30d71cf5a08
Opcode Fuzzy Hash: 532ac5c5b056f60c62df5a34be903c8476a018ce11570fb06b4e2a92962d2769
Instruction Fuzzy Hash: 6881AEF191CB898FE791DF28C8553A87BE6FF45310F4801AAD088C7296DF392985CB41

Function 00007FFB116A3B69 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

0#qn, xrefs: 00007FFB116A3C8E

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0#qn
API String ID: 0-2001394668
Opcode ID: e55fe1068e60090d61d1c1d84655a6e41cce1948bd2bb0d2c673b6c8a5878b90
Instruction ID: 435709be590ec06caf850e7b6ee0de76d18552b9c942ab817575986667648660
Opcode Fuzzy Hash: e55fe1068e60090d61d1c1d84655a6e41cce1948bd2bb0d2c673b6c8a5878b90
Instruction Fuzzy Hash: E6517861A0EE8A0FE798E63DDC455757BD7EFA6320B1900FAD48EC7183DD5AAC428340

Function 00007FFB1169B31F Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

x^hn, xrefs: 00007FFB1169B41A

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: x^hn
API String ID: 0-4005820709
Opcode ID: fdbf5bd7554e72865ac1763c9d190c3dd61dbd789af1b29c6d1df85f1069fe28
Instruction ID: 212fe22ee6953c2c54265b90796a00ba05dbcc3df9c1bebb3c15faf837dd7e3d
Opcode Fuzzy Hash: fdbf5bd7554e72865ac1763c9d190c3dd61dbd789af1b29c6d1df85f1069fe28
Instruction Fuzzy Hash: B55158A391DF8A4FE315EF3CDC919B57BA1EF51224B5801B7D049C7187EE1AB8468381

Function 00007FFB11699010 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

x^hn, xrefs: 00007FFB1169B41A

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: x^hn
API String ID: 0-4005820709
Opcode ID: feaefd475f848ac290aaf3fe2e0668bc8c490e7f094998eefaaf919e17bf7852
Instruction ID: 47eb53856f0b47ddbceac43ec4a60687e90a613bce3f13d279da36cced9025fb
Opcode Fuzzy Hash: feaefd475f848ac290aaf3fe2e0668bc8c490e7f094998eefaaf919e17bf7852
Instruction Fuzzy Hash: 59312C63E1DD4E0FE758A97CD8459BA77D2EF94770B54017BD04EC328AED26B8428380

Function 00007FFB1169B4E1 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

Xjn, xrefs: 00007FFB1169B522

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: Xjn
API String ID: 0-306029680
Opcode ID: d3edce14aa14e0aa960d8c12ca2981310625fbcb775181b276aa11a6f534646f
Instruction ID: 8e7213ba9736f173ffd107e19de55de994d8678a1b4302ca09bded9b69cb00ca
Opcode Fuzzy Hash: d3edce14aa14e0aa960d8c12ca2981310625fbcb775181b276aa11a6f534646f
Instruction Fuzzy Hash: DD4126B2A0CA4D8FEB49DF78DC959AC7BE2FF59310B0401AAD048E3296CA255C01C7D5

Function 00007FFB1169B500 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

Xjn, xrefs: 00007FFB1169B522

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: Xjn
API String ID: 0-306029680
Opcode ID: ec550bb9fe38458e71a2edc07fc67c8eb34747da98b69151125b5e5a4dfb7cda
Instruction ID: 97bc7e7907d18da68def0dd059779b7d74d4965446924e94b6ee75bfd90c63de
Opcode Fuzzy Hash: ec550bb9fe38458e71a2edc07fc67c8eb34747da98b69151125b5e5a4dfb7cda
Instruction Fuzzy Hash: 8A31F6B2E08E0D4FEB88DF6CDC959AD7BE2FF98314B44016AD049E3296CE256C0187D4

Function 00007FFB116967C9 Relevance: .9, Instructions: 944COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3519b6e8f5407bd41ef0c13857481b487877b69edac5433eba3d2d4876cf28
Instruction ID: af04b97b07dd288d3d2d5acf3b1295c8412d87162fd682035c3f9373d865130e
Opcode Fuzzy Hash: 7e3519b6e8f5407bd41ef0c13857481b487877b69edac5433eba3d2d4876cf28
Instruction Fuzzy Hash: 7F626B71A18E498FEB94EF2CC894B6977D2FF58310F4401BAD44DC729ADE29AC45C781

Function 00007FFB116AD2C8 Relevance: .8, Instructions: 767COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a7185a22bb94a404e11e5cd71873001e059a3d96f030256478d7a0439969b8
Instruction ID: 4e9759d3b847fd5533ec61c5a39fccd1f28d72ab7ab8029c2b7d241ff8817f55
Opcode Fuzzy Hash: 83a7185a22bb94a404e11e5cd71873001e059a3d96f030256478d7a0439969b8
Instruction Fuzzy Hash: A132F571A0CE4A4FE758DB2CD851675B7E6FF95320F1441BDD44AC7292DA26F882CB80

Function 00007FFB1169F07A Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6629758d49e623aca53aef73f4ef3fc2d9e8c90ad1e0b7049005dc458a8c32
Instruction ID: d0a021e8bf5ed4a4816dba128c811907d4a1456b7cd1bd92174b0c954a89815f
Opcode Fuzzy Hash: ce6629758d49e623aca53aef73f4ef3fc2d9e8c90ad1e0b7049005dc458a8c32
Instruction Fuzzy Hash: FB22D8A2A1CE4A0FFB999E7CD8511787A93FF94750B5940BED04EC76CBDD1AF8014282

Function 00007FFB116A62E1 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6023dc0d32c86facfadcac5c71802db33ff9194c4075dd2a2e204ef5676c37
Instruction ID: 0fea4e20875cab6044faa8c92a8a8f51bdd280618213c71b03da7925cf34c37d
Opcode Fuzzy Hash: 6a6023dc0d32c86facfadcac5c71802db33ff9194c4075dd2a2e204ef5676c37
Instruction Fuzzy Hash: 3D02D9A2B1DE850FF7599A3CAC551B87BD6EFD9214B4841BEE08EC33D7DD15AC028281

Function 00007FFB116A6E13 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ec7f08b26c8d157698d12787e0fa79efa464c26def5a1782b936a832a2d493
Instruction ID: 73960b9bfde8257f61af0cdbdfcb861aab7554cf897c5e5e0f002c40abcea38b
Opcode Fuzzy Hash: 56ec7f08b26c8d157698d12787e0fa79efa464c26def5a1782b936a832a2d493
Instruction Fuzzy Hash: 83F1F5A1A1DE4A4FE799EA3CD8556B573D2FF98310B54017AD04EC3287DE2AFC468780

Function 00007FFB1169D9C7 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c4ff9e5d741d2c7bb37c1422922e4d3b33956b638d1a8656bc838373d2fbad
Instruction ID: 00218479afcc50101eb6b9b5305525146cf64e1ccbf6da588fde8cb00e1295ba
Opcode Fuzzy Hash: d2c4ff9e5d741d2c7bb37c1422922e4d3b33956b638d1a8656bc838373d2fbad
Instruction Fuzzy Hash: 8AF1B5A1A1CE4E4FEB98EE7CD85567C77D2EFA8310B540179D44DC729ADE29AC028780

Function 00007FFB116A4F27 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ec5d199ea76138fb4104085794d3b6c43c7a32102ff2ec3b15a5f8e51fe910
Instruction ID: e06003b96fa34d88ec7704e55a8d5885e8930b5f40d375474b72f48d918cb036
Opcode Fuzzy Hash: f8ec5d199ea76138fb4104085794d3b6c43c7a32102ff2ec3b15a5f8e51fe910
Instruction Fuzzy Hash: 36F1A371A19E098FEB98EB2CD848A6477E6FF58314F1541B9D04DC72A2DF25EC41CB81

Function 00007FFB116A6CD8 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c110971a99bea2c0d3de566e1812baabce5aecb9f2a10ca23a3b3a4dfe1db6b1
Instruction ID: d69a8b68f01a5d940133c87611b0cddfc67a04d9b243e828416beb1cece0220e
Opcode Fuzzy Hash: c110971a99bea2c0d3de566e1812baabce5aecb9f2a10ca23a3b3a4dfe1db6b1
Instruction Fuzzy Hash: B1E14471A09D0A8FDB98DA2CE490A75B3D7FF98324B5441B9D44DC7689CE26FC82C780

Function 00007FFB116AF922 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92cb7fc88a98868d5ebed85075af13c1583ea31dc92103d0d05cff171b52f3be
Instruction ID: 6a005a2a05c24a62cc4fab3f9045d7bb9840e429dcf4f21bf254bbcab8d94940
Opcode Fuzzy Hash: 92cb7fc88a98868d5ebed85075af13c1583ea31dc92103d0d05cff171b52f3be
Instruction Fuzzy Hash: 33D1E491B1EE5B0BE7A9963DAC2127976D7EF84620B4801FED44AC71C7DE1AEC054283

Function 00007FFB1169C51D Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2681884bf7778d840cb1870bcb6bb6b52bc55dc6b71aa33b0ef06c3f8b658fb2
Instruction ID: 5b6d1fcd316fbb60deb2cd1a698dfe92ce97bec1298616c82a84d3cea41f8a42
Opcode Fuzzy Hash: 2681884bf7778d840cb1870bcb6bb6b52bc55dc6b71aa33b0ef06c3f8b658fb2
Instruction Fuzzy Hash: 28028374D18A1D8FEB98EF69C8956FDB7B1FB58301F4040EA940DE3695DE346A818F40

Function 00007FFB11694C24 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9955fb2d91b7288792148edd1f7e0e3fe9f78e9f33ed6e7a6604666ece6b7447
Instruction ID: 648c3baa8e0badec11000c61b501d567cc3228b02bc79bc26afdb36945b0d873
Opcode Fuzzy Hash: 9955fb2d91b7288792148edd1f7e0e3fe9f78e9f33ed6e7a6604666ece6b7447
Instruction Fuzzy Hash: 6CE1B2B1918B498FEB94EF28C8957A9B7E1FF58314F1401BAD08DC3286DF35A981CB41

Function 00007FFB11697A35 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61962a806f3fd20e1cd8c10a1671f822924f47052979aab413c66ae1dff9aad3
Instruction ID: 93e46c60ebc84e0342bb0750ed1bf7e955f593966b5a706b68e0bf8e4638ec1b
Opcode Fuzzy Hash: 61962a806f3fd20e1cd8c10a1671f822924f47052979aab413c66ae1dff9aad3
Instruction Fuzzy Hash: 4AB1577161CF894FE319DF2CDC855B177E1EFA5320B1801BED489C72A7DA2AA846C781

Function 00007FFB11699110 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f8e085c3225946dac3033417c96211a532f7e2011d2fcdaf04eccf52bc19ae
Instruction ID: 569bba5e2a2433b49503af0128d16179eda7be8a5be7a95f792c56dc65f8ecec
Opcode Fuzzy Hash: d2f8e085c3225946dac3033417c96211a532f7e2011d2fcdaf04eccf52bc19ae
Instruction Fuzzy Hash: 6DC1C6B1A1CF494FE799DF28D8556B9B7E2FF95320F44017ED04AC3286EE25A842C781

Function 00007FFB116A8235 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24cb7977e153611865619d0720dfae030c46e7a9b216a2a8f66621c01b8b813
Instruction ID: 2de90e6ca8c580d4c016451f3f0f76cfce6298db84e803de8c970e3e9b9d65c9
Opcode Fuzzy Hash: d24cb7977e153611865619d0720dfae030c46e7a9b216a2a8f66621c01b8b813
Instruction Fuzzy Hash: CDB189A0B19D064FFBD59A38A8553B523CFEF95762F440079D84DC72D6DD1BEC068281

Function 00007FFB116A8900 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9de2979ebd3e5ae2702f9fa05bcaa213c3a6ec7f1eb0f4ade0bdb83101cb0e8
Instruction ID: ba7896c5aee43d8929a39a95081f35fd9493b20bf5f900366e05fd5d768e5c2a
Opcode Fuzzy Hash: a9de2979ebd3e5ae2702f9fa05bcaa213c3a6ec7f1eb0f4ade0bdb83101cb0e8
Instruction Fuzzy Hash: 30C1D8B191DB864FE774DB28D8452BAB7DAFF94311F04067EC48DC3292DE36A8418782

Function 00007FFB1169E9C8 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d15928c05c1d5e6c736e84a1bc4f80e8f92f62293d12d72a9119f64652f7c4
Instruction ID: b6c343e25cdf2b577f9c52641aef65d3775889d39e0a1e9d188c0f2f56d92c8b
Opcode Fuzzy Hash: 66d15928c05c1d5e6c736e84a1bc4f80e8f92f62293d12d72a9119f64652f7c4
Instruction Fuzzy Hash: 6BB1A4A1A1DE6F4FEBE9DE2C8C5163576D6FF44314B8800B9D84AC768BDE59EC018380

Function 00007FFB116AD2A8 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42b6358653d231e9c1cee93aa4f7f28953bd5434b5b37233c67b8b6f376e91f
Instruction ID: cad9421388ba3ca0c622ab517b8377945bc579b6f3ae0dd09c7b277eb95fc5ef
Opcode Fuzzy Hash: e42b6358653d231e9c1cee93aa4f7f28953bd5434b5b37233c67b8b6f376e91f
Instruction Fuzzy Hash: BCC1A070A18E0A8FEBA4DA68C490771B3E6FF54315F64847DC44987686DB3AF882C780

Function 00007FFB116A2F80 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c052c1299278dbdf7c618659e382dff644e5f6c2aa13a404ed16a197564516be
Instruction ID: 3310a362697eed2135e74de9365db42924ffab6d41aed5acab691b36977854d6
Opcode Fuzzy Hash: c052c1299278dbdf7c618659e382dff644e5f6c2aa13a404ed16a197564516be
Instruction Fuzzy Hash: AAA1E6B1A1DE1A4FE768EA28D845676B3D6FF94310F14417ED44EC3296EE35F8428780

Function 00007FFB11695B30 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8b5457b0660a5edce1959c21928fd4d64f20deec55836b503b9964d39ff2aa
Instruction ID: 05fafbea064ebea5e7c7633e51a509b26af17673a308408a24fe8a1f287772be
Opcode Fuzzy Hash: 9a8b5457b0660a5edce1959c21928fd4d64f20deec55836b503b9964d39ff2aa
Instruction Fuzzy Hash: D791C2B1A18E0E8FE798EF2CD84567673D6FF98360F04027AD44DC3299DE25E8428681

Function 00007FFB116AE0AE Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f58a87d6ffcfd21bab2cf0cdbdf85b0d40f8992d54c350d02085df24965c128
Instruction ID: 920edc019c9d8fe711691de5d35427e8fa69d5de983e9c56fd16b795bae357e9
Opcode Fuzzy Hash: 3f58a87d6ffcfd21bab2cf0cdbdf85b0d40f8992d54c350d02085df24965c128
Instruction Fuzzy Hash: AB81A170B0DE598FEB98DA2CDC456B977E6FF99320F14017AD44AC3292DA25FC428781

Function 00007FFB116AE2F4 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec3734047b1fe87caeea3a6b4eacff4414c1550ba75c22c5379af5b58560971
Instruction ID: 89af7115e063aff85ef711ca6c82acab45732ea9bb51ad7eecc3b703a88d16af
Opcode Fuzzy Hash: 5ec3734047b1fe87caeea3a6b4eacff4414c1550ba75c22c5379af5b58560971
Instruction Fuzzy Hash: F091D271A1CE5A4FEB68EA28D844676B3D6FF94310F14417ED44EC3292EE35F8428781

Function 00007FFB115A22EB Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51645eaf07b5fcc9c0f107d21d9e996a2250a5b66c3b7e2898cd2b8b2a48d26
Instruction ID: b2ef7e407f8ff6174081d0eeb99e4a5dd526d38438d1a91ecaea3017ab9b57c5
Opcode Fuzzy Hash: c51645eaf07b5fcc9c0f107d21d9e996a2250a5b66c3b7e2898cd2b8b2a48d26
Instruction Fuzzy Hash: 8B81E2A1B0DA994FE759962CE4566743BD2EF9A360F1401BBD08EC76E3DD18AC428381

Function 00007FFB116993A3 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7e4ff168be615250b7ceb8f290adfef77f6d1e68a8030d19773a5e9aa82254
Instruction ID: f33f9f452d7c8fdc527033fe9d9b9a13a7f3cef236ca545e490ec2460f04d8eb
Opcode Fuzzy Hash: 1f7e4ff168be615250b7ceb8f290adfef77f6d1e68a8030d19773a5e9aa82254
Instruction Fuzzy Hash: CE91F7B1A1CF4A4FE759DF28D8556B9B7E2FF94310F44017ED04AC328AEE25A846C780

Function 00007FFB115AD189 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55a81ac28c3ab78e94c7cf7a4cd76bbf80cfdc18e0026733da2bbd993872455
Instruction ID: da00954e5e56063c564d685f49ace0e3215d63576d80f6d0e87d0368290d0ede
Opcode Fuzzy Hash: c55a81ac28c3ab78e94c7cf7a4cd76bbf80cfdc18e0026733da2bbd993872455
Instruction Fuzzy Hash: D171A67170CE484FE759DB2CA8655687BE2EF9A32075901EFE48EC72A7DD14AC42C381

Function 00007FFB115ABD6C Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a79a1ada0fcecd4f89bbab8df2466e58137d410b75c0b3be2c85b1d851e3bad
Instruction ID: b7fb3d5ba4488b522c276f6d5ee959bc66c5d39fdff72194306968441aeb1354
Opcode Fuzzy Hash: 7a79a1ada0fcecd4f89bbab8df2466e58137d410b75c0b3be2c85b1d851e3bad
Instruction Fuzzy Hash: B071067170CE884FD798DB2CD855A257BE2EF99720B4501AFE08AC72B3DA24DC428781

Function 00007FFB116A6D30 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527cfc9e77381b3e586cd1dd3292412367f6fdf5903bff56bdc3f99e10fb31f2
Instruction ID: c50a8484235f6555c51b9aa330c28f1cabe46a3901aafa0a0b1915085f3efb96
Opcode Fuzzy Hash: 527cfc9e77381b3e586cd1dd3292412367f6fdf5903bff56bdc3f99e10fb31f2
Instruction Fuzzy Hash: CC719471A19E058FEB68DA28E841A71B3E6FF95321F14457DD08EC3695DE36F842C780

Function 00007FFB115AC268 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a98a66b5c83e48d4b67447a4ec160829c44b14e73818ae22612afa1f8a7786
Instruction ID: 2929687fc4f6d3c7438656c3a20ee356dae1b4a45d1b916cf6634a3398aae7e8
Opcode Fuzzy Hash: 80a98a66b5c83e48d4b67447a4ec160829c44b14e73818ae22612afa1f8a7786
Instruction Fuzzy Hash: 5E61B07170CE484FE798DA1CE455A7977D2EB99720B5501BFE08EC72A2DE21EC428781

Function 00007FFB1169736D Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4036e7c55a3c0b270b4b1f54ab86f5a77427a51a9c076c24e6715760a373a0c7
Instruction ID: 0a0246723fef9720bd0e38fca58423649d87df93f1546a234d4fe601dfaa4c61
Opcode Fuzzy Hash: 4036e7c55a3c0b270b4b1f54ab86f5a77427a51a9c076c24e6715760a373a0c7
Instruction Fuzzy Hash: 5461A37161CD0D4FEB88EF2CD845A7577D6FF99320B1401BAE44DC72A6DE26AC428B81

Function 00007FFB116AB6B1 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b147df00341d235359070572c5d22c8ba51907908015ab75ef5b1dd8768d13
Instruction ID: b1c5bcf8f270d6f69c56a59c175bcb4d1b4978baaeffe239fc10aeb51fcba937
Opcode Fuzzy Hash: 30b147df00341d235359070572c5d22c8ba51907908015ab75ef5b1dd8768d13
Instruction Fuzzy Hash: 8771166190DB854FE76A8638E8252753FE6EF46320F0905FFD48AC7293D91EAC06C342

Function 00007FFB116A3E79 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d41571c2124b053d6d10efec8ee133ad3f94241590d195dcdbbb95de4e18167
Instruction ID: 9664684cde9a254a9cfd9b66020d6a51c7a8bb9476468dc8e060045913b02bf5
Opcode Fuzzy Hash: 7d41571c2124b053d6d10efec8ee133ad3f94241590d195dcdbbb95de4e18167
Instruction Fuzzy Hash: CB61037061DE4A4FE798AB3CEC45AB57BEAEF5532070801BED489C7193EE55EC428381

Function 00007FFB116A2664 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7144d8013a9ea5811015062dd097578b176ebfdb92d54abe48549ba1d74a9e72
Instruction ID: 5a55075906ecaf2900b064ace8626af7cf7b2439e36e09dd2147118c4a578ebb
Opcode Fuzzy Hash: 7144d8013a9ea5811015062dd097578b176ebfdb92d54abe48549ba1d74a9e72
Instruction Fuzzy Hash: 3E51FCA1E1DE1A0BE758963CE84567A77C7EF98370F14017ED84DC3696DE2AEC4242C1

Function 00007FFB116AD5C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ef068484c1d09be10c86d1adbe4d86ef2948a3c5b3dd55dcade8c53cbf8de4
Instruction ID: db2e9a054eae09a0bc1fbf3f74451bb8a6a411d9081b74c411962511542a522c
Opcode Fuzzy Hash: 17ef068484c1d09be10c86d1adbe4d86ef2948a3c5b3dd55dcade8c53cbf8de4
Instruction Fuzzy Hash: 7F61EEA2A1DE8A0FEB5C9A7CE8546B937D2EF69310F04417AD04DC72C7DD25EC468780

Function 00007FFB11698C49 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cc9b8fe640e09f20033462014683003ac267afa15cf4c8efbbcd25f2456502
Instruction ID: f00558a000d44dabff46bb8d3c934eb45220d30f704bcf637ee668a7e9153251
Opcode Fuzzy Hash: e1cc9b8fe640e09f20033462014683003ac267afa15cf4c8efbbcd25f2456502
Instruction Fuzzy Hash: C771266291DB465FD715EB3CE8911F577A1EF00328B1841BBE48CCB183EF2AA8858785

Function 00007FFB116A3018 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 223e7985fdba8dd1c0ce336cc62d513abd4033690604432882a43ad2c1390bb3
Instruction ID: a3738e048161567cb72c812d2c5d86034bc1698c21ae1106d34ba57745ead9d1
Opcode Fuzzy Hash: 223e7985fdba8dd1c0ce336cc62d513abd4033690604432882a43ad2c1390bb3
Instruction Fuzzy Hash: 8061587291EF460BE314E638EC554F077E6EF41324F5841BAE489CB193EE5ABC468385

Function 00007FFB116AE0F0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282762b05f2b3809d69b2b7691ebaf99114d88d01d1b08ae30ec796a718952f6
Instruction ID: 6ef543dea41e5b8204371109064f564065f78a96dd3b5e0f6be9fa2475264023
Opcode Fuzzy Hash: 282762b05f2b3809d69b2b7691ebaf99114d88d01d1b08ae30ec796a718952f6
Instruction Fuzzy Hash: 74518E70A19E198FEB98EA38DC456B973E6FF99321F500179D44AC3291DE25FC428781

Function 00007FFB116A73C5 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765008480e910500260692ab466cfdb26e04cc75f28a8c85a26ed18df62bdfbf
Instruction ID: 80a6366dfc68388ed51a8eb3a18f6eac4f020da6d825f839bab1678a999dac97
Opcode Fuzzy Hash: 765008480e910500260692ab466cfdb26e04cc75f28a8c85a26ed18df62bdfbf
Instruction Fuzzy Hash: 5851BEB1A18E894FDB98EF28D491A7577E6FB98310B1001BED48FC7296DE25E8428741

Function 00007FFB116B01BA Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d2715de89d6d8272d01df723a2888040350e5284675287b431ea76834b3e7e
Instruction ID: e9e3783362dddc476168d35cbb050d72626032e911de7fb1b22ae7634186ec9f
Opcode Fuzzy Hash: 80d2715de89d6d8272d01df723a2888040350e5284675287b431ea76834b3e7e
Instruction Fuzzy Hash: 5F51EBB1B1CE094FE798DB6CD85527877E2EB88324F5441BED04EC3286DE36AC468785

Function 00007FFB116A4901 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f3e2c479f510dcb24cdf8277f314c84ae1c6aef9aa8611563d65c97b5fc730
Instruction ID: 6cb46a0b53c07e91d2223e050545c28c7c4447a4bad8f85bfbd8d505c45bfe3f
Opcode Fuzzy Hash: 10f3e2c479f510dcb24cdf8277f314c84ae1c6aef9aa8611563d65c97b5fc730
Instruction Fuzzy Hash: C9510771A09D4A4FEB84DB3CC891AA577E6FF98310B1C41B9D44DC7296DE26EC01C780

Function 00007FFB116AB77B Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7029e231cf0f0ae68270d2e3409a7a39c0f298c19836d05ff5d589223e9f0a
Instruction ID: fa23e299fd103179e334ae72708601c165d5d7067a388b2b86f432eb7391a40c
Opcode Fuzzy Hash: ce7029e231cf0f0ae68270d2e3409a7a39c0f298c19836d05ff5d589223e9f0a
Instruction Fuzzy Hash: 2951F761A0DBC50FE75A973898252653BE6EF97220F0905FFD08AC7193DD1DAC068382

Function 00007FFB116A7595 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e09ae2fe4b482394ff85cc61132757de33aea17e791c1c5ea53ddc7fb706925
Instruction ID: d7af503aa30b3c007c14de27a1bfc9a1b45900388ca2d608d5d98aa6ecde9c2b
Opcode Fuzzy Hash: 2e09ae2fe4b482394ff85cc61132757de33aea17e791c1c5ea53ddc7fb706925
Instruction Fuzzy Hash: DD4119A2E1EED60FE749A63CD8555B5BBD1EF95360F04017FE08AC32C3DD1AA8058391

Function 00007FFB116A78A8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d27e2b62bf167fabfcb14937684da57d51bf62272800dc9c3a8c5c8f646d00
Instruction ID: 2054a02003f749ada31fd62ebf3bf47aebcc8c3c4a76b54933a605fc2c46392f
Opcode Fuzzy Hash: 03d27e2b62bf167fabfcb14937684da57d51bf62272800dc9c3a8c5c8f646d00
Instruction Fuzzy Hash: 17517070608E058FEB94DF29E495A62B3E6FF58321B14457DD48BC7692CA2AFC81C781

Function 00007FFB116A00A3 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a410d6ef793e43cb7648e27b5f9338752a289f9de517d49879ec92dea8ec2bb6
Instruction ID: c7febfe4e6a1b59beff29aa3ad91982050dd82a59ddcf344084dccda2bcbca72
Opcode Fuzzy Hash: a410d6ef793e43cb7648e27b5f9338752a289f9de517d49879ec92dea8ec2bb6
Instruction Fuzzy Hash: 6741A676A5DE1A4BE7A9966CF8402B563D7EFC5331F544279C40DC3289DE2BFC428280

Function 00007FFB116A2E15 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956a6acea7b03f094cc630eff733db6a994835b4b4b4f9ac0d728697a2901758
Instruction ID: cf08af218fed170f41bd197edd1a8b4859846969e5548903ba33762d4c58b729
Opcode Fuzzy Hash: 956a6acea7b03f094cc630eff733db6a994835b4b4b4f9ac0d728697a2901758
Instruction Fuzzy Hash: 5A5127E2F0EE964BE759977C9C251A83BE6FF55220B0840BAD44DC72C3ED1968068385

Function 00007FFB116A4091 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eac77456e477b0aa646ef45fa0a81cdee807d6d75a3da1710c09be6d43d440b
Instruction ID: b59b65af079e388f2e2ec958bc43509e5eee37235307edd95258b52fff2bb031
Opcode Fuzzy Hash: 2eac77456e477b0aa646ef45fa0a81cdee807d6d75a3da1710c09be6d43d440b
Instruction Fuzzy Hash: 2D41AE71B1DD094FEB98EB2CE854A7537D6FFA932170800B9E44DC7292DE26EC428780

Function 00007FFB116A6CC8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da94383b1c2bf58a43e82a8e453c71e3b7c7a68b2b68e6cad425a5633b1f15ad
Instruction ID: 268144878ab00185a40523808542271e8a37f679dec65e31dabe29efc0f96cb4
Opcode Fuzzy Hash: da94383b1c2bf58a43e82a8e453c71e3b7c7a68b2b68e6cad425a5633b1f15ad
Instruction Fuzzy Hash: 2951C672A09E068FEB64DE2CE8505B6B7E6FFE4360B040579D44AC3585DE26F845C780

Function 00007FFB1169DEAB Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046efdd0b3dc0f62eaf8c6fde11c8b2e3a0d9b1be06ab090d3859dfde83e7fa2
Instruction ID: 9db927f6217f7666fb70d010d1e5d036972b8effad463eebdc5b50914a9b0a83
Opcode Fuzzy Hash: 046efdd0b3dc0f62eaf8c6fde11c8b2e3a0d9b1be06ab090d3859dfde83e7fa2
Instruction Fuzzy Hash: 0C41E8B2A0CE0D4FE794EE6CD8466F8B7C6EBA9230F14017AD44DC3296DD2568428340

Function 00007FFB1169C205 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9468da3ae091163cf883e5923314ad80f9006216745aa439c12b02e08daebbab
Instruction ID: 452ca76c67a4be90eacfef310b4f72e70f1e1ad3637fdaafb4ae64b90240189a
Opcode Fuzzy Hash: 9468da3ae091163cf883e5923314ad80f9006216745aa439c12b02e08daebbab
Instruction Fuzzy Hash: 7151F8B1D08A1D8FEB94EFA8C8546AC7BB6FF59311F5000BAD00DD729ADB35A841CB41

Function 00007FFB1169CACD Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd00b8c338bb22e1686765bdfbfae004bb948760b986fe7a9c8b4ba8af344aa
Instruction ID: 1988f982d022f4f34b973540b5c7727f15cee6d2f0726d2357ff30dc0fb89fb9
Opcode Fuzzy Hash: dfd00b8c338bb22e1686765bdfbfae004bb948760b986fe7a9c8b4ba8af344aa
Instruction Fuzzy Hash: 28510B70918A5D8FDF89EF68D8A5AEDBBB1FF59310F1400AAD40DE7296CB356841CB40

Function 00007FFB1169785D Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d59d0aa962e653302934b4501b62d204fac7acf4089f990b115c8dcffe7c1b
Instruction ID: 7c986a2ff6e0433deb266f52c985959254f3feb6a4725bc1ee4ecc8844d83216
Opcode Fuzzy Hash: c6d59d0aa962e653302934b4501b62d204fac7acf4089f990b115c8dcffe7c1b
Instruction Fuzzy Hash: B1417C70718E0A9FE748EB2CD895A7577D6EFA932071401BEE40DC72AADE25EC41C781

Function 00007FFB1169D76D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839a411041df5ace1397e0c9dac4f0c03b62e2adb34a4163709bdbef2ecb3dfb
Instruction ID: ccb0f6fa4cb73407fc44e7d7dd6ab16b50b3d29a21251bea39c9bf1d79f52c66
Opcode Fuzzy Hash: 839a411041df5ace1397e0c9dac4f0c03b62e2adb34a4163709bdbef2ecb3dfb
Instruction Fuzzy Hash: 46411362619D0A8FDB94EB3CE845AF977D6FF5836570801B2E44CCB256EA15AC8283C0

Function 00007FFB115A031D Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493ca36d8e7bb6fb1d22caeee665cd557815a59b2ea8e4278b83fafa7033e89c
Instruction ID: c0b7794da5fbe722f61b8deb035761cc053d69cf90fa7f716f20e1325b4e317f
Opcode Fuzzy Hash: 493ca36d8e7bb6fb1d22caeee665cd557815a59b2ea8e4278b83fafa7033e89c
Instruction Fuzzy Hash: A541F56160EB854FE756D728D8955B93BE2EF96320B1902FBD089C76F3D918AC068381

Function 00007FFB116AE4B7 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ea2e5cf266cc593c131697c95cc21c983c9435dde5d03a62f03a2eaac75968
Instruction ID: 4395fe33c9cba48ac7bb2ffa4a5497113d60526e0b79683baa2a595c06055582
Opcode Fuzzy Hash: 24ea2e5cf266cc593c131697c95cc21c983c9435dde5d03a62f03a2eaac75968
Instruction Fuzzy Hash: 9A41807165DE1A4FEB98EA28E850675B3D6FF94320F50457DD44EC3286EF2AF8428680

Function 00007FFB116AD358 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da8ccc47cc23faa188f5c49ff04421fc0215b3f7f4ddf4fea2e9cbbfb1b6b2f
Instruction ID: 7ee142414fe54f953c0eacdab1f25460ab149cfb3d70c80f57fc1b25e141ce9d
Opcode Fuzzy Hash: 3da8ccc47cc23faa188f5c49ff04421fc0215b3f7f4ddf4fea2e9cbbfb1b6b2f
Instruction Fuzzy Hash: 6F51C175B0CF964FE7A4CA38C884766BBE2FF55314F088579D4CAC36D1EA69A884C740

Function 00007FFB116AB4B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afbd1e1764920e73905e4656b79ad799bfa97f268766b2c3f3181d0cbefaf23
Instruction ID: e850a1993314c7f8605f1dc0a1945668cd7c996192146c0c5108318524969fa6
Opcode Fuzzy Hash: 3afbd1e1764920e73905e4656b79ad799bfa97f268766b2c3f3181d0cbefaf23
Instruction Fuzzy Hash: C151D2B194EBC64FD3665A74E8542A47BE6EF52330F1904FFC0C98A092EA5E6C86C711

Function 00007FFB1169DBD9 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44abaf7185ae59ef126dcc619ae78b9d4e25a723ae09f14885d8a089f1599b35
Instruction ID: 29bd21991eaeae7cc0756d46337f6fadc8371d8483e77390441e1380fc2b677c
Opcode Fuzzy Hash: 44abaf7185ae59ef126dcc619ae78b9d4e25a723ae09f14885d8a089f1599b35
Instruction Fuzzy Hash: 54415171A18E4D8FEB94EE78D855AAC77E2FF68310F540179D049C7296EE25AC42CB40

Function 00007FFB11698B31 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4b2301c66cf2a9af4440d60101a5a83c4a9c5d96f9eea353af133471542fa1
Instruction ID: 0a8f3e8ee9959a0674facae19e0d7d08cfc551d53fe3239b3f2d8c94d4445a18
Opcode Fuzzy Hash: fe4b2301c66cf2a9af4440d60101a5a83c4a9c5d96f9eea353af133471542fa1
Instruction Fuzzy Hash: CA31097261CE0D4FD788AA3CD8456B577D6FF99360B4501BAD04EC3297DD26A8428380

Function 00007FFB116AC055 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faedf0af4ba0440fd736434c1e92b4dd48aff8d69eb754b11abb6bc4ba8e2f0c
Instruction ID: 9c41fd642e14b1ed08a658197ae6264c543c11542fd1342b5574305c395f3e3f
Opcode Fuzzy Hash: faedf0af4ba0440fd736434c1e92b4dd48aff8d69eb754b11abb6bc4ba8e2f0c
Instruction Fuzzy Hash: 634106B1A0DF464FE7A4DE3CD850562BBE6FFA5360B080579D08AC358ADA26F845C780

Function 00007FFB1169FF47 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb65f62b5cea833735c8e38b7e8b871c5871cea641f9fcfce15beb0a58df4e7
Instruction ID: bfb0b6d91233dc4ddd1748ad4bf114f7a07421cd81fd932fc2cc223ac9af6a60
Opcode Fuzzy Hash: 2eb65f62b5cea833735c8e38b7e8b871c5871cea641f9fcfce15beb0a58df4e7
Instruction Fuzzy Hash: 0531F360A4CE0E0FEBA5AA7CE8845B577C6EF55330B1501FAD40CC719ADD1AAC818382

Function 00007FFB116A24FD Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a430f025d4b3e0e32d89681d77fce35e9e9ffcee49e9192556782b8baceb577
Instruction ID: 8d7523a7d2956e76167daf2be05066559e5dc3d8510ad6355c63fc8d4fe6a56a
Opcode Fuzzy Hash: 7a430f025d4b3e0e32d89681d77fce35e9e9ffcee49e9192556782b8baceb577
Instruction Fuzzy Hash: B531C571B08D194FEBD8EA6CE49867573D2FF9832174500BAD44EC72A6DD25DC828780

Function 00007FFB116A1A41 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71abd9e35d30c593ddc900d0178d8f070bb4e7f200d68dc6c8d157da844a5743
Instruction ID: 9ec54ff453e8977fe3a7aef6e212ae760998c7e886b276c5f84d449078f1f6ee
Opcode Fuzzy Hash: 71abd9e35d30c593ddc900d0178d8f070bb4e7f200d68dc6c8d157da844a5743
Instruction Fuzzy Hash: 3A310961B0DE594FFB95EA7CA89567437C6EF69370B0401BAD84CC3293DD269C428380

Function 00007FFB116A40B0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b84e83c4c774223384d9a1c197afe68c362f62f8f192ac07790e38cd1e6851
Instruction ID: 79edc480fbe31ac778eb78256d2f3412e2b1fd7903202e40d45b85a48a74060b
Opcode Fuzzy Hash: 68b84e83c4c774223384d9a1c197afe68c362f62f8f192ac07790e38cd1e6851
Instruction Fuzzy Hash: 4231AF7171CD1A4FDB98EA2CE855A7537D6FFA932175400B9E40DC7296DE22FC428780

Function 00007FFB116AD642 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d448fb77f6ef4af849d25bbab4bfdb1633da6cdbcccba2d377117b4426d14a65
Instruction ID: 043ce48ddb17b5ad565ed6f677d83641e8cda2420259aaf07c3c86be7f50da64
Opcode Fuzzy Hash: d448fb77f6ef4af849d25bbab4bfdb1633da6cdbcccba2d377117b4426d14a65
Instruction Fuzzy Hash: B941F8A1A0DE850FEB9C9778E8546793BD6EF69320F0840BAD44DC72C7DD1AEC418781

Function 00007FFB1169B368 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ddc06c25eb9c62717a42aaa583974fe1349074141f25b422de668e16423e84
Instruction ID: 30ca85f4920365c260b65552cea6a43f866700e0edfde201bbf94d3284629b03
Opcode Fuzzy Hash: 49ddc06c25eb9c62717a42aaa583974fe1349074141f25b422de668e16423e84
Instruction Fuzzy Hash: 7A41A775A1891D8FDF98EF58D8A4AADB7B2FF58314F14006ED40AE7295CB35A841CB40

Function 00007FFB116ABF55 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834a6053b08d575f57cf033f2e48890c6fb022bad008e9c069c0d2c6ba235a9e
Instruction ID: 3da5780585811274b414a0b6165492bba6fd2938dfb838086cc2ca26fdd49a5c
Opcode Fuzzy Hash: 834a6053b08d575f57cf033f2e48890c6fb022bad008e9c069c0d2c6ba235a9e
Instruction Fuzzy Hash: 5731E6B2A1DA890FEB4CAA2CD8555F977D1EF65310F04007FF44AC3287ED25A8468385

Function 00007FFB116AD660 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a945b8961a5e5b04cff185175a5dfa684527d26138669dd23c10a98ee0a2d3
Instruction ID: 5c66d2ef9e1a408e455be621c845679ba3e79f53affdbc6e057eabc3c8918434
Opcode Fuzzy Hash: c8a945b8961a5e5b04cff185175a5dfa684527d26138669dd23c10a98ee0a2d3
Instruction Fuzzy Hash: 6331E9A1A0DD490BEB9C9A28E85467977C6FF69320F144179E04DC72C6DD26EC418680

Function 00007FFB116A7740 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfa58fb32d19fc8528f156e503d4e685072fcecc160edd774e595f56d3b5b6d
Instruction ID: fbf4dbb45fe9c130850f795160eb6ee6aff0d6cd26488503d755f2c223267f25
Opcode Fuzzy Hash: dcfa58fb32d19fc8528f156e503d4e685072fcecc160edd774e595f56d3b5b6d
Instruction Fuzzy Hash: D631E771A09E064BEB64AA28E8447B673DAEF55360F14017AC44FC3591DE2FBC86C780

Function 00007FFB1169F8C5 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc0ded78d490dfc5c0673da562848c355d4c06837eebc4963d53b5b5b534659
Instruction ID: 6f5df443d653b602d6795767d5fdbb8af02585c9c0b74ff14d4361b59308dc28
Opcode Fuzzy Hash: bcc0ded78d490dfc5c0673da562848c355d4c06837eebc4963d53b5b5b534659
Instruction Fuzzy Hash: 8E31693061CA8D9FDB94EF38C844B647BE6FF59324F0505FAE449C72A6CB29E8448741

Function 00007FFB115AB3AA Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ef51c26fdc84d65c4963c6834479662d6e3911720d155385766d2ee64e4410
Instruction ID: 204bee051173e1d381300d8a613aab4099f6d30b5ffbd617c41c3fc08e71dcc1
Opcode Fuzzy Hash: f1ef51c26fdc84d65c4963c6834479662d6e3911720d155385766d2ee64e4410
Instruction Fuzzy Hash: 6C31507170CE494FEB98EB2CE450A78B7E2FF95320B4445BED04EC72A6DA25EC458781

Function 00007FFB116A760A Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e77ee1a2497caae3c98dd2461e2a1b0fa07b2284d3fed367a0edddd22583df
Instruction ID: 8519272ff474a318749654805e3beeb3f048f170751ef4135b4d97cb9e8773bb
Opcode Fuzzy Hash: 99e77ee1a2497caae3c98dd2461e2a1b0fa07b2284d3fed367a0edddd22583df
Instruction Fuzzy Hash: 2A31EA6291CE910FE74D963CD8565B9BBD1EFA5350F14407FF08EC3693ED29A8068382

Function 00007FFB1169F772 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88eb3b5901e7aaa0a7289eae3fd59282572ec8c19a8f69efc861de12b72007b
Instruction ID: 848da43e457dc5b9cfd3699fd35c1659bae12916758a504230240af84768a750
Opcode Fuzzy Hash: b88eb3b5901e7aaa0a7289eae3fd59282572ec8c19a8f69efc861de12b72007b
Instruction Fuzzy Hash: 5B31C8A290DBC94FE35A9B749C650687FB5EF17220B0E01FBD088CF2E7DD5A68458352

Function 00007FFB1169ED9D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13eced0501adfe7f226c02f8c08efa3b5b601c6d9a824ae54aa66f0cd06ff1e
Instruction ID: 02e9fca460da8b09942f22be306ee36e488243d405d79c5ebbdfca1a11cf7032
Opcode Fuzzy Hash: d13eced0501adfe7f226c02f8c08efa3b5b601c6d9a824ae54aa66f0cd06ff1e
Instruction Fuzzy Hash: BC21EB61F1CE6E4FE794DE3CDC856B577D6EF55320B0401BAD449C3686DD16AC068380

Function 00007FFB116A7701 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e24afd4d8fe597141042d093ee685afc8121e08dd0ce8d561361bf7ee93ef4
Instruction ID: 179dd7c67d2af66396a95441dd517ec89570e15375757c773e9881f4ddbc44e4
Opcode Fuzzy Hash: c8e24afd4d8fe597141042d093ee685afc8121e08dd0ce8d561361bf7ee93ef4
Instruction Fuzzy Hash: E631E46290EF860FE7569678EC545B27BD5EF52230B0801FBC04AC75E3DA1FA885C351

Function 00007FFB116ABF70 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9020d2f53189590d2a8f6b50ea3bec39db86c0101c50f187d8028e0f7e058c
Instruction ID: 5409f65bce38c761d96c9870bfb7c994254b4b1f9f627f707a2bbe21d92fa356
Opcode Fuzzy Hash: 5e9020d2f53189590d2a8f6b50ea3bec39db86c0101c50f187d8028e0f7e058c
Instruction Fuzzy Hash: 4D21A772A2C9494FDF4CAA2CD8469F977D5EB95350F40002FF44FC3687EE25A8468785

Function 00007FFB116AD208 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98d5f14806a4fe019e44765b6418b128b74267b5a3e96967579952569389252
Instruction ID: a1db2a2a584352434c19c97a4fbeecac51243ae2fb37a9747755fe2a49af752e
Opcode Fuzzy Hash: f98d5f14806a4fe019e44765b6418b128b74267b5a3e96967579952569389252
Instruction Fuzzy Hash: 77315DB192CF859AD768AB38C4457B6B7E1EB69310F14452ED08FC3682EF64B4018782

Function 00007FFB1169E9AA Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23798a33bbd8d42d757dc8aad55134ec7d2972071dc5172e15f5b45cd4443e64
Instruction ID: 6c240f3208c62eb9cabfd3a767239698e24c8c069b720b92199f20ae55142616
Opcode Fuzzy Hash: 23798a33bbd8d42d757dc8aad55134ec7d2972071dc5172e15f5b45cd4443e64
Instruction Fuzzy Hash: 7C319E71B28E4A8FD788DF2CD881A6477E2FF5831474501B9D05AC769ACE25FC128780

Function 00007FFB1169BDA0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5334da9ebee540d6f52dfc16d4280d8bde082b363bc0d3d34bbec7dcc1a65439
Instruction ID: 0ab07e88a258be2eacf6c6f8b3d2f280e2f2238fd99b5946325ec6a04fb51b1d
Opcode Fuzzy Hash: 5334da9ebee540d6f52dfc16d4280d8bde082b363bc0d3d34bbec7dcc1a65439
Instruction Fuzzy Hash: FA21B77271CD0D4FD784EB6CD884AB977D6EFAC351F40057AE40DC72A9DD6598818341

Function 00007FFB116A7630 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82bc8cd37f66126d7486f2c1d7be1a3b8d166c7a5d39d03d746b47a725259ce1
Instruction ID: deb59e3c5339178d8f4975da3c9af04992ce7ba4591d1ecfbd4b80df89e7ee76
Opcode Fuzzy Hash: 82bc8cd37f66126d7486f2c1d7be1a3b8d166c7a5d39d03d746b47a725259ce1
Instruction Fuzzy Hash: 5521D872A2CA510FE74CA62CD4469BAB7D1EB98350F40442FF48FC3697ED25A8064386

Function 00007FFB1169D105 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c4b0a6330ba645a2f2063b4edc66a3e8bbde925b88b43467bb10b75f0b619d
Instruction ID: 01c6cfeb35908372c2c1991d8ea6bba006d3515681de2d9ef3c04f0c965e309d
Opcode Fuzzy Hash: e6c4b0a6330ba645a2f2063b4edc66a3e8bbde925b88b43467bb10b75f0b619d
Instruction Fuzzy Hash: DF213A6260CE4D4FD784EB3CC894AB97BD2EFA9350F0401BAE04CC72A7DD199C458342

Function 00007FFB1169C41D Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6307fc709c4f001687522d7163341e3f76e6b6670e1c65ad805b251e6c1ec0
Instruction ID: 35ef1db01db1d131b31165077483cc03c725942d1d1522b9fe3600ef5a1afd19
Opcode Fuzzy Hash: 2d6307fc709c4f001687522d7163341e3f76e6b6670e1c65ad805b251e6c1ec0
Instruction Fuzzy Hash: C4210E7094CA8D8FDB41EF78CC659F93FB5EF09310F0401AAE049C7196CA39A542C782

Function 00007FFB116A4AD4 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40edf705991b51fab06f108a1ed6292a0994f4285fb2b8829a1075bb4b9f5f29
Instruction ID: cc699d2bb22441ca7b2456826374c3ce03e9996a72adfe65ae6edb3fbdd25f79
Opcode Fuzzy Hash: 40edf705991b51fab06f108a1ed6292a0994f4285fb2b8829a1075bb4b9f5f29
Instruction Fuzzy Hash: 8321D8A2B1DD084BE7989A6CFC6177837D7FFD9325B090079E54DD32D2DE1658028349

Function 00007FFB1169B63D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b30175f2ec5537e7ebea11300f139cb11d1ff68eb666444915441849d19eaa
Instruction ID: 29e4b4fb2f02ddab45748c1ad78ba6d5b819f336f5a43ebea294f20ed18ff1a4
Opcode Fuzzy Hash: 17b30175f2ec5537e7ebea11300f139cb11d1ff68eb666444915441849d19eaa
Instruction Fuzzy Hash: 8C21B171808A5D8FDB85EF78CC59AF97BE5EF54320F0405BAD408C7192DB356585CB81

Function 00007FFB116A2F38 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e534f754af579b47fb99908b75f51074faf295d27f405c6a356e54b149fc245
Instruction ID: d8f0c5ece9bed160eacc4e5e70808ab1beb964c071d237c01ebf1d4b34fa964c
Opcode Fuzzy Hash: 1e534f754af579b47fb99908b75f51074faf295d27f405c6a356e54b149fc245
Instruction Fuzzy Hash: 5621F661B5EE2E0EE790A63CBC483B6B3C9EB99235F540A7BD84DC2181DD5E98818341

Function 00007FFB1169726D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2268a8d1db79add4c2bdc78e2cc56f0b51ac0db9511c82c45da6f0d119685ae
Instruction ID: c8549a35712974e2882f1d6c68336967a72e6bb5390f8f151111b8799bbb08eb
Opcode Fuzzy Hash: c2268a8d1db79add4c2bdc78e2cc56f0b51ac0db9511c82c45da6f0d119685ae
Instruction Fuzzy Hash: F621677290CF894FDB42DA38E8419A1BBE1EF95320F0406BBE049C7191CE29E88587C2

Function 00007FFB116A7A15 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e76030d954c5921b712d0666101ce57785f5c5953a78697967c3ed33028c0d3
Instruction ID: 561066d93ac8951b717816ff48556586d47111ac902ce8b040d6b0d708e12cc3
Opcode Fuzzy Hash: 2e76030d954c5921b712d0666101ce57785f5c5953a78697967c3ed33028c0d3
Instruction Fuzzy Hash: 72216270619E058FEB94EB28D494F61B3E2FF54314B4445A8D44EC76A2CF2AFC81CB41

Function 00007FFB116AF701 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517486db25dcd1dbac360135d8bfdd3e52675f22f9a6c55690cf210a7baf3038
Instruction ID: 22b5d7126717df86f5c010eb0cb68561d53d7c455aa90a737c39b91cbd4c14d8
Opcode Fuzzy Hash: 517486db25dcd1dbac360135d8bfdd3e52675f22f9a6c55690cf210a7baf3038
Instruction Fuzzy Hash: 1721F9B1A0DF494FDB94DA34D8555BA7793EF94314B1440B9D04DC36C6DE36E805C342

Function 00007FFB116A1391 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf4abaa623be6cb45306ecde88c9e310aaef10a1387178d6e0d27b1d3172d4e
Instruction ID: 2a7b64f765e3be012d57b93870abf6ab1ba2c53bd8c84ed70dabbb19c44e4292
Opcode Fuzzy Hash: acf4abaa623be6cb45306ecde88c9e310aaef10a1387178d6e0d27b1d3172d4e
Instruction Fuzzy Hash: 4F21DF2050EAC64FC797DB78D864A517FE6EF4722030A01EBD088CF1A3C6199C86C752

Function 00007FFB116A2F20 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fbf1c6550e80e6be13b6e148796b1b1dc419746ba73f91a5a3f287c99217c9
Instruction ID: 94a9a0f4cd7bd00556b4c2bddc7deabbcf8dbaf6d32170c90e73aa13638316c7
Opcode Fuzzy Hash: 94fbf1c6550e80e6be13b6e148796b1b1dc419746ba73f91a5a3f287c99217c9
Instruction Fuzzy Hash: 35212B71A09E0A4FEB649A38E8805BB37D7EF99364F104579D40EC3286CD3AF8418342

Function 00007FFB1169E5F9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab83b0741d78a4ead2dc58a7d079de3c3e784a56bb7ee980fbc4e9cab1bf2bea
Instruction ID: dc1aaab9892fcbba0b0554ff11da816c4e1fa27f69eb7504d5731b395f1c7a22
Opcode Fuzzy Hash: ab83b0741d78a4ead2dc58a7d079de3c3e784a56bb7ee980fbc4e9cab1bf2bea
Instruction Fuzzy Hash: 38213D71918A8D8FDB85EF68C8956ED7FF1FF69310F1501AAE408D3252DB35A540CB81

Function 00007FFB1169AC99 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23676e475b3b3569196488987a5cc13d1ec1668dd9b607f766e872f5f622781d
Instruction ID: 28b07d92bb87aa5ab6b885ea8d01ea7577e0688e0d7f8ceb2c7c615a686fdee3
Opcode Fuzzy Hash: 23676e475b3b3569196488987a5cc13d1ec1668dd9b607f766e872f5f622781d
Instruction Fuzzy Hash: CA110892A0CB9A0FF765496CA8552BA3BD5DF85231F0901BFE888C6187EC1A5C459281

Function 00007FFB116977B8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450254b91bb118d16a093e35e0e310f47132ff5bbe7990db524bfd1f2bef109f
Instruction ID: f2bc0993ca81317a62ad3e6df24f0477cda4205b153f81c83af25d29054bf78d
Opcode Fuzzy Hash: 450254b91bb118d16a093e35e0e310f47132ff5bbe7990db524bfd1f2bef109f
Instruction Fuzzy Hash: D2110470A1CF0A4FDBA99A38C85527573E2FF48321B54457DC04FC6189DE2EE882CB40

Function 00007FFB1169CF2C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6505ff9ed1d48d56ffedeed8648cbddd21dbfd093efb26af5fb5162a59e395a
Instruction ID: 34418c328e6a9172333d6ce603f960e27b709a10d777accee0eaffc7839b4836
Opcode Fuzzy Hash: e6505ff9ed1d48d56ffedeed8648cbddd21dbfd093efb26af5fb5162a59e395a
Instruction Fuzzy Hash: 09112C61A0CE490FE7449A7C6C4A575BBD6DF9A270B0801BBD84CC31EFDD16A8468391

Function 00007FFB115A2119 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80079cdfad33bbbc0d68f65ad16f0d8269d1cdff26d3cb577cab1e5411434479
Instruction ID: c089b983ffaa87e63772d3d2757b83edaa898a7cb44ac465401156427f5aa192
Opcode Fuzzy Hash: 80079cdfad33bbbc0d68f65ad16f0d8269d1cdff26d3cb577cab1e5411434479
Instruction Fuzzy Hash: A3112962A4DE550FE395D62C94962393BD3EFD4360B58007FD04CC73E6DD19AC058346

Function 00007FFB116A7FCD Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87ef0f7cf216be80fb2eac86156d915cb0310c14e3f5ce669afe5a410b9afb8
Instruction ID: fc4410743672c1113fa334e6d8ea2fc66419c9bc4f668b4e775bb2ab49e1183c
Opcode Fuzzy Hash: c87ef0f7cf216be80fb2eac86156d915cb0310c14e3f5ce669afe5a410b9afb8
Instruction Fuzzy Hash: 2D113671A0DE854FE795DA3CD8959617BD6EFA526070C00FEC489C7192D91BEC46C380

Function 00007FFB115A06E0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478adb1bb0acea23d7525e65c9682b1adfec952eecd97ec55533f902f26afa75
Instruction ID: 5ddfc21d2a73a6287b2987c81061f7a6a72f61452ea421305cb394705e26ac96
Opcode Fuzzy Hash: 478adb1bb0acea23d7525e65c9682b1adfec952eecd97ec55533f902f26afa75
Instruction Fuzzy Hash: 7E11B4A2A5DE854FE394963CD8595397BD3EF98320B2801BFD04DC72E6DD28AC428745

Function 00007FFB116A80B1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075792562cad91393eb4623e93d51aebac49892fc8511e9ab8f08052482fd73f
Instruction ID: 4cc363671ccf41c1a0b834797099c32b79451f78b696a609e8c2a34a7d271bce
Opcode Fuzzy Hash: 075792562cad91393eb4623e93d51aebac49892fc8511e9ab8f08052482fd73f
Instruction Fuzzy Hash: E211A561B19E460FEB558B2CF8553B577C6EF8576274400FAD048C7296CD1ABC4687C1

Function 00007FFB116AC227 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05ab9294e92439fe5bd76e29ba07dc84c31ed582e21105275aca712e26dfbd3
Instruction ID: 70a5ad0c4fbf4d357408c5b7a03e085bd054d038e48c4159b4bf3a8a3fb33f23
Opcode Fuzzy Hash: e05ab9294e92439fe5bd76e29ba07dc84c31ed582e21105275aca712e26dfbd3
Instruction Fuzzy Hash: E911A372A08E194BEB64DA69E4415FBB3E6EFD4321F00463BD58EC3544DB26E4458780

Function 00007FFB1169F7F5 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4272b564e643ddbf2f1b22160f92536f36a09cab3b1a6212276e2243c4160443
Instruction ID: 30c87332273127787802cbf43f239b95b35e2692e201272f8db0fd6eeaa1db4e
Opcode Fuzzy Hash: 4272b564e643ddbf2f1b22160f92536f36a09cab3b1a6212276e2243c4160443
Instruction Fuzzy Hash: 2501B59294EFD50FE39A4A784D650643FF1EF5622170F00EFD089CB6E7D90E18458382

Function 00007FFB116A4892 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc678e82ff37d861ceda5d79dac08658e49a6bbb67a4988b55febdb9f3b388ab
Instruction ID: 664aa9944afbd6f442258a79c10affadc01886537f65ef5141fbe3a042e46f80
Opcode Fuzzy Hash: cc678e82ff37d861ceda5d79dac08658e49a6bbb67a4988b55febdb9f3b388ab
Instruction Fuzzy Hash: 84014C7160DE8A4FDB95E72CEC686247BE6EF9922070E01E3D008CB2A7DA59EC45C751

Function 00007FFB116979B9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4188e91e1501996ed139fa1ef33ffe354d463bf7110d1329c04d630789d4c1d
Instruction ID: 82cffdfee78e78d8efca69d493a8f2c78900f4e78290c4ac38f914c4f21018e4
Opcode Fuzzy Hash: f4188e91e1501996ed139fa1ef33ffe354d463bf7110d1329c04d630789d4c1d
Instruction Fuzzy Hash: C8012D7110CF895FC741DB38E80569177D5FF85220F0445BBE888C7192D92DD946C782

Function 00007FFB1169BAE5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fce6a184396b0f88c02873824af6a76efebf2fb5e1011889c6ca111000d66a
Instruction ID: 444ce04bb23575da8d63db4bc089bd5938638c95879bdbc251131bd2b0930a10
Opcode Fuzzy Hash: f3fce6a184396b0f88c02873824af6a76efebf2fb5e1011889c6ca111000d66a
Instruction Fuzzy Hash: 7F117070918A4C8FCF89EF28C899AE93BF0FF28305F05016AE849D7251DB35E550CB81

Function 00007FFB115A07CE Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1552851615.00007FFB115A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB115A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb115a0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fe9dee04666d49c49848cc37b0145293ba604990b6ff11436cb390740478b2
Instruction ID: dd55d79eedc4cebdd2bb7545e28def8908676e5705c7a39c26b981807248eac1
Opcode Fuzzy Hash: 92fe9dee04666d49c49848cc37b0145293ba604990b6ff11436cb390740478b2
Instruction Fuzzy Hash: 0A118270A1DE869FDBA5E728D864A2977D2EF54310B5801AEE04DC72D6CE28EC41C781

Function 00007FFB116AD338 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dcc45f24feac1fa8e8da7fe6fa9f3b1fd424aa00697031bcd7216939b03ae45
Instruction ID: a7101103a61c1ccb29668ca2600a97a0cbeaee2cf545862dd47f8d486e05b15d
Opcode Fuzzy Hash: 5dcc45f24feac1fa8e8da7fe6fa9f3b1fd424aa00697031bcd7216939b03ae45
Instruction Fuzzy Hash: 4111E960A1CF954AF77582B9D4453757BD55F12328F0884BCC4CA426C2CA9EBCC6C355

Function 00007FFB1169BB00 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83957a127fccb29f015c05e692ea847067dd7955f696d39b4c7ce8e1eb05f92f
Instruction ID: 2bc3f46e07ee2043d8e6d10a03ed473e06bd1c97a56ed47acb3ed684fc19418d
Opcode Fuzzy Hash: 83957a127fccb29f015c05e692ea847067dd7955f696d39b4c7ce8e1eb05f92f
Instruction Fuzzy Hash: 7E01DA70914A4D8FDF88EF68C899AFE7BF1FB68305F00056AA819D3250DB31E591CB81

Function 00007FFB116A80FC Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d4a2e64d0158753d001428c9708c430c28157330c2a8f92f15a7981fd94dd9
Instruction ID: fa2121450d04e4fdc1e73f479da0e8e3a6c328e391999c8b1ba14f516a02e467
Opcode Fuzzy Hash: e7d4a2e64d0158753d001428c9708c430c28157330c2a8f92f15a7981fd94dd9
Instruction Fuzzy Hash: A8018150B19E060FEBA59B2CE84537563CBEF99752B4400BED049C729ACD1AAC0282C1

Function 00007FFB116A48B0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36133d7778a83114b6db4bc83ed0ffc0940eccf56c4012d019a78a10cb70686
Instruction ID: eac534946b9594ac0a4103da42c948ca2b5158505905a8e8b6d2a216225c7b63
Opcode Fuzzy Hash: e36133d7778a83114b6db4bc83ed0ffc0940eccf56c4012d019a78a10cb70686
Instruction Fuzzy Hash: D4F0D030705C0E8F9B94F72CE858A2573D6EF9832175A02A6E40DC7269DE64DC52C781

Function 00007FFB116AB3F5 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cdd4b398359a3be469db7c3b684522d7e6e081f2d8e186465c44df6cd2effd
Instruction ID: 2db337416363f8d220d97897999495e4b262c22a6f85479ad8be47829c29ca6a
Opcode Fuzzy Hash: a7cdd4b398359a3be469db7c3b684522d7e6e081f2d8e186465c44df6cd2effd
Instruction Fuzzy Hash: C1017C4184EFE20EE7A3527968542B67FE1DF12220F0918EBC8C8CA4D7D54DA8858382

Function 00007FFB1169BB88 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d942d2c463815cb471d284f58a3d2b73a196d10725ccaedf1a6e71c29e1ee3f
Instruction ID: 07e7ec6c14526c8956919bbcd8e91901948b9631417b7b0d5613baed78f54e9c
Opcode Fuzzy Hash: 7d942d2c463815cb471d284f58a3d2b73a196d10725ccaedf1a6e71c29e1ee3f
Instruction Fuzzy Hash: 7701D670914A0D8FDF84EF68C848AEA77F0FB28305F00056AA81DD3294DB31E554CB81

Function 00007FFB116AD288 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf6de87c4b9b5b306757a2c89dfbd0ab8a622aeba51159d7d44576297bc5df1
Instruction ID: 74176b8e4456847c21749906c4f6e3cd9b7e303ca7207ba0f1326d598a8a9067
Opcode Fuzzy Hash: 8cf6de87c4b9b5b306757a2c89dfbd0ab8a622aeba51159d7d44576297bc5df1
Instruction Fuzzy Hash: EAF04FA071CD0E8FEF84EA7CC84192473E9FF283557A481A8D40DC7191E926EC46C704

Function 00007FFB1169C4BA Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e1cc885280b50832bb549b449df303667e619193dd8b7a00074f0c99196577
Instruction ID: e1437ba6c7a4db8e5ed71284acf61495a0da90f2288ea307760e3ddc98f7e36f
Opcode Fuzzy Hash: 51e1cc885280b50832bb549b449df303667e619193dd8b7a00074f0c99196577
Instruction Fuzzy Hash: 3E019670918A5D8FDF84EF68C859AEA7BF1FF68305F00056AE819D3290DB71E554CB81

Function 00007FFB1169B935 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44c570df51f7879531f49f796c9e421fdc78c34af058e47e0f610659d7e049e
Instruction ID: bef05e5e0183ddaf133248373b022f9f6bc053bbdbc2fc64f55aef26d873c5a3
Opcode Fuzzy Hash: c44c570df51f7879531f49f796c9e421fdc78c34af058e47e0f610659d7e049e
Instruction Fuzzy Hash: F6014670918A4D8FCF84EF68C858AAE7BB0FF28301F0405AAE419C72A1EB709654CB41

Function 00007FFB116977D0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e884c14e0671a9f76b8e5e9e30f9013306c1d5ce5f5573f5b39d3e7858efe4b0
Instruction ID: acf83e58daa4d8fe0484aa06496a1538a4162693049f0fc654026d5ec42a979d
Opcode Fuzzy Hash: e884c14e0671a9f76b8e5e9e30f9013306c1d5ce5f5573f5b39d3e7858efe4b0
Instruction Fuzzy Hash: BDF0A470A18E0A4FDBA8DA38D444772B2D2FB58310F10457DC05FC2188DE29E882CB80

Function 00007FFB1169D738 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2360d8cac5ebcfcb432f538a065ee5554186e39ed6cb16b1941832818032d9a
Instruction ID: ca761d3638f4e39c9ab8d7c311e187af3a6bc3e48f56bc8f37950feeef1b85d7
Opcode Fuzzy Hash: f2360d8cac5ebcfcb432f538a065ee5554186e39ed6cb16b1941832818032d9a
Instruction Fuzzy Hash: 0BF024A3A1CE150FE398587C68550683AD2EF1922830600FEE089C63D6ED091C4142C5

Function 00007FFB116A6D35 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f224431b952a514395b4274f497077f71d8b657a59cd135f3a585e3676624c18
Instruction ID: 3967ae412ba89de52e2c2c5d50b079e594138925455b862b223a0a7abff5c2b7
Opcode Fuzzy Hash: f224431b952a514395b4274f497077f71d8b657a59cd135f3a585e3676624c18
Instruction Fuzzy Hash: 3CF02732B1FE5D0AD775623CB8805F91B96DFC5230B9402B6C0C9C619ACD0FAC8283C1

Function 00007FFB116AD08D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5805e13b3665262102d6018a2b77d5331690e6521496bbe7331472b39bb00d80
Instruction ID: b5ae3d900a4413427848df904a18f59259e544db8435db9ec7df2a0e9097a270
Opcode Fuzzy Hash: 5805e13b3665262102d6018a2b77d5331690e6521496bbe7331472b39bb00d80
Instruction Fuzzy Hash: 4EF0964184FFD20BE7632678AC541B52FD55F67270B1A00F7C4C8CB0A3D8095887C352

Function 00007FFB1169B6CA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e178128eb950d1e4dba9a370991b9fb68e8edb17afbad5f07a35b99cd3fd07b
Instruction ID: fd3bb67adba53ade7a4c00127c899c9645b23ad46685486ecdd9642d2b99e2b6
Opcode Fuzzy Hash: 5e178128eb950d1e4dba9a370991b9fb68e8edb17afbad5f07a35b99cd3fd07b
Instruction Fuzzy Hash: 66F0FF70918A5D8FDF84EF68C898AED7BF0FF28301F0005AAD419D3250DB719594CB41

Function 00007FFB1169731D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e4a08b89e6d7e9b1cf0c1507b0fbaee3724e4114423d3cf51a3bb37968e184
Instruction ID: 91b7ac85fea14a54e357be8dd38567ce8240c6f9d6d4ea6b38453107d72dafa0
Opcode Fuzzy Hash: 06e4a08b89e6d7e9b1cf0c1507b0fbaee3724e4114423d3cf51a3bb37968e184
Instruction Fuzzy Hash: B2F05E7021CB089FCB84EB1CD081D9AB7E1FB99754F54462AF04AC3265CA35E8818B82

Function 00007FFB116983F9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27149a44b5854a06bb375f79d3e26d2049cff6949c4cf9b8555d6e2eda992cb6
Instruction ID: 23be48e66cf6f06edfa68d72d31e5cd07791ff2ac6fa2fc6b4ab4451d75e0bcb
Opcode Fuzzy Hash: 27149a44b5854a06bb375f79d3e26d2049cff6949c4cf9b8555d6e2eda992cb6
Instruction Fuzzy Hash: 5AF0E26180DF894FD761AB78D8442B2BBF5EF65210B0906AEC049C3586DB5CA8498381

Function 00007FFB116965EC Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4811e096974d64d34efca6c1e5ff9293be999fc3d4d1f0aa4f015b4535b27cc9
Instruction ID: c04f0c357ea07e7d7f9ed571193f16b6ef07aa1ac6104c6ee9b1d3da1c4b222f
Opcode Fuzzy Hash: 4811e096974d64d34efca6c1e5ff9293be999fc3d4d1f0aa4f015b4535b27cc9
Instruction Fuzzy Hash: C1E06D60706A088FD755AA7CB8996B977D5EF85221B5400BBD409CB15ADD2688818700

Function 00007FFB116A6D40 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327ea9aa5ffaafd03e4afb70dbe3c05deff2cfc5ff0ee56cb0fe9fccd0de50c5
Instruction ID: 1cefb77ae1a753eec386b70fa0dcb3bad4e27b2f60c7bca05dc49bd699356603
Opcode Fuzzy Hash: 327ea9aa5ffaafd03e4afb70dbe3c05deff2cfc5ff0ee56cb0fe9fccd0de50c5
Instruction Fuzzy Hash: C4E09B72A1FD19059764623CB8411F51697DF85330B540176D44ED218ADE1FAC8282C1

Function 00007FFB1169BA4B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3a038bc84c1585bc61404591d1d91d928c995b39bb1c8f6c8dd300f0b4d692
Instruction ID: 0c28367418475ee1575284537792213025008c7ffab14209dffdd1b59ebcb360
Opcode Fuzzy Hash: cd3a038bc84c1585bc61404591d1d91d928c995b39bb1c8f6c8dd300f0b4d692
Instruction Fuzzy Hash: 1AF01975A0491C9F9F84EF98D498AEDBBB1FF68315F14016AE409E3261DB31A981CB40

Function 00007FFB116A68E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356a51c298713200e0a9beb1662ceb4e5be36bc838b3866982dcfe19a49bca6f
Instruction ID: c606a37674cfad978a093eb5a0963b972236b236859fd318e952b6be8ec6f344
Opcode Fuzzy Hash: 356a51c298713200e0a9beb1662ceb4e5be36bc838b3866982dcfe19a49bca6f
Instruction Fuzzy Hash: BFE04F50D4ED2606BBB42578B8051B811CA8F69271B0500B2DC4CC61D5EC0EACD342C6

Function 00007FFB116B9445 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d4182daa8e24dea6d6c426227badb23e21ebd0627204c3b6aab9dfb4dba53d
Instruction ID: 8f4c0601feacc9880c2f28e6911f7bb680a675c5570bb0b18c024c075907fadc
Opcode Fuzzy Hash: f5d4182daa8e24dea6d6c426227badb23e21ebd0627204c3b6aab9dfb4dba53d
Instruction Fuzzy Hash: 6CE020B194DD4C8FDB48EBA49C002D537E4FF48304F000159E05CC7181D73A5955C7C9

Function 00007FFB116A41AE Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681ede9fdaf55d20493c32824b1a9d1bfd3cdb797bb13305b75dcb56d2d4b85e
Instruction ID: 8867e10de7a03fa0868836636c96de4b1e7478da7eca1789e306094c02ed2752
Opcode Fuzzy Hash: 681ede9fdaf55d20493c32824b1a9d1bfd3cdb797bb13305b75dcb56d2d4b85e
Instruction Fuzzy Hash: EEE0C22270DE5E0DE694A6ACBC013F423C6DB55131F480076C948C2246EE5BBC974280

Function 00007FFB116AFA5A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09973ed529541d442de052840eb31620f721f7693bef97fcbd178f38b65e78b1
Instruction ID: d5ebe1df8bfa498733ff43a2d20810dba57354de16340fa22f722940af44e681
Opcode Fuzzy Hash: 09973ed529541d442de052840eb31620f721f7693bef97fcbd178f38b65e78b1
Instruction Fuzzy Hash: F6D05B2275EB1C4B5664692CB8061B9B3C5D785531740077FD88AC2159DD17B4464286

Function 00007FFB11698410 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544515b81665719a8f9d445c00e09180c0d7aff78f7ea45c5cc5c8e504d450c9
Instruction ID: 081c73f91d581f6b75069927925cbfcb35707cd9d201ed2aa1bd9976c4b30733
Opcode Fuzzy Hash: 544515b81665719a8f9d445c00e09180c0d7aff78f7ea45c5cc5c8e504d450c9
Instruction Fuzzy Hash: 87D01261D28E5D4FDBB4BA78E0453B5A1E5FF18324F400A6AD01AC3689EF68AD8547C1

Function 00007FFB1169CFB9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe5acfda813806a08ce7a457fd5d68f6ae81c738eb88184900b772634fe154d
Instruction ID: 1396f05604e8dd950d25c47f867219e5d4abdbe08759cba743f87100f6e2ea56
Opcode Fuzzy Hash: bfe5acfda813806a08ce7a457fd5d68f6ae81c738eb88184900b772634fe154d
Instruction Fuzzy Hash: 29D0A92270CE290B6644A91CB8038B8B3C1E788630B00016FE44AC2285DE2AA88282CA

Function 00007FFB1169859D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188f120592d3ea05bcde73c903fea80a596db0794afaed7eeff0137c3e328fab
Instruction ID: a351415375f2ef0a043e49954480367b7afbf12e1cec286319ec84834cf70b70
Opcode Fuzzy Hash: 188f120592d3ea05bcde73c903fea80a596db0794afaed7eeff0137c3e328fab
Instruction Fuzzy Hash: 35D0A993E08F1B4EF2485CB8A8C18A8438AFB44230B000132C40A81289D81B28818281

Non-executed Functions

Function 00007FFB118CA628 Relevance: 1.9, Strings: 1, Instructions: 605COMMON

Download Yara Rule

Strings

0Wqn, xrefs: 00007FFB118CF349

Memory Dump Source

Source File: 00000000.00000002.1555966978.00007FFB118B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB118B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb118b0000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0Wqn
API String ID: 0-615652192
Opcode ID: 9a130b13f6bcf951342997ee2d96680a526835673871b94a271b951562a79f1e
Instruction ID: 07a1c0011dcdee5c7da36a74536c375958f4301181097235609972457b1f76f0
Opcode Fuzzy Hash: 9a130b13f6bcf951342997ee2d96680a526835673871b94a271b951562a79f1e
Instruction Fuzzy Hash: 4B22B1B090CB5A8FE7A5DB78C8543F97BE2FF96310F1481BAD449C71D2DA38A8458781

Function 00007FFB116AD86D Relevance: .9, Instructions: 874COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0b7bc6f450dd5e9c0d6a8632733cbc057499a9d1d7ca4374fa60b5a27d686f
Instruction ID: a62a4db80b75cf2bc870fddf75f75ba12e25870fdd2a8a12a836df6c9ddf41c3
Opcode Fuzzy Hash: 0a0b7bc6f450dd5e9c0d6a8632733cbc057499a9d1d7ca4374fa60b5a27d686f
Instruction Fuzzy Hash: 8F42F9B2A1CE454BE7589B3CE855679B7D2FF98350F44417DE48EC32C3DE2AA8428781

Function 00007FFB1169A77B Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a87c157309eaff81160c072fbd1da7c192f6a77162a02d936aa7beca045f1e1
Instruction ID: 73be2c6e96766ef1810ce31175c9ded20583ab5af12d8bb0f639eb152bc2a521
Opcode Fuzzy Hash: 2a87c157309eaff81160c072fbd1da7c192f6a77162a02d936aa7beca045f1e1
Instruction Fuzzy Hash: 96F1F1B2618A4A4FE7489F2CD4497AABBD2FB54314F14417ED04ACB287DF7999068BC0

Function 00007FFB113811A0 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550722126.00007FFB11380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11380000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7b916098a8f73c96a798ef8d06b27dad42642e1eda54f84660a00bca978f5b
Instruction ID: 59b69317bb142a2eec70578ad3e36d02ffb0be56848c7bfbeba9835717eaf09e
Opcode Fuzzy Hash: 8b7b916098a8f73c96a798ef8d06b27dad42642e1eda54f84660a00bca978f5b
Instruction Fuzzy Hash: 9BD140C390EEC51FF75687B8A81917D6F9AFB9663076803FAE0C8871DF9858990583C1

Function 00007FFB116AAF40 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a1c15363f832b4d47056e0e33332018a95dd2fa64ba2d0da0c39ab27314ddc
Instruction ID: bad2841867dc7be713898ea952fe4d46cce17b168a90d74420834eda09b24f12
Opcode Fuzzy Hash: 04a1c15363f832b4d47056e0e33332018a95dd2fa64ba2d0da0c39ab27314ddc
Instruction Fuzzy Hash: E9B183B161CE494FDBA8EB28D455AB9B7D2EF98310F10457ED04EC3296CE35A846C781

Function 00007FFB11388A58 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1550722126.00007FFB11380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11380000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80aa4f6a96e843288e02c1b2e673469b6bd7534d3a47d00b63f8d186c04d2774
Instruction ID: 2e50543dde775ef227c3ae11aa2a3657e2165c65583d6575993148a9e86be37c
Opcode Fuzzy Hash: 80aa4f6a96e843288e02c1b2e673469b6bd7534d3a47d00b63f8d186c04d2774
Instruction Fuzzy Hash: AA7188C2D0FFC11FF35687B87C1A129AE96BF526217A801FED0C48A19FE418991983C2

Function 00007FFB116A3D09 Relevance: 6.4, Strings: 5, Instructions: 162COMMON

Download Yara Rule

Strings

"rgn, xrefs: 00007FFB116A3D7D
"rgn, xrefs: 00007FFB116A3E2C
"rgn, xrefs: 00007FFB116A3D5A
"rgn, xrefs: 00007FFB116A3E09
"rgn, xrefs: 00007FFB116A3DE6

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: "rgn$"rgn$"rgn$"rgn$"rgn
API String ID: 0-1136738621
Opcode ID: 8a4b5e443e9b3ec9731445d9ff1c48858c876a06b73d695b7ede7b8c136abdd0
Instruction ID: 9c548c882a926c4be8963b3abe3d0ce9f33fe1d123f81a127764ff90f8873c1a
Opcode Fuzzy Hash: 8a4b5e443e9b3ec9731445d9ff1c48858c876a06b73d695b7ede7b8c136abdd0
Instruction Fuzzy Hash: 1341E5A2E19D864FDF94EA78D4819A2F7D2FFA52007188166C08DC729ADE25FC4387C0

Function 00007FFB116A0C2A Relevance: 5.2, Strings: 4, Instructions: 223COMMON

Download Yara Rule

Strings

x^hn, xrefs: 00007FFB116A0C7F
0_Co, xrefs: 00007FFB116A0DF0
xqn, xrefs: 00007FFB116A0DD4
xqn, xrefs: 00007FFB116A0DAF

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: 0_Co$x^hn$xqn$xqn
API String ID: 0-2185859596
Opcode ID: 338e4b45fd513ce82a86822883d74a5a483666a37af21fd43054fb593fa1b5f4
Instruction ID: 304760f66a377c376df16f7499af18384097f87474f46cf41d533ff25454824b
Opcode Fuzzy Hash: 338e4b45fd513ce82a86822883d74a5a483666a37af21fd43054fb593fa1b5f4
Instruction Fuzzy Hash: 95613B6260DF894FD396EB3CD8542A47BE2EF9622071800FBD04DCB297DD29AC46C741

Function 00007FFB1169CFDD Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

xqn, xrefs: 00007FFB1169D082
xqn, xrefs: 00007FFB1169D0A7
xqn, xrefs: 00007FFB1169D05D
xqn, xrefs: 00007FFB1169D038

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: xqn$xqn$xqn$xqn
API String ID: 0-1793532225
Opcode ID: 742c944af4c94ec8e4826a8ba13debf2604d1eb4841f493b5406aee371f26a85
Instruction ID: bea9eae35f37cd5371130e5229bf1d704724c3495ca9d5d144aee3ed50f67758
Opcode Fuzzy Hash: 742c944af4c94ec8e4826a8ba13debf2604d1eb4841f493b5406aee371f26a85
Instruction Fuzzy Hash: 1631D6B1A08E4E4FE794DF3CD858AB867D6FF6839170401B5D84CC7296EE25AC42C780

Function 00007FFB11699050 Relevance: 5.1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

Strings

xqn, xrefs: 00007FFB1169D082
xqn, xrefs: 00007FFB1169D0A7
xqn, xrefs: 00007FFB1169D05D
xqn, xrefs: 00007FFB1169D038

Memory Dump Source

Source File: 00000000.00000002.1553710243.00007FFB11690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB11690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb11690000_FaZM14kDMN.jbxd

Similarity

API ID:
String ID: xqn$xqn$xqn$xqn
API String ID: 0-1793532225
Opcode ID: 193197c9591b0439c28b069d6ea70e89203a4617574ddb8b02cda17e55062b88
Instruction ID: 07d355f6df3e5e7a74cbfd6f708a51d895144a5a16ba3808262e7cf3c21216b6
Opcode Fuzzy Hash: 193197c9591b0439c28b069d6ea70e89203a4617574ddb8b02cda17e55062b88
Instruction Fuzzy Hash: D431E971A14D1E4FE794EF2CD858BB863C5FF683A0B4405B5D80CC7295DE29AC82C780

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FaZM14kDMN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
FaZM14kDMN.exe

Function 00007FFB118B9A1D Relevance: 10.9, Strings: 8, Instructions: 879
COMMON

Function 00007FFB115A945D Relevance: 6.4, Strings: 4, Instructions: 1385
COMMON

Function 00007FFB116A41DD Relevance: 8.0, Strings: 6, Instructions: 535
COMMON

Function 00007FFB116A42C2 Relevance: 7.8, Strings: 6, Instructions: 261
COMMON

Function 00007FFB116A4DDE Relevance: 7.3, Strings: 5, Instructions: 1012
COMMON

Function 00007FFB115AD3C9 Relevance: 5.2, Strings: 3, Instructions: 1462
COMMON

Function 00007FFB11695175 Relevance: 4.5, Strings: 3, Instructions: 725
COMMON

Function 00007FFB116A101C Relevance: 4.2, Strings: 3, Instructions: 497
COMMON