Edit tour

Windows Analysis Report
39382629.exe

Overview

General Information

Sample name:	39382629.exe
Analysis ID:	1580579
MD5:	e8baebcd4279a203d5d3b6b21f753e5b
SHA1:	60382eed3e26e8b20830749b0c1a872057fd362e
SHA256:	cb4a22756f39ea5c69e24772b8eb6d004962196c683cc2d7742eb89e65836890
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

39382629.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\39382629.exe" MD5: E8BAEBCD4279A203D5D3B6B21F753E5B)

39382629.exe (PID: 7712 cmdline: "C:\Users\user\Desktop\39382629.exe" MD5: E8BAEBCD4279A203D5D3B6B21F753E5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["87.120.120.7:1912"], "Bot Id": "BOT", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1822092380.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1699747934.00000000039B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 39382629.exe PID: 7544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 39382629.exe PID: 7544	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 39382629.exe PID: 7712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 39382629.exe PID: 7712	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.39382629.exe.3ad4b58.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.39382629.exe.3ad4b58.1.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296ba:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.39382629.exe.39b5da8.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.39382629.exe.39b5da8.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296ba:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.39382629.exe.3ad4b58.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.39382629.exe.3ad4b58.1.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x278ba:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.39382629.exe.39b5da8.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.39382629.exe.39b5da8.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x278ba:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
2.2.39382629.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.39382629.exe.400000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296ba:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.39382629.exe.3a45138.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.39382629.exe.3a45138.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xb46e3:$gen01: ChromeGetRoamingName 0xb4708:$gen02: ChromeGetLocalName 0xb474b:$gen03: get_UserDomainName 0xb85e4:$gen04: get_encrypted_key 0xb7363:$gen05: browserPaths 0xb7639:$gen06: GetBrowsers 0xb6f21:$gen07: get_InstalledInputLanguages 0xb33ec:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x92a38:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0xb8a26:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0xb8ac4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0xb90da:$spe9: wallet 0xb140a:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xb1934:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xb19e1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xb13b8:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xb13e1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xb15b2:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xb1805:$typ11: 2A19BFD7333718195216588A698752C517111B02 0xb1af4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T10:37:02.609013+0100	2043234	1	A Network Trojan was detected	87.120.120.7	1912	192.168.2.4	49733	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T10:37:02.220812+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:07.819578+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:12.262922+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:12.682432+0100	2043231	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.7	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T10:37:09.978821+0100	2046056	1	A Network Trojan was detected	87.120.120.7	1912	192.168.2.4	49733	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T10:37:02.220812+0100	2046045	1	A Network Trojan was detected	192.168.2.4	49733	87.120.120.7	1912	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["87.120.120.7:1912"], "Bot Id": "BOT", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: 39382629.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 39382629.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 39382629.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: sqiK.pdbSHA256 source: 39382629.exe
Source:	Binary string: sqiK.pdb source: 39382629.exe

Source: C:\Users\user\Desktop\39382629.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_080C1A78
Source: C:\Users\user\Desktop\39382629.exe	Code function: 4x nop then jmp 080C11BAh	2_2_080C0D98
Source: C:\Users\user\Desktop\39382629.exe	Code function: 4x nop then jmp 080C163Ah	2_2_080C0D98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49733 -> 87.120.120.7:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49733 -> 87.120.120.7:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 87.120.120.7:1912 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 87.120.120.7:1912 -> 192.168.2.4:49733

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.120.7:1912

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 87.120.120.7:1912

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.120.7

Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 39382629.exe	String found in binary or memory: http://tempuri.org/DataSet2.xsd
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 39382629.exe, 00000002.00000002.1823869664.000000000331C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 39382629.exe, 00000002.00000002.1823869664.000000000331C000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 39382629.exe, 00000002.00000002.1823869664.000000000331C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 39382629.exe, 00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000000.00000002.1699747934.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1822092380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 39382629.exe	String found in binary or memory: https://git.io/vblQ0
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.39382629.exe.3ad4b58.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.39382629.exe.39b5da8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.39382629.exe.3ad4b58.1.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.39382629.exe.39b5da8.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 2.2.39382629.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_028D3E40	0_2_028D3E40
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_028DE504	0_2_028DE504
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_028D7288	0_2_028D7288
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_070963F8	0_2_070963F8
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07098D00	0_2_07098D00
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0709948A	0_2_0709948A
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07099498	0_2_07099498
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07137F20	0_2_07137F20
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0713CF50	0_2_0713CF50
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0713D6C0	0_2_0713D6C0
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07132B18	0_2_07132B18
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_071353B8	0_2_071353B8
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07130040	0_2_07130040
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0713A0C8	0_2_0713A0C8
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0713E3D0	0_2_0713E3D0
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07134200	0_2_07134200
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07136AF0	0_2_07136AF0
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_0149DC74	2_2_0149DC74
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C0040	2_2_080C0040
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C1A78	2_2_080C1A78
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C2588	2_2_080C2588
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C0D98	2_2_080C0D98
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C5630	2_2_080C5630
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C0798	2_2_080C0798
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C0011	2_2_080C0011
Source: C:\Users\user\Desktop\39382629.exe	Code function: 2_2_080C0D87	2_2_080C0D87

Source: 39382629.exe, 00000000.00000002.1699747934.00000000039F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1698224388.0000000002971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1705173228.0000000007180000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 39382629.exe
Source: 39382629.exe, 00000000.00000000.1668313297.0000000000552000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesqiK.exe< vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1699747934.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1696476125.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1699747934.0000000003B17000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1703706075.00000000055B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 39382629.exe
Source: 39382629.exe, 00000000.00000002.1698224388.00000000029E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1822092380.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq,\\StringFileInfo\\000004B0\\OriginalFilename vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq,\\StringFileInfo\\040904B0\\OriginalFilename vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $tq,\\StringFileInfo\\080904B0\\OriginalFilename vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000032FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs 39382629.exe
Source: 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 39382629.exe
Source: 39382629.exe	Binary or memory string: OriginalFilenamesqiK.exe< vs 39382629.exe

Source: 39382629.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.39382629.exe.3ad4b58.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.39382629.exe.39b5da8.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.39382629.exe.3ad4b58.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.39382629.exe.39b5da8.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 2.2.39382629.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: 39382629.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.39382629.exe.3a45138.2.raw.unpack, W7EnincKnyVAQnexwB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, W7EnincKnyVAQnexwB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: _0020.SetAccessControl
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: _0020.AddAccessRule
Source: 0.2.39382629.exe.7180000.5.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: _0020.SetAccessControl
Source: 0.2.39382629.exe.7180000.5.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.39382629.exe.7180000.5.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: _0020.AddAccessRule
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: _0020.SetAccessControl
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	Security API names: _0020.AddAccessRule
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, W7EnincKnyVAQnexwB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, W7EnincKnyVAQnexwB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.39382629.exe.7180000.5.raw.unpack, W7EnincKnyVAQnexwB.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.39382629.exe.7180000.5.raw.unpack, W7EnincKnyVAQnexwB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 39382629.exe, 00000000.00000002.1703566285.00000000053D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DITC Viner Hand is a Trademark of International Typeface Corporation.slntf+

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/1

Source: C:\Users\user\Desktop\39382629.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39382629.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

Mutant created: NULL

Source: 39382629.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 39382629.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\39382629.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 39382629.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\39382629.exe "C:\Users\user\Desktop\39382629.exe"
Source: C:\Users\user\Desktop\39382629.exe	Process created: C:\Users\user\Desktop\39382629.exe "C:\Users\user\Desktop\39382629.exe"
Source: C:\Users\user\Desktop\39382629.exe	Process created: C:\Users\user\Desktop\39382629.exe "C:\Users\user\Desktop\39382629.exe"	Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\39382629.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 39382629.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 39382629.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 39382629.exe

Static file information: File size 1071616 > 1048576

Source: 39382629.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x103e00

Source: 39382629.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 39382629.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: sqiK.pdbSHA256 source: 39382629.exe
Source:	Binary string: sqiK.pdb source: 39382629.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 39382629.exe, mainWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	.Net Code: GgCkFkY8u5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	.Net Code: GgCkFkY8u5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.39382629.exe.7180000.5.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	.Net Code: GgCkFkY8u5 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07098490 pushad ; iretd	0_2_070985B5
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0709F2C0 push B4070B87h; iretd	0_2_0709F2CD
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_0711B68E pushfd ; ret	0_2_0711B68F
Source: C:\Users\user\Desktop\39382629.exe	Code function: 0_2_07115277 pushfd ; iretd	0_2_07115285

Source: 39382629.exe

Static PE information: section name: .text entropy: 7.379318935525983

Source: 0.2.39382629.exe.3a45138.2.raw.unpack, qr0EhtssdDdIvyci3t.cs	High entropy of concatenated method names: 'L13L5W5xhq', 'WfjLmejkp1', 'hqBLKXyHi8', 'IoiLaDEXgN', 'Ka2Lna1JSe', 'HeQLI0hFVv', 'mUxL8yEeDV', 'degLqT0c95', 'XLnLN4LueE', 'mfQLp2NNKA'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, qJchT24wWR0fXgoHc5.cs	High entropy of concatenated method names: 'ALIFqaY70', 'hmrQf0GeY', 'j2QugVvuJ', 'wAQJDkSR0', 'BsuyFs6OJ', 'oPrsc8U16', 'dCKBg0nelrL8TpFCpB', 'hhJwDptH3FOuthYMRy', 'Lij6t4Z9y', 'dZe1ZmDsd'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, X93ysMMVy1y9I0O8Gb.cs	High entropy of concatenated method names: 'BcAXR18d3k', 'ykNXg6lYy2', 'YOuXTGJmfu', 'nuwTOQ2A3Y', 'OCRTzuv1Lw', 'vdmXd9veHL', 'IUfXjUolb5', 'GtZXtnhmWd', 'y1WXWqewNT', 'wB2XkfRcpx'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, g7OXIHUhiL0CasyvAm.cs	High entropy of concatenated method names: 'L3uT2UDihx', 'q2XTYg4jsJ', 'DS5TcRaMeV', 'ToString', 'rdxTwEI6fx', 'PdfTCJxwh2', 'n0KaYd4appYh14xJOhs', 'tNLPxt4SdR9RwZY2BuC', 'HIvOp14nF5FjuKOk8le'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, tbRLYiolqbIBshu0mdX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Gfc1r4Ds0X', 'uX91Sn7gIN', 'b6H1DUthFn', 'svW1fYbe4Z', 'b2317vq8Wm', 'Mh912sdlhM', 'Wc41Yrj0be'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, WuvQxvYIgololr7M5S.cs	High entropy of concatenated method names: 'YDr1gotB0t', 'j7a1UcXd34', 'g6r1T564Ql', 'xLc1X0ZWhR', 'jGP1LsDGBg', 'zvy1ihXCrR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, dUOhbgomtHdfUPFto0h.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'a8OoLTrfhE', 'KlJo19HBvi', 'KPyo0jaPNv', 'M5WooCS9ZN', 'i20o4RvM64', 'kNGoh2Rs0I', 'VHNoG3eS1a'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, icVo777oQlS8BDNOD8.cs	High entropy of concatenated method names: 'hycxH2kiQ9', 'AVuxMGiljm', 'ToString', 'nW0xRfrn1p', 'GfBxbr4uFK', 'cO0xg1Uc9a', 'i2cxUMB0Y2', 'VL6xTkkgSB', 'kiwxX3DHXn', 'aH3xiNAXwH'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, MpmEQvnDTkMGHXW5tl.cs	High entropy of concatenated method names: 'Dispose', 'T8Zjev80xQ', 'JDitmSWEw4', 'HbPocmhkjr', 'K9cjOQ43pB', 'YGfjz58MrD', 'ProcessDialogKey', 'QILtdujvin', 'KMbtjNXs62', 'bSlttgsTya'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, W7EnincKnyVAQnexwB.cs	High entropy of concatenated method names: 'K6Nbf1G7ZC', 'iu8b7mQ9bt', 'tH7b27ipLg', 'Mq0bYr8meJ', 'mUFbc8lP4d', 'nE2bwnHGuh', 'pQXbClFfaS', 'rl8bZ4yMPy', 'zTtbeaHNMn', 'uRJbOPT4yr'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, a6wIKD5ZU92sw1fCiF.cs	High entropy of concatenated method names: 'R2VgQGHE4A', 'UAigubvcW2', 'WrjgPgEAko', 'Qp2gyaxA0x', 'gfbgl7X0qY', 'xLWg3y5RHW', 'byigxwUp2Q', 'J2cg6wRro8', 'E5FgLJCBNW', 'Xtpg1bCFxG'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, e7HKvypOiwBUd7wRS5.cs	High entropy of concatenated method names: 'HYgXVGUT5E', 'exyXBZdUNL', 'EFsXFdPcAZ', 'zHXXQocMIy', 'zM0XED0HOc', 'YHLXuyMfxS', 'xqLXJwQjqD', 'lrcXPCqlN9', 'RApXyy702R', 'BoZXsOFNkA'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, UqxeJ4yXq0aUEUFODu.cs	High entropy of concatenated method names: 'QcALl3RyCd', 'Aw4LxmWmhB', 'SWiLLWq5Pi', 'iKmL0GHCJJ', 'LC5L4Vadcn', 'g35LGFaavq', 'Dispose', 'Ikv6Ri5kT8', 'Hs46b58IJG', 'y0m6gdfgV3'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, MkORJFWmrPD7RJCRfF.cs	High entropy of concatenated method names: 'tUPUE2FCNK', 'pHmUJ5Eqt0', 'l8BgKmVOln', 'kQtga3c8nZ', 'QO2gn0g5u3', 'KD8gIMXqyn', 'ijWg8FQ6ug', 'v9ugq5bw5E', 'KR1gNvEUE9', 'blegp5m4ob'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, bI5m8ENOX97eDT5JXi.cs	High entropy of concatenated method names: 'zXovPJx3H9', 'PwXvynDUKW', 'HgYv5wTaKd', 'Kuovm9ttNd', 'S4nvaJ68VL', 'iX5vnNyVpR', 'N8hv8gUGyU', 'AprvqJjKU7', 'zlIvp1BpIc', 'uA3vrZUg55'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, JExRBez0pDmoXFSG2P.cs	High entropy of concatenated method names: 'nxW1ubbvqC', 'IKk1PelmAI', 'eNj1yRkSBx', 'auw15kpoDD', 'bZp1mVolQp', 'VA71ayVYrT', 'eNR1nmQ3c4', 'aae1GeaBnX', 'R4j1VxYqkk', 'xOg1ByLWvy'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, A03jCrrGGL75XjN2wZ.cs	High entropy of concatenated method names: 'XBElpmNSDI', 'njjlS8Fs26', 'LXRlfdGGy2', 'x6Jl7Llfb8', 'S4QlmRXeWR', 'bxdlKKHqMl', 'CIplaE8Aax', 'OO7lnemJCG', 'Ij0lIYXnId', 'bdpl8M32Of'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	High entropy of concatenated method names: 'AxfWARv7ES', 'tLDWRx5aH9', 'J9HWbP174i', 'cfOWgE9XHc', 'T3vWUu50i5', 'AlQWTQILer', 'YRBWXuQotu', 'iWJWisLRWx', 'BBoW9t5An7', 'vgsWHjCAoD'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, tpa4qSxTgMdPCUd3Ka.cs	High entropy of concatenated method names: 'AlwxZsG5NT', 'B9vxObPvjT', 'PUG6d2Mh6l', 'W366jfDV1B', 'nDSxrbF1ZU', 'IqSxS9J3dM', 'E4sxDvSckF', 'rSqxfbfhPU', 'PxAx7BVrO1', 'TUax2fXiAE'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, GWScYRtZiQVI4AaNBV.cs	High entropy of concatenated method names: 'ToString', 'dhc3rVFOq7', 'L0a3mduJ7q', 'Ggy3Kvu0oh', 'Vfp3am1vlH', 'GOu3nuxFnl', 'pBF3Il97mP', 'rRr38mmkmw', 'pVC3qBJ09A', 'wja3NB1792'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, KvYKc4ooepvtfIi4tUL.cs	High entropy of concatenated method names: 'ylt1OBrVF9', 'hLc1z7k7Hq', 'eoZ0dkrJFM', 'mI00jJuAd1', 'Y0u0tfc39C', 'qfU0Wre8X6', 'c7Q0kpVtEo', 'cmW0A9bx3e', 'cd90RW17Vv', 'TKq0bcTUam'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, BDOAsEmawpdElhFvn4.cs	High entropy of concatenated method names: 'DJfjXYrS8g', 'tMhjirZrZT', 'i7FjHjCrY9', 'xjfjMpWjdm', 'jW6jl6XPRA', 'Wx0j3ByLoq', 'AAhm54o2MGmAgW5QBu', 'DpEiTf8wCetfb0nM7x', 'O40jjLRcZw', 'MU8jWseOHm'
Source: 0.2.39382629.exe.3a45138.2.raw.unpack, sv2dwvAiKMQ6dl1CnR.cs	High entropy of concatenated method names: 'A8DTA0T2qy', 'aORTbyPsNF', 'YHUTUx6ghk', 'jiPTXc9jDU', 'QNmTiKjyPP', 'kPlUc1xxlV', 'wT5UwF5W4u', 'bAIUCiMs40', 'nEbUZlyId4', 'plxUebgPfi'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, qr0EhtssdDdIvyci3t.cs	High entropy of concatenated method names: 'L13L5W5xhq', 'WfjLmejkp1', 'hqBLKXyHi8', 'IoiLaDEXgN', 'Ka2Lna1JSe', 'HeQLI0hFVv', 'mUxL8yEeDV', 'degLqT0c95', 'XLnLN4LueE', 'mfQLp2NNKA'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, qJchT24wWR0fXgoHc5.cs	High entropy of concatenated method names: 'ALIFqaY70', 'hmrQf0GeY', 'j2QugVvuJ', 'wAQJDkSR0', 'BsuyFs6OJ', 'oPrsc8U16', 'dCKBg0nelrL8TpFCpB', 'hhJwDptH3FOuthYMRy', 'Lij6t4Z9y', 'dZe1ZmDsd'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, X93ysMMVy1y9I0O8Gb.cs	High entropy of concatenated method names: 'BcAXR18d3k', 'ykNXg6lYy2', 'YOuXTGJmfu', 'nuwTOQ2A3Y', 'OCRTzuv1Lw', 'vdmXd9veHL', 'IUfXjUolb5', 'GtZXtnhmWd', 'y1WXWqewNT', 'wB2XkfRcpx'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, g7OXIHUhiL0CasyvAm.cs	High entropy of concatenated method names: 'L3uT2UDihx', 'q2XTYg4jsJ', 'DS5TcRaMeV', 'ToString', 'rdxTwEI6fx', 'PdfTCJxwh2', 'n0KaYd4appYh14xJOhs', 'tNLPxt4SdR9RwZY2BuC', 'HIvOp14nF5FjuKOk8le'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, tbRLYiolqbIBshu0mdX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Gfc1r4Ds0X', 'uX91Sn7gIN', 'b6H1DUthFn', 'svW1fYbe4Z', 'b2317vq8Wm', 'Mh912sdlhM', 'Wc41Yrj0be'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, WuvQxvYIgololr7M5S.cs	High entropy of concatenated method names: 'YDr1gotB0t', 'j7a1UcXd34', 'g6r1T564Ql', 'xLc1X0ZWhR', 'jGP1LsDGBg', 'zvy1ihXCrR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, dUOhbgomtHdfUPFto0h.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'a8OoLTrfhE', 'KlJo19HBvi', 'KPyo0jaPNv', 'M5WooCS9ZN', 'i20o4RvM64', 'kNGoh2Rs0I', 'VHNoG3eS1a'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, icVo777oQlS8BDNOD8.cs	High entropy of concatenated method names: 'hycxH2kiQ9', 'AVuxMGiljm', 'ToString', 'nW0xRfrn1p', 'GfBxbr4uFK', 'cO0xg1Uc9a', 'i2cxUMB0Y2', 'VL6xTkkgSB', 'kiwxX3DHXn', 'aH3xiNAXwH'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, MpmEQvnDTkMGHXW5tl.cs	High entropy of concatenated method names: 'Dispose', 'T8Zjev80xQ', 'JDitmSWEw4', 'HbPocmhkjr', 'K9cjOQ43pB', 'YGfjz58MrD', 'ProcessDialogKey', 'QILtdujvin', 'KMbtjNXs62', 'bSlttgsTya'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, W7EnincKnyVAQnexwB.cs	High entropy of concatenated method names: 'K6Nbf1G7ZC', 'iu8b7mQ9bt', 'tH7b27ipLg', 'Mq0bYr8meJ', 'mUFbc8lP4d', 'nE2bwnHGuh', 'pQXbClFfaS', 'rl8bZ4yMPy', 'zTtbeaHNMn', 'uRJbOPT4yr'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, a6wIKD5ZU92sw1fCiF.cs	High entropy of concatenated method names: 'R2VgQGHE4A', 'UAigubvcW2', 'WrjgPgEAko', 'Qp2gyaxA0x', 'gfbgl7X0qY', 'xLWg3y5RHW', 'byigxwUp2Q', 'J2cg6wRro8', 'E5FgLJCBNW', 'Xtpg1bCFxG'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, e7HKvypOiwBUd7wRS5.cs	High entropy of concatenated method names: 'HYgXVGUT5E', 'exyXBZdUNL', 'EFsXFdPcAZ', 'zHXXQocMIy', 'zM0XED0HOc', 'YHLXuyMfxS', 'xqLXJwQjqD', 'lrcXPCqlN9', 'RApXyy702R', 'BoZXsOFNkA'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, UqxeJ4yXq0aUEUFODu.cs	High entropy of concatenated method names: 'QcALl3RyCd', 'Aw4LxmWmhB', 'SWiLLWq5Pi', 'iKmL0GHCJJ', 'LC5L4Vadcn', 'g35LGFaavq', 'Dispose', 'Ikv6Ri5kT8', 'Hs46b58IJG', 'y0m6gdfgV3'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, MkORJFWmrPD7RJCRfF.cs	High entropy of concatenated method names: 'tUPUE2FCNK', 'pHmUJ5Eqt0', 'l8BgKmVOln', 'kQtga3c8nZ', 'QO2gn0g5u3', 'KD8gIMXqyn', 'ijWg8FQ6ug', 'v9ugq5bw5E', 'KR1gNvEUE9', 'blegp5m4ob'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, bI5m8ENOX97eDT5JXi.cs	High entropy of concatenated method names: 'zXovPJx3H9', 'PwXvynDUKW', 'HgYv5wTaKd', 'Kuovm9ttNd', 'S4nvaJ68VL', 'iX5vnNyVpR', 'N8hv8gUGyU', 'AprvqJjKU7', 'zlIvp1BpIc', 'uA3vrZUg55'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, JExRBez0pDmoXFSG2P.cs	High entropy of concatenated method names: 'nxW1ubbvqC', 'IKk1PelmAI', 'eNj1yRkSBx', 'auw15kpoDD', 'bZp1mVolQp', 'VA71ayVYrT', 'eNR1nmQ3c4', 'aae1GeaBnX', 'R4j1VxYqkk', 'xOg1ByLWvy'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, A03jCrrGGL75XjN2wZ.cs	High entropy of concatenated method names: 'XBElpmNSDI', 'njjlS8Fs26', 'LXRlfdGGy2', 'x6Jl7Llfb8', 'S4QlmRXeWR', 'bxdlKKHqMl', 'CIplaE8Aax', 'OO7lnemJCG', 'Ij0lIYXnId', 'bdpl8M32Of'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	High entropy of concatenated method names: 'AxfWARv7ES', 'tLDWRx5aH9', 'J9HWbP174i', 'cfOWgE9XHc', 'T3vWUu50i5', 'AlQWTQILer', 'YRBWXuQotu', 'iWJWisLRWx', 'BBoW9t5An7', 'vgsWHjCAoD'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, tpa4qSxTgMdPCUd3Ka.cs	High entropy of concatenated method names: 'AlwxZsG5NT', 'B9vxObPvjT', 'PUG6d2Mh6l', 'W366jfDV1B', 'nDSxrbF1ZU', 'IqSxS9J3dM', 'E4sxDvSckF', 'rSqxfbfhPU', 'PxAx7BVrO1', 'TUax2fXiAE'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, GWScYRtZiQVI4AaNBV.cs	High entropy of concatenated method names: 'ToString', 'dhc3rVFOq7', 'L0a3mduJ7q', 'Ggy3Kvu0oh', 'Vfp3am1vlH', 'GOu3nuxFnl', 'pBF3Il97mP', 'rRr38mmkmw', 'pVC3qBJ09A', 'wja3NB1792'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, KvYKc4ooepvtfIi4tUL.cs	High entropy of concatenated method names: 'ylt1OBrVF9', 'hLc1z7k7Hq', 'eoZ0dkrJFM', 'mI00jJuAd1', 'Y0u0tfc39C', 'qfU0Wre8X6', 'c7Q0kpVtEo', 'cmW0A9bx3e', 'cd90RW17Vv', 'TKq0bcTUam'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, BDOAsEmawpdElhFvn4.cs	High entropy of concatenated method names: 'DJfjXYrS8g', 'tMhjirZrZT', 'i7FjHjCrY9', 'xjfjMpWjdm', 'jW6jl6XPRA', 'Wx0j3ByLoq', 'AAhm54o2MGmAgW5QBu', 'DpEiTf8wCetfb0nM7x', 'O40jjLRcZw', 'MU8jWseOHm'
Source: 0.2.39382629.exe.3bf4b08.3.raw.unpack, sv2dwvAiKMQ6dl1CnR.cs	High entropy of concatenated method names: 'A8DTA0T2qy', 'aORTbyPsNF', 'YHUTUx6ghk', 'jiPTXc9jDU', 'QNmTiKjyPP', 'kPlUc1xxlV', 'wT5UwF5W4u', 'bAIUCiMs40', 'nEbUZlyId4', 'plxUebgPfi'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, qr0EhtssdDdIvyci3t.cs	High entropy of concatenated method names: 'L13L5W5xhq', 'WfjLmejkp1', 'hqBLKXyHi8', 'IoiLaDEXgN', 'Ka2Lna1JSe', 'HeQLI0hFVv', 'mUxL8yEeDV', 'degLqT0c95', 'XLnLN4LueE', 'mfQLp2NNKA'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, qJchT24wWR0fXgoHc5.cs	High entropy of concatenated method names: 'ALIFqaY70', 'hmrQf0GeY', 'j2QugVvuJ', 'wAQJDkSR0', 'BsuyFs6OJ', 'oPrsc8U16', 'dCKBg0nelrL8TpFCpB', 'hhJwDptH3FOuthYMRy', 'Lij6t4Z9y', 'dZe1ZmDsd'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, X93ysMMVy1y9I0O8Gb.cs	High entropy of concatenated method names: 'BcAXR18d3k', 'ykNXg6lYy2', 'YOuXTGJmfu', 'nuwTOQ2A3Y', 'OCRTzuv1Lw', 'vdmXd9veHL', 'IUfXjUolb5', 'GtZXtnhmWd', 'y1WXWqewNT', 'wB2XkfRcpx'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, g7OXIHUhiL0CasyvAm.cs	High entropy of concatenated method names: 'L3uT2UDihx', 'q2XTYg4jsJ', 'DS5TcRaMeV', 'ToString', 'rdxTwEI6fx', 'PdfTCJxwh2', 'n0KaYd4appYh14xJOhs', 'tNLPxt4SdR9RwZY2BuC', 'HIvOp14nF5FjuKOk8le'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, tbRLYiolqbIBshu0mdX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Gfc1r4Ds0X', 'uX91Sn7gIN', 'b6H1DUthFn', 'svW1fYbe4Z', 'b2317vq8Wm', 'Mh912sdlhM', 'Wc41Yrj0be'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, WuvQxvYIgololr7M5S.cs	High entropy of concatenated method names: 'YDr1gotB0t', 'j7a1UcXd34', 'g6r1T564Ql', 'xLc1X0ZWhR', 'jGP1LsDGBg', 'zvy1ihXCrR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, dUOhbgomtHdfUPFto0h.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'a8OoLTrfhE', 'KlJo19HBvi', 'KPyo0jaPNv', 'M5WooCS9ZN', 'i20o4RvM64', 'kNGoh2Rs0I', 'VHNoG3eS1a'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, icVo777oQlS8BDNOD8.cs	High entropy of concatenated method names: 'hycxH2kiQ9', 'AVuxMGiljm', 'ToString', 'nW0xRfrn1p', 'GfBxbr4uFK', 'cO0xg1Uc9a', 'i2cxUMB0Y2', 'VL6xTkkgSB', 'kiwxX3DHXn', 'aH3xiNAXwH'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, MpmEQvnDTkMGHXW5tl.cs	High entropy of concatenated method names: 'Dispose', 'T8Zjev80xQ', 'JDitmSWEw4', 'HbPocmhkjr', 'K9cjOQ43pB', 'YGfjz58MrD', 'ProcessDialogKey', 'QILtdujvin', 'KMbtjNXs62', 'bSlttgsTya'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, W7EnincKnyVAQnexwB.cs	High entropy of concatenated method names: 'K6Nbf1G7ZC', 'iu8b7mQ9bt', 'tH7b27ipLg', 'Mq0bYr8meJ', 'mUFbc8lP4d', 'nE2bwnHGuh', 'pQXbClFfaS', 'rl8bZ4yMPy', 'zTtbeaHNMn', 'uRJbOPT4yr'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, a6wIKD5ZU92sw1fCiF.cs	High entropy of concatenated method names: 'R2VgQGHE4A', 'UAigubvcW2', 'WrjgPgEAko', 'Qp2gyaxA0x', 'gfbgl7X0qY', 'xLWg3y5RHW', 'byigxwUp2Q', 'J2cg6wRro8', 'E5FgLJCBNW', 'Xtpg1bCFxG'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, e7HKvypOiwBUd7wRS5.cs	High entropy of concatenated method names: 'HYgXVGUT5E', 'exyXBZdUNL', 'EFsXFdPcAZ', 'zHXXQocMIy', 'zM0XED0HOc', 'YHLXuyMfxS', 'xqLXJwQjqD', 'lrcXPCqlN9', 'RApXyy702R', 'BoZXsOFNkA'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, UqxeJ4yXq0aUEUFODu.cs	High entropy of concatenated method names: 'QcALl3RyCd', 'Aw4LxmWmhB', 'SWiLLWq5Pi', 'iKmL0GHCJJ', 'LC5L4Vadcn', 'g35LGFaavq', 'Dispose', 'Ikv6Ri5kT8', 'Hs46b58IJG', 'y0m6gdfgV3'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, MkORJFWmrPD7RJCRfF.cs	High entropy of concatenated method names: 'tUPUE2FCNK', 'pHmUJ5Eqt0', 'l8BgKmVOln', 'kQtga3c8nZ', 'QO2gn0g5u3', 'KD8gIMXqyn', 'ijWg8FQ6ug', 'v9ugq5bw5E', 'KR1gNvEUE9', 'blegp5m4ob'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, bI5m8ENOX97eDT5JXi.cs	High entropy of concatenated method names: 'zXovPJx3H9', 'PwXvynDUKW', 'HgYv5wTaKd', 'Kuovm9ttNd', 'S4nvaJ68VL', 'iX5vnNyVpR', 'N8hv8gUGyU', 'AprvqJjKU7', 'zlIvp1BpIc', 'uA3vrZUg55'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, JExRBez0pDmoXFSG2P.cs	High entropy of concatenated method names: 'nxW1ubbvqC', 'IKk1PelmAI', 'eNj1yRkSBx', 'auw15kpoDD', 'bZp1mVolQp', 'VA71ayVYrT', 'eNR1nmQ3c4', 'aae1GeaBnX', 'R4j1VxYqkk', 'xOg1ByLWvy'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, A03jCrrGGL75XjN2wZ.cs	High entropy of concatenated method names: 'XBElpmNSDI', 'njjlS8Fs26', 'LXRlfdGGy2', 'x6Jl7Llfb8', 'S4QlmRXeWR', 'bxdlKKHqMl', 'CIplaE8Aax', 'OO7lnemJCG', 'Ij0lIYXnId', 'bdpl8M32Of'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, LQcoCSbuhUFhxfCQTv.cs	High entropy of concatenated method names: 'AxfWARv7ES', 'tLDWRx5aH9', 'J9HWbP174i', 'cfOWgE9XHc', 'T3vWUu50i5', 'AlQWTQILer', 'YRBWXuQotu', 'iWJWisLRWx', 'BBoW9t5An7', 'vgsWHjCAoD'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, tpa4qSxTgMdPCUd3Ka.cs	High entropy of concatenated method names: 'AlwxZsG5NT', 'B9vxObPvjT', 'PUG6d2Mh6l', 'W366jfDV1B', 'nDSxrbF1ZU', 'IqSxS9J3dM', 'E4sxDvSckF', 'rSqxfbfhPU', 'PxAx7BVrO1', 'TUax2fXiAE'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, GWScYRtZiQVI4AaNBV.cs	High entropy of concatenated method names: 'ToString', 'dhc3rVFOq7', 'L0a3mduJ7q', 'Ggy3Kvu0oh', 'Vfp3am1vlH', 'GOu3nuxFnl', 'pBF3Il97mP', 'rRr38mmkmw', 'pVC3qBJ09A', 'wja3NB1792'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, KvYKc4ooepvtfIi4tUL.cs	High entropy of concatenated method names: 'ylt1OBrVF9', 'hLc1z7k7Hq', 'eoZ0dkrJFM', 'mI00jJuAd1', 'Y0u0tfc39C', 'qfU0Wre8X6', 'c7Q0kpVtEo', 'cmW0A9bx3e', 'cd90RW17Vv', 'TKq0bcTUam'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, BDOAsEmawpdElhFvn4.cs	High entropy of concatenated method names: 'DJfjXYrS8g', 'tMhjirZrZT', 'i7FjHjCrY9', 'xjfjMpWjdm', 'jW6jl6XPRA', 'Wx0j3ByLoq', 'AAhm54o2MGmAgW5QBu', 'DpEiTf8wCetfb0nM7x', 'O40jjLRcZw', 'MU8jWseOHm'
Source: 0.2.39382629.exe.7180000.5.raw.unpack, sv2dwvAiKMQ6dl1CnR.cs	High entropy of concatenated method names: 'A8DTA0T2qy', 'aORTbyPsNF', 'YHUTUx6ghk', 'jiPTXc9jDU', 'QNmTiKjyPP', 'kPlUc1xxlV', 'wT5UwF5W4u', 'bAIUCiMs40', 'nEbUZlyId4', 'plxUebgPfi'

Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 39382629.exe PID: 7544, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\39382629.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\39382629.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 4970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 8AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 7350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 9AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: AAD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 1490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe	Window / User API: threadDelayed 1255			Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Window / User API: threadDelayed 3937			Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe TID: 7916	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\39382629.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 39382629.exe, 00000002.00000002.1822963754.00000000014D6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\39382629.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

Process created: C:\Users\user\Desktop\39382629.exe "C:\Users\user\Desktop\39382629.exe"

Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Users\user\Desktop\39382629.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Users\user\Desktop\39382629.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\39382629.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 39382629.exe, 00000002.00000002.1836071260.000000000668A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\39382629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.39382629.exe.3ad4b58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.39b5da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.3ad4b58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.39b5da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.39382629.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.3a45138.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1822092380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699747934.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 39382629.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 39382629.exe PID: 7712, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\39382629.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 39382629.exe PID: 7712, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.39382629.exe.3ad4b58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.39b5da8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.3ad4b58.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.39b5da8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.39382629.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.39382629.exe.3a45138.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1822092380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699747934.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 39382629.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 39382629.exe PID: 7712, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
39382629.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Strictor

Name	Source	Malicious	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23ResponseD	39382629.exe, 00000002.00000002.1823869664.000000000331C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id2Response	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id4	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id7	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id6Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ip.sb/ip	39382629.exe, 00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000000.00000002.1699747934.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1822092380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, 39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/sc	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1ResponseD	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://git.io/vblQ0	39382629.exe	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id9Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id20	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id21	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id22	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id23	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id24Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	39382629.exe, 00000002.00000002.1823869664.000000000369C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id1Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/08/addressing	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id11	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id12	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id13	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id14	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id15	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id16	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id17	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id18	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id5Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id19	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id10Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/Entity/Id8Response	39382629.exe, 00000002.00000002.1823869664.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	39382629.exe, 00000000.00000002.1703817177.0000000006BB2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	39382629.exe, 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.120.7	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580579
Start date and time:	2024-12-25 10:36:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	39382629.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 268 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:36:58	API Interceptor	28x Sleep call for process: 39382629.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	87.120.112.234
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	87.120.112.234
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	87.120.112.234
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	87.120.112.234
	arm7.elf	Get hash	malicious	Mirai	Browse	87.120.114.32
	x86_64.elf	Get hash	malicious	Mirai	Browse	87.120.114.32
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	87.120.112.234
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	87.120.112.234
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	87.120.112.234
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	87.120.112.234

Process:	C:\Users\user\Desktop\39382629.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.337066511654157
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhgLE4qXKIE4oKNzKoZAE4Kze0E4qE4x84j:MIHK5HKH1qHiYHKh3ogLHitHo6hAHKze
MD5:	55A2AF8F9FCA3AE99FBA235D3E16A53F
SHA1:	32F34219599006657BFF0B868257916A0C393AAA
SHA-256:	2E0B5859D8501D26669B982BD18005B625352435DB8E1D8B944EED350C1DB0B3
SHA-512:	F6EB6E6AA729963FF23349B6DF3B558896C7B294BF15F6601C4FEF2B1034DEBE207CE04A85F14124CBC41B168157778A23BAA06FCCFE13B0EE262CF2D80FDDA6
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.367968135237483
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	39382629.exe
File size:	1'071'616 bytes
MD5:	e8baebcd4279a203d5d3b6b21f753e5b
SHA1:	60382eed3e26e8b20830749b0c1a872057fd362e
SHA256:	cb4a22756f39ea5c69e24772b8eb6d004962196c683cc2d7742eb89e65836890
SHA512:	2624efc40e014e44f5cb9e3628d1d9c01d3424a9e48c2cc13d6d67de891d913dd055f1c615c6827d83e20807b12ddb722166c5c7ec7cd2c262f51e8c058c822d
SSDEEP:	24576:Wj30ivvE/4NzF4xuY9lOJ9IQ32vfeSKzk0Oq3Gf:Wjki3E/44x3bOp2fqxOO
TLSH:	8435F1091A44D147C869B3348AB6F1B91F343D9FF650D65A9FF4BEBF34B8A124C1A602
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....kg..............0..>...........]... ...`....@.. ....................................@................................

File Icon


Icon Hash:	32642092d4f29244

Static PE Info

General

Entrypoint:	0x505d2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676BA2EE [Wed Dec 25 06:15:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x105cda	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x106000	0x1750	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x108000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x103160	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x103d34	0x103e00	26cd4810ab3dc698589151a960eb6fd7	False	0.77919353505291	data	7.379318935525983	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x106000	0x1750	0x1800	c9a2b722e0babad4bf83bae0016d6b13	False	0.3898111979166667	data	5.080848135521701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x108000	0xc	0x200	82d823bc73df9132daf3eff1893692c8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x106130	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3726547842401501
RT_GROUP_ICON	0x1071d8	0x14	data	1.1
RT_VERSION	0x1071ec	0x378	data	0.43243243243243246
RT_MANIFEST	0x107564	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-25T10:37:02.220812+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:02.220812+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:02.609013+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	87.120.120.7	1912	192.168.2.4	49733	TCP
2024-12-25T10:37:07.819578+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:09.978821+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	87.120.120.7	1912	192.168.2.4	49733	TCP
2024-12-25T10:37:12.262922+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.7	1912	TCP
2024-12-25T10:37:12.682432+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	87.120.120.7	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 10:37:00.836842060 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:00.956410885 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:00.956499100 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:00.966226101 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:01.085731030 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:02.189764977 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:02.220812082 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:02.340451002 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:02.609013081 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:02.664509058 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:07.819577932 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:07.939680099 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210374117 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210396051 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210407972 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210418940 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210429907 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210441113 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:08.210455894 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:08.210493088 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.858936071 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.978821039 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.978837013 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.978874922 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.978955030 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979022026 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979042053 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979044914 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979062080 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979110003 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979120016 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979203939 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979253054 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979255915 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979307890 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979378939 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979425907 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:09.979434013 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:09.979486942 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.098803043 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.098813057 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.098889112 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.098896980 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.098999023 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.099006891 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.099013090 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.099076033 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.099272966 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.099282980 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.099373102 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.099378109 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.099431038 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.099436045 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.099503994 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.218851089 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.218921900 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.218955994 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.218992949 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219033003 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219063044 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219104052 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219172955 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219249010 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219326019 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219330072 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219376087 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219377995 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219436884 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219465017 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219516993 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219598055 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219681025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219713926 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219727993 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219804049 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219858885 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.219930887 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219939947 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.219994068 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220017910 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220027924 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220103025 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220112085 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220120907 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220175982 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220211983 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220221043 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220290899 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220320940 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220336914 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220367908 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220381975 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220411062 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220421076 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220474958 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220568895 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220577002 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220617056 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220623970 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220653057 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220664024 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220701933 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.220706940 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.220766068 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.339695930 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.339847088 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.339921951 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.339965105 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340101957 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340159893 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.340272903 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340281963 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340327978 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.340459108 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340565920 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340574980 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340583086 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.340636969 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.341007948 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341017008 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341181040 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341341019 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341506958 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341516972 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341604948 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341613054 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341620922 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341639042 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341648102 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341650963 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341659069 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341667891 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341677904 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341686964 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341696024 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341702938 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341713905 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341722012 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341732025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341795921 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341917038 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.341986895 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342068911 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342080116 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342255116 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342262983 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342309952 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342428923 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342464924 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342552900 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342592955 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342735052 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342742920 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342874050 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.342881918 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343019962 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343028069 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343234062 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343344927 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343360901 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343369961 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343467951 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343548059 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343676090 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343683958 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343822002 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343868017 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.343997955 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344007015 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344080925 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344147921 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344295025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344333887 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344466925 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344475985 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344580889 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344631910 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344775915 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344784975 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.344794989 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.344854116 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.459667921 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.459686041 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.459815025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.459824085 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.459835052 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.459959030 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.459969044 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460097075 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460243940 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460252047 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460457087 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460464001 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460479975 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460488081 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460494995 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460503101 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460515022 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460568905 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460623026 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460632086 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.460865974 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.460935116 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.464413881 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464422941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464518070 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464545012 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464787006 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464797020 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464935064 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464943886 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464953899 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.464961052 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465095997 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465104103 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465138912 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465147972 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465291023 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465466022 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465475082 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465584993 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465593100 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465600014 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465604067 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465616941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465814114 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465822935 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465893030 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.465903044 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466089964 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466098070 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466118097 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466154099 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466279984 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466288090 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466372013 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466379881 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466447115 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466514111 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466608047 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466667891 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466681004 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466689110 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466784954 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466793060 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466934919 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466943026 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.466945887 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467000961 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467016935 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467025042 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467137098 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467310905 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467324972 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467333078 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467626095 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467636108 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.467845917 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.467906952 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.580733061 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.580744028 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581039906 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581145048 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581326008 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581334114 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581341982 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581516981 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581628084 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581635952 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581645012 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581650019 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581711054 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581720114 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581819057 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.581855059 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582007885 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582015991 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582130909 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582139969 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582217932 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582284927 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582477093 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582484961 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582629919 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582678080 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582791090 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582798958 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582808018 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582817078 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582918882 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.582926035 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583009958 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583019018 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583169937 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583178997 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583183050 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583252907 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583338976 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583422899 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583522081 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583530903 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583657980 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583664894 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583775043 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.583784103 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584357977 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584366083 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584368944 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584378958 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584387064 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584476948 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584485054 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584491968 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.584723949 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.584796906 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.587459087 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587580919 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587590933 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587677002 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587686062 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587764025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587771893 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587845087 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587862015 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.587949038 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588032007 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588040113 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588068008 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588182926 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588191032 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588417053 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588828087 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588835955 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588849068 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588857889 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588865995 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588876009 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588884115 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588980913 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.588989019 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589334965 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589343071 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589346886 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589354038 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589356899 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589371920 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589384079 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589387894 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589453936 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589559078 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589567900 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589576006 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589608908 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589669943 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589729071 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589736938 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.589937925 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590167999 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590176105 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590421915 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590431929 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590439081 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590441942 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590445995 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590455055 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590457916 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590461969 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590501070 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590574026 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.590769053 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.590825081 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.706995964 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707012892 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707022905 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707032919 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707042933 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707051992 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707669973 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707741022 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707778931 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707828045 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707838058 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.707922935 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.708220959 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.709132910 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.709268093 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.709278107 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.709321022 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.709357023 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.709480047 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.710390091 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.710427046 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.710616112 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.710624933 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.711189032 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.711788893 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712076902 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712567091 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712575912 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712584972 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712738991 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712754965 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712764978 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712774038 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712868929 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712877989 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.712934971 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714109898 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714119911 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714262962 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714272976 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714406013 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714416027 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.714423895 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.715759993 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.715770006 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.715822935 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.715831995 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.715926886 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.715935946 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717015028 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717024088 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717031956 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717041016 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717174053 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717183113 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717190981 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.717444897 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.717525005 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.718159914 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718236923 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718267918 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718276978 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718291998 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718300104 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718310118 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718318939 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718441963 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718451023 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718537092 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718664885 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718676090 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718683004 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718776941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718786001 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718847036 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.718857050 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719011068 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719021082 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719049931 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719069004 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719223022 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719232082 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719285965 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719295025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719605923 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719615936 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719774008 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719784021 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719911098 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719923973 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719933033 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.719944000 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720050097 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720060110 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720068932 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720211983 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720341921 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720351934 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720360994 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720370054 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720458984 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720468044 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720477104 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720491886 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720500946 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720510006 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720519066 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720618010 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720628977 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.720843077 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.720911980 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.837126970 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837146044 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837179899 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837280989 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837304115 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837348938 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837414026 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837435961 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837483883 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837496996 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837570906 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837579966 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837680101 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837697983 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837801933 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837811947 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837831974 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837842941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837965012 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.837979078 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838042974 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838083029 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838205099 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838215113 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838231087 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838239908 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838361025 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838408947 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838504076 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838512897 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838545084 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838614941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838624954 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838634014 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838816881 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838826895 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838846922 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.838856936 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839056969 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839082003 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839092016 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839109898 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839119911 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839138985 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839220047 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839230061 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839351892 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839360952 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839370966 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839447975 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839457989 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839468002 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839536905 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839545965 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.839755058 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.839823961 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.840435028 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840488911 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840579033 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840588093 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840626001 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840636015 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840764046 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840840101 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840903044 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840913057 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840955019 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.840965986 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841095924 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841105938 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841114044 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841121912 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841181040 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841191053 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841330051 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841340065 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841350079 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841363907 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841453075 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841510057 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841562986 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841650009 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841723919 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841759920 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841881037 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.841995001 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842094898 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842250109 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842295885 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842428923 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842536926 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842596054 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842688084 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842698097 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.842792034 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:10.959506035 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.959682941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.960124016 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.960155010 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.960303068 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.960387945 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.960560083 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.960709095 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961225986 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961236000 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961393118 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961553097 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961668015 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961822033 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.961894989 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962024927 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962034941 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962455988 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962511063 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962660074 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962749958 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.962953091 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:10.963010073 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:12.262105942 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:12.262922049 CET	49733	1912	192.168.2.4	87.120.120.7
Dec 25, 2024 10:37:12.382493019 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:12.654376030 CET	1912	49733	87.120.120.7	192.168.2.4
Dec 25, 2024 10:37:12.682431936 CET	49733	1912	192.168.2.4	87.120.120.7

Target ID:	0
Start time:	04:36:56
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\39382629.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\39382629.exe"
Imagebase:	0x550000
File size:	1'071'616 bytes
MD5 hash:	E8BAEBCD4279A203D5D3B6B21F753E5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1699747934.0000000003979000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1699747934.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1699747934.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:36:59
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\39382629.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\39382629.exe"
Imagebase:	0xda0000
File size:	1'071'616 bytes
MD5 hash:	E8BAEBCD4279A203D5D3B6B21F753E5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1822092380.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1823869664.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	2

Executed Functions

Function 07130040 Relevance: 25.0, Strings: 19, Instructions: 1235COMMON

Download Yara Rule

Strings

ctq, xrefs: 071308BE
,xq, xrefs: 07130FE9
|buq, xrefs: 07130391
|buq, xrefs: 0713039B
ctq, xrefs: 071308DA
h|q, xrefs: 0713025C
ctq, xrefs: 0713043D
$tq, xrefs: 07130BA8
h|q, xrefs: 07130217
h|q, xrefs: 07130252
$tq, xrefs: 07130B96
$tq, xrefs: 07130BB4
4ctq, xrefs: 0713028F
|buq, xrefs: 07130356
4ctq, xrefs: 07130285
$|q, xrefs: 071301DA
ctq, xrefs: 071308D0
,xq, xrefs: 07130FFD
kT, xrefs: 07130FBE

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: $|q$,xq$,xq$4ctq$4ctq$h|q$h|q$h|q$|buq$|buq$|buq$$tq$$tq$$tq$ctq$ctq$ctq$ctq$kT
API String ID: 0-3177018962
Opcode ID: 4be77220d14a8b20184b465e22dbc4e13af4a62bca62643e8d9c2c5ca923fe49
Instruction ID: fc64e141ab95cfb295961699789e91633e4c28c0fa8425f246c46adae97ce19c
Opcode Fuzzy Hash: 4be77220d14a8b20184b465e22dbc4e13af4a62bca62643e8d9c2c5ca923fe49
Instruction Fuzzy Hash: 98B23BB4B006158FCB15DF29C494A69BBF2BF88310F1585A9E80ADB3A1DB31ED81CF51

Function 070963F8 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 0709668C

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: $tq
API String ID: 0-2018120210
Opcode ID: a52abbbe6a876534d7fb866ee8f6b3a806cd7c5e9dfc7b5ebccdd86f9309831d
Instruction ID: 0c20ec27dfc58d3511c2528f1d2ad4ac4844f5e09729e1c01c8d30ce1c842fd3
Opcode Fuzzy Hash: a52abbbe6a876534d7fb866ee8f6b3a806cd7c5e9dfc7b5ebccdd86f9309831d
Instruction Fuzzy Hash: 4B126EB4B002059FCB54DF79C454AAEBBF6BF88700B158269E906EB365DB31EC41CB90

Function 028D3E40 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

Pqtq, xrefs: 028D7357

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID:
String ID: Pqtq
API String ID: 0-3542822785
Opcode ID: 0627d4af01486a327d7b4a1236e228ae7690d233ae71acacc3a24e30932c1995
Instruction ID: 8b69b9271ac31cbc394ca1786d92ca5230dee3e34e1662871bcf198f119dd8ec
Opcode Fuzzy Hash: 0627d4af01486a327d7b4a1236e228ae7690d233ae71acacc3a24e30932c1995
Instruction Fuzzy Hash: 04E19178E00218CFDB54DFA9D984A9DBBB2FF88300F1085A9D909AB355DB30AD85CF51

Function 028D7288 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

Pqtq, xrefs: 028D7357

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID:
String ID: Pqtq
API String ID: 0-3542822785
Opcode ID: 9166582b9f2d512fe29a0d0cba4668b6dfa7d30111a17f44e7a0227c1ff96353
Instruction ID: 57a4b42003ffda35631020b8ab4b24127ae97fa3625c78d529e0b9495340a42d
Opcode Fuzzy Hash: 9166582b9f2d512fe29a0d0cba4668b6dfa7d30111a17f44e7a0227c1ff96353
Instruction Fuzzy Hash: 99B18074E01218CFDB54DFA9D984A9DBBF2BF88300F1485A9E809AB355DB30AD45CF50

Function 0713D6C0 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b185932a2666c49387dd064eb6f6b5bde32bf408c9674cbcda0b938ebf4480b6
Instruction ID: d37dcfef4fb0d4ddd986cf8e3cbc6c1518a54a57261aefcf0b8300688d312fba
Opcode Fuzzy Hash: b185932a2666c49387dd064eb6f6b5bde32bf408c9674cbcda0b938ebf4480b6
Instruction Fuzzy Hash: 044269B0B00205DFDB19DF78D494A6ABBF2BF89300F158569E4469B3A5DB74EC41CB90

Function 071353B8 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed563099d4edf242415daf52485a24d2d1e02846266f9254352e0f69164deb50
Instruction ID: 40f13a3008ab46bb973f1056c1d2965b5fd9bb5c2d6b6a4225586cae3dc8c5d5
Opcode Fuzzy Hash: ed563099d4edf242415daf52485a24d2d1e02846266f9254352e0f69164deb50
Instruction Fuzzy Hash: 92428BB0A00701CFCB2ACF79D58866ABBF3BF84715F158569E4028B794CB38E991CB50

Function 07132B18 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d00fc361adaa7a3943be0ce115da567d156f7fd11d980d203f02796139ea16
Instruction ID: d569be23872ad10a9bebd059715f96130a2b5abb6d32fa349c7fb7d46a3f5e85
Opcode Fuzzy Hash: a1d00fc361adaa7a3943be0ce115da567d156f7fd11d980d203f02796139ea16
Instruction Fuzzy Hash: 12F1D0B5B00215DBDB2AAF24D85567EBAA6FF88740F148529E806DB3C4CF74CC41CB91

Function 0713CF50 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee2eae6185d13d1bf7c3305808187059d1ebf89cfb3c3bcea6a06efb7d76435
Instruction ID: bd13f3b3533486c12fcf8defeb3b1498c163103b2e5080595e5a0bbb66864f61
Opcode Fuzzy Hash: 9ee2eae6185d13d1bf7c3305808187059d1ebf89cfb3c3bcea6a06efb7d76435
Instruction Fuzzy Hash: D01259B4B002059FDB15DF69C584A6ABBF2FF88300B19C599E549DB7A2C730ED45CBA0

Function 0713A0C8 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e261da5969c513551e7cbf47b377c913b5dbac1e3de1d6490fc2ddaa10d1ca
Instruction ID: 6d66bad6c1e0b107902cfcaa2206c8ef698175abe24ef58ec8c03e8bdf568c3e
Opcode Fuzzy Hash: 55e261da5969c513551e7cbf47b377c913b5dbac1e3de1d6490fc2ddaa10d1ca
Instruction Fuzzy Hash: 4F023CB5A00705CFDB25CF69C484A6ABBF2BF48300F15C669E8969B791DB39E845CB40

Function 07137F20 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ded573e85a95d92abe9d18e6c5aba1d8861648270582b3500574ec5be37ec06
Instruction ID: a5023a6944f2ec40cc407b33cab19d4f25b7789f4ff036222b11888506afeae7
Opcode Fuzzy Hash: 6ded573e85a95d92abe9d18e6c5aba1d8861648270582b3500574ec5be37ec06
Instruction Fuzzy Hash: 1DF15EB4A002099FDB08DFA5C854AADBBF2FF88300F118569E816AF395DB35ED45CB51

Function 07092350 Relevance: 38.3, Strings: 28, Instructions: 3259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 07093ED6
, tq, xrefs: 07094BA4
\stq, xrefs: 07093C10
4'tq, xrefs: 07092A52
(otq, xrefs: 07095549
xxq, xrefs: 07093E01
Hbuq, xrefs: 0709337D
p<tq, xrefs: 07092B14
$tq, xrefs: 07092AB3
X#tq, xrefs: 0709444B
ctq, xrefs: 07092738
x yq, xrefs: 07095917
$#tq, xrefs: 07094630
pByq, xrefs: 0709560B
0"tq, xrefs: 0709469C
yq, xrefs: 07092B75
;tq, xrefs: 07092D5A
|buq, xrefs: 07093823
4ctq, xrefs: 07092E1C
(Ayq, xrefs: 070947BF
,xq, xrefs: 070954E8
Pptq, xrefs: 0709418D
\;tq, xrefs: 070955AA
p`tq, xrefs: 070931F5
,xq, xrefs: 070942B8
|yq, xrefs: 0709412C
p tq, xrefs: 0709431D
LRtq, xrefs: 07094A79

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: $#tq$(Ayq$(otq$, tq$,xq$,xq$0"tq$4'tq$4ctq$Hbuq$LRtq$PHtq$Pptq$X#tq$\;tq$\stq$p tq$p<tq$pByq$p`tq$x yq$xxq$|buq$|yq$yq$$tq$;tq$ctq
API String ID: 0-3481421656
Opcode ID: f355f83fe74a77905559f71012e2babde823f00638de8eda004ee96e20646b6c
Instruction ID: 7e687cb39cd1edc1752f40f3ec53e490a7894f486a370b8688b6e746c43cb2de
Opcode Fuzzy Hash: f355f83fe74a77905559f71012e2babde823f00638de8eda004ee96e20646b6c
Instruction Fuzzy Hash: 14635EB1A00218AFEB659BA8CC45BED7BB6FF88300F1041D9E6096B2D0DB755E80DF55

Function 0711AB93 Relevance: 5.1, Strings: 4, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRtq, xrefs: 0711AB92
$tq, xrefs: 0711ACEA
$tq, xrefs: 0711AC0F
$tq, xrefs: 0711ACFA

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID: LRtq$$tq$$tq$$tq
API String ID: 0-3750185724
Opcode ID: 2b26d0515a6ca38268524896be9e2269e36abe335c90de149e022a82ec2ba9bc
Instruction ID: 2ad63d86197c04eed058befac972ec4a8b0935a875a92a4f9d0382305b5887b1
Opcode Fuzzy Hash: 2b26d0515a6ca38268524896be9e2269e36abe335c90de149e022a82ec2ba9bc
Instruction Fuzzy Hash: 2541DEB0B16246EFDB148BA8D845B7EBBA2EF45711F14817AE402AF2C0D7748992C744

Function 0709EE68 Relevance: 4.0, Strings: 3, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;-, xrefs: 0709EF7E
7, xrefs: 0709EFB9
,xq, xrefs: 0709F0F3

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: ,xq$;-$7
API String ID: 0-3552580634
Opcode ID: f0453609a1ef577d6b8d3f2e896d3ea3f21d265cdc3b8440f5ec4de987eeb868
Instruction ID: cf81d4e1a2c8ff154c0e18b8673b149dd25d60e1726095646e6e4e4cfbedb247
Opcode Fuzzy Hash: f0453609a1ef577d6b8d3f2e896d3ea3f21d265cdc3b8440f5ec4de987eeb868
Instruction Fuzzy Hash: EEA14DB4A102069FCB14DFA5C954A9EBBF6BF88740F108629E915DB364DF70EC42DB90

Function 0711ACBB Relevance: 3.9, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRtq, xrefs: 0711AB92
$tq, xrefs: 0711ACEA
$tq, xrefs: 0711AC0F

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID: LRtq$$tq$$tq
API String ID: 0-1569288798
Opcode ID: 86aa641541be9e371107ab1d45cb9815cf6e7e8b7e20253c541bfc4c1b310ffc
Instruction ID: 2cceea28cd14bd53e6b4fdbb193c02aad71741d1737bac52e3f6b0fc0993bd19
Opcode Fuzzy Hash: 86aa641541be9e371107ab1d45cb9815cf6e7e8b7e20253c541bfc4c1b310ffc
Instruction Fuzzy Hash: AA31E0B0B56205EBDB248FA8C846B7D7AA2FF01711F14817AE402EF2D0D7B48A91C749

Function 07131228 Relevance: 3.8, Strings: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(xq, xrefs: 071312A7
(xq, xrefs: 071312D3
(xq, xrefs: 0713127B

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: (xq$(xq$(xq
API String ID: 0-984040436
Opcode ID: 92922d4ce81937ce25f04b35c7fe0f4a60511a172006026b57587ea58caeb5ae
Instruction ID: 13be2d41b7d5f35c3ee47a9996d2a29fd66362f0c33f1daf97dedd5bf692604c
Opcode Fuzzy Hash: 92922d4ce81937ce25f04b35c7fe0f4a60511a172006026b57587ea58caeb5ae
Instruction Fuzzy Hash: AF216AB1B0C8589FD7589BADC010A2EBBC7EFC96907248119EC09EB385DF388D0283D1

Function 07111170 Relevance: 3.3, Instructions: 3315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c1f9d3328a92a551d213c59bf8f4fe5d4c7e70fb8801df384cbb435f7ec9dc
Instruction ID: 77934a136418de6c6865ef614ee0e046b3efa72b2550e48c61f3119ab92066bf
Opcode Fuzzy Hash: 44c1f9d3328a92a551d213c59bf8f4fe5d4c7e70fb8801df384cbb435f7ec9dc
Instruction Fuzzy Hash: 4B634BB0A40218AFEB259B60CC55BEEBB72EF88700F1041E9E70D7B2D1DA751E849F55

Function 07095C00 Relevance: 3.0, Strings: 2, Instructions: 459
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(xq, xrefs: 07095C14
d, xrefs: 07095E55

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: (xq$d
API String ID: 0-4179481474
Opcode ID: 1bf2dfa2e12b650e2d33ee3990207320d511557a27e1bfe38b44165c361ff4fc
Instruction ID: 8905b45d38d7db1b145e8ca858956f8e26ba942529ddfaf9345267c01d99f6d5
Opcode Fuzzy Hash: 1bf2dfa2e12b650e2d33ee3990207320d511557a27e1bfe38b44165c361ff4fc
Instruction Fuzzy Hash: F1028EB46006068FCB14CF5AC88496ABBF6FF88314B15C669D45A9B7A1DB31FC42CB90

Function 0709EE57 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;-, xrefs: 0709EF7E
7, xrefs: 0709EFB9

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: ;-$7
API String ID: 0-3582119738
Opcode ID: f8c352f6ae93f09af239fa3845ef5fdbd8bc3d40e66a42645bff2886613b3385
Instruction ID: e88e875be3531541e117d66588f2961d23634455f8867b7da8dbe551b751feb4
Opcode Fuzzy Hash: f8c352f6ae93f09af239fa3845ef5fdbd8bc3d40e66a42645bff2886613b3385
Instruction Fuzzy Hash: 34713BB0A102069FCB14DF69C85499EBBF2FF88300B108669E815EF365DB70ED46CB90

Function 0711B74A Relevance: 2.6, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8xq, xrefs: 0711B823
8xq, xrefs: 0711B850

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID: 8xq$8xq
API String ID: 0-3319388108
Opcode ID: cc41330711b1f00f2f98ae9c3d5cc66b04f14c11fce56244953950d12fd097b8
Instruction ID: 30a7398515b42ffad6fbce280db0255adc4830ac7ed9430f0094bc6147033fb7
Opcode Fuzzy Hash: cc41330711b1f00f2f98ae9c3d5cc66b04f14c11fce56244953950d12fd097b8
Instruction Fuzzy Hash: F131E2F1B08201DFD7249B69D806AA97BA2FBC9705F24807EE405DF3D1EB75894287A1

Function 07119958 Relevance: 2.5, Strings: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 0711997E
$tq, xrefs: 07119972

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID: $tq$$tq
API String ID: 0-1837209516
Opcode ID: 71c6961e6264b6b85c2b2884c734b970e4747588fa5bb3c4335d03e9bc23af11
Instruction ID: f963ce281d8f0e8c3194c71d11c7d26ff4dd0e03082beabe429572e5cf66c5fa
Opcode Fuzzy Hash: 71c6961e6264b6b85c2b2884c734b970e4747588fa5bb3c4335d03e9bc23af11
Instruction Fuzzy Hash: 60D0C26050D3CE5EE72702311C20294AF25EA4300076D00A7C450CF183E7048816C362

Function 0713EE80 Relevance: 1.9, Strings: 1, Instructions: 601
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbuq, xrefs: 0713EED3

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: Hbuq
API String ID: 0-1107131545
Opcode ID: f46c99bea4702d9ac20da295f12a5b018fb2ef16fa24ddcde083731b3ea1050f
Instruction ID: ca7c32f7579340c1bf3e94e4b09bd3513a39b74ab0b4dc899842b96445a56cf4
Opcode Fuzzy Hash: f46c99bea4702d9ac20da295f12a5b018fb2ef16fa24ddcde083731b3ea1050f
Instruction Fuzzy Hash: F34217B4A002099FCB15DF68C594E9EBBF6FF48310F1585A9E805AB3A1D734ED46CB90

Function 0709B588 Relevance: 1.6, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hxq, xrefs: 0709B6C1

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: Hxq
API String ID: 0-2956916855
Opcode ID: 6c126aa776c9b16d0a2148036409dc7f5a6d0ac4f48db67dfe606f25705b00cd
Instruction ID: 3a108266be9e296892b8f7b5c46ffe78652ffd51773b39e26221f5e137af8864
Opcode Fuzzy Hash: 6c126aa776c9b16d0a2148036409dc7f5a6d0ac4f48db67dfe606f25705b00cd
Instruction Fuzzy Hash: D5D1D0F1B142269FCF618B68A44062EFBE2AF89620F15476EE841DB395DB30CC41DBD1

Function 028D590D Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 028D59C9

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b9b9227a07d247fd4c4761d6c11c08a7f42243bcc8ce6eb4fc29d091b74fca86
Instruction ID: 6d7258e201b484a82ace68452d213156be139fbe709bcb8baa8d640b6def19f5
Opcode Fuzzy Hash: b9b9227a07d247fd4c4761d6c11c08a7f42243bcc8ce6eb4fc29d091b74fca86
Instruction Fuzzy Hash: CD41E3B4C0061DDBDB24DFA9C884B9EBBF5BF48314F60806AD409AB251DB79694ACF50

Function 028D44C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 028D59C9

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 363ed681b9e0659773b9e243b5b5e0c492dce4cfa2532a685ba1968d816d36be
Instruction ID: 12920f59777a4103cd60222816fad0fec20e807a3dd23edb0497febd562a4725
Opcode Fuzzy Hash: 363ed681b9e0659773b9e243b5b5e0c492dce4cfa2532a685ba1968d816d36be
Instruction Fuzzy Hash: 2641E2B4C0071DCBDB24DFA9C885B9EBBF5BF48314F60805AD409AB251DB796949CF90

Function 028DD470 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,028DDB6E,?,?,?,?,?), ref: 028DDC2F

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: faef2b3c269bd169a139ee8376231b8b6730d3bf6335fa16b4d50d44b7f06efc
Instruction ID: 75a9f460a4265a3e93eedb768ba1a85923ed34e83854bf802add1adbac1b46e3
Opcode Fuzzy Hash: faef2b3c269bd169a139ee8376231b8b6730d3bf6335fa16b4d50d44b7f06efc
Instruction Fuzzy Hash: D421E5B5D002489FDB10CF9AD584ADEFBF4EB48324F14841AE919A7310D375A944CFA1

Function 028DDBA0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,028DDB6E,?,?,?,?,?), ref: 028DDC2F

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3d6a1c54618871b1a3d680b4e03c85e7f98442cd2a26c0f213ba7ea08d83813b
Instruction ID: 57f7c754a6b8f750d02df1c098482c1fa84f587e7ca69a6c524cd15827329177
Opcode Fuzzy Hash: 3d6a1c54618871b1a3d680b4e03c85e7f98442cd2a26c0f213ba7ea08d83813b
Instruction Fuzzy Hash: 8821E6B5D00248DFDB10CF9AD584ADEBBF4EB48320F14841AE918E3350D374A944CFA1

Function 028DDBA5 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,028DDB6E,?,?,?,?,?), ref: 028DDC2F

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b6f633c6ce13809ec64e020a6bea6a1c20c819e9a06b041dee80c0a4b7291f21
Instruction ID: 3247ea80e845f4c3cb157e1ef3e4a080a36dc598f27dbaa8e52abd169c498681
Opcode Fuzzy Hash: b6f633c6ce13809ec64e020a6bea6a1c20c819e9a06b041dee80c0a4b7291f21
Instruction Fuzzy Hash: DA21E4B5D002489FDB10CF9AD584ADEBFF4EB48320F14841AE918E7350D379A945CFA1

Function 028DB8BC Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 028DB926

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8e0e1b2fc029349c82ec8f84769588fe9b8d001728fa8f8e9cd41e820c0be5b3
Instruction ID: e78e43c1651882dc5b031a797330b0a7836f2aa906bc918c0bebf85df54fa564
Opcode Fuzzy Hash: 8e0e1b2fc029349c82ec8f84769588fe9b8d001728fa8f8e9cd41e820c0be5b3
Instruction Fuzzy Hash: B011F0B9C006499FCB10CF9AD484ADEFBF4EB88224F15851AD429A7600D379A546CFA1

Function 028DB8C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 028DB926

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d7f02143cd614b1e499b0c4c36f1f2912fd2336e4ebdd9a84d51b66db563e31e
Instruction ID: baa26e4fdbc575367ba23523807baa2f0d8ca718311bab5c86d058c7693f7b85
Opcode Fuzzy Hash: d7f02143cd614b1e499b0c4c36f1f2912fd2336e4ebdd9a84d51b66db563e31e
Instruction Fuzzy Hash: 36110FB9C006899FCB10CF9AC484A9EFBF4EF88224F15841AD429B7200D379A549CFA1

Function 07097E78 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

d, xrefs: 070980C9

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: c11c1a4da845d3ef0f1fbb61322cc16d497a7082ba953e395a79bc13a74a5903
Instruction ID: e576060aad4eeac0b47e03631a071d9e431d8cd17097157b7cd4d14125c336d0
Opcode Fuzzy Hash: c11c1a4da845d3ef0f1fbb61322cc16d497a7082ba953e395a79bc13a74a5903
Instruction Fuzzy Hash: F4C17D75600606CFCB10CF19C48096ABBF6FF89314B16CA69E55A9B3A5DB30FC46DB90

Function 07090701 Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

,xq, xrefs: 070907F3

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: ,xq
API String ID: 0-593212731
Opcode ID: 3c6096d0639ca7467e345907cc12b50f904867ecce2e664521d210d97779f40f
Instruction ID: cfdadee0940a5ab74157bf7f81781c7e0fde64da216ded73d9929f1fe57c50c8
Opcode Fuzzy Hash: 3c6096d0639ca7467e345907cc12b50f904867ecce2e664521d210d97779f40f
Instruction Fuzzy Hash: 1E71B5F0B141078FDFA59A79951053EB6E6AFC6350B1442B6D816CF3A1EE20CC41EBB2

Function 07096AF0 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

,xq, xrefs: 07096D28

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: ,xq
API String ID: 0-593212731
Opcode ID: 89a135263b8032cf9be99d510e818af58e216240dee13a1ded9a882b84d3e33e
Instruction ID: df1645c3527e77bb0f0e578130c4ff03c1a0c5f795a04609bcc684727f4c448c
Opcode Fuzzy Hash: 89a135263b8032cf9be99d510e818af58e216240dee13a1ded9a882b84d3e33e
Instruction Fuzzy Hash: 87717FB47102008FCB18AB79D458A2ABBF6EF89614B1541BAF506CB3B2DF72DC41CB50

Function 055D8628 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

(xq, xrefs: 055D87C5

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID: (xq
API String ID: 0-3100309293
Opcode ID: a4c3cfc339c4595bc97c4b07f75257b687f94a11f0ac5be4c9284ab6c2c41ea6
Instruction ID: e52ac656afa188c512e670b82d25778867f6f5824e4da08ed4fca884bc4a7f24
Opcode Fuzzy Hash: a4c3cfc339c4595bc97c4b07f75257b687f94a11f0ac5be4c9284ab6c2c41ea6
Instruction Fuzzy Hash: 5771B3326002059FD728DB6EC854BAEFBA6FFC8310F148829E90697291DF759941CB61

Function 0709E670 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

$tq, xrefs: 0709E6BC

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: $tq
API String ID: 0-2018120210
Opcode ID: 9bf9a6e88ad4aa85ff051969a1ccbeb1fe32d416abdb495a2ad0193561bba36e
Instruction ID: 36a6c2071182a0cd3db66275b94761f2f77a7036105cec93f2ebb06c6f735389
Opcode Fuzzy Hash: 9bf9a6e88ad4aa85ff051969a1ccbeb1fe32d416abdb495a2ad0193561bba36e
Instruction Fuzzy Hash: E16149B6A10205CFDB54DB69D848AAEB7F1FF88711F208179E816AB3A0DB30DC41DB50

Function 07090ED8 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

d, xrefs: 07091024

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: e59d1659b4f1d02f6f246bb6304361ab47e75c4ea96522cda1743fb023d01aad
Instruction ID: 1cbb0b1eab67a2036ef60964ef1ce843f98a44245cfac6bde2a8f25a880811af
Opcode Fuzzy Hash: e59d1659b4f1d02f6f246bb6304361ab47e75c4ea96522cda1743fb023d01aad
Instruction Fuzzy Hash: F06169B4A0060A8FCF14CF59D4C08AAFBB6FF88310B50C669E91997755EB31F951CBA0

Function 0711C148 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

Hxq, xrefs: 0711CB79

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID: Hxq
API String ID: 0-2956916855
Opcode ID: cdc8f22348177adf0f8701c8ff9e6cd27a212e531d0d9bcd68727406a6f0d96e
Instruction ID: ae3d56e064f62de0ad0bfe9a2bb1620ec0bcb98beb8c7cc6ba322b7014aa50f4
Opcode Fuzzy Hash: cdc8f22348177adf0f8701c8ff9e6cd27a212e531d0d9bcd68727406a6f0d96e
Instruction Fuzzy Hash: 0051B2B0954619CBCB158F68C8402AEBBB2FF86300F15857AE815EF2A1D738DD42C7A5

Function 0713D508 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

@, xrefs: 0713D671

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 51c1be37db6ebfdb404f022112f0cb788add5c9c1a9cd77d47fc401deee725b3
Instruction ID: 2b5b8a9084eb4ead3db0ea2bf60b1216e874df8ab298c84aa3a2115fe10b09ca
Opcode Fuzzy Hash: 51c1be37db6ebfdb404f022112f0cb788add5c9c1a9cd77d47fc401deee725b3
Instruction Fuzzy Hash: 77519FF5B002199FDB05CF68D885AAEBBF1FF48310F058466E859EB291D730D944CB90

Function 055D6D38 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(xq, xrefs: 055D6D74

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID: (xq
API String ID: 0-3100309293
Opcode ID: c06fa2276557642b25db481e9a2deaf10241dd1df69f40c7ad9d59836741d1fe
Instruction ID: d169fcff9285322f3ac7ee29b4fee9f7ca79b970af36946018f70f9c1bb08e20
Opcode Fuzzy Hash: c06fa2276557642b25db481e9a2deaf10241dd1df69f40c7ad9d59836741d1fe
Instruction Fuzzy Hash: D451AD75A042099FCB25DF6CE4596AEBBF6FF88300B148569E806DB341DF30D802CBA1

Function 070982B0 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

,xq, xrefs: 07098326

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: ,xq
API String ID: 0-593212731
Opcode ID: 48384d32765f4204190ce3da86aefd20ba1a47a70973cfa17ef300107eb48b46
Instruction ID: e1f3b194317ab51e5d590234373e99725d55fb1f7b9863776e0d05d175b77b2c
Opcode Fuzzy Hash: 48384d32765f4204190ce3da86aefd20ba1a47a70973cfa17ef300107eb48b46
Instruction Fuzzy Hash: FC514FB47042009FC718DB79D15492A7BE3AF8A3447658AB8E506CF7B6CA71EC41CB91

Function 0709FC60 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

`]yq, xrefs: 0709FD6E

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: `]yq
API String ID: 0-2818119401
Opcode ID: 2038ead6ef0c9a04ea7faeb828d9024e5916328b11ddff36d3dbad7c03acc3e1
Instruction ID: 943059d72acf207e6a036de251f43c6e39ba402645718b1034f3318b488d2e43
Opcode Fuzzy Hash: 2038ead6ef0c9a04ea7faeb828d9024e5916328b11ddff36d3dbad7c03acc3e1
Instruction Fuzzy Hash: F241D2B1701616CFCB14DF29DA8096ABBF5EF89311B1585BAE809CB365DB30EC41CB61

Function 070982A0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

,xq, xrefs: 07098326

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: ,xq
API String ID: 0-593212731
Opcode ID: 23af32d4c92a6ab11021d2f4e14129b9f703828d51b8cf4e400a0c88f90c0d1e
Instruction ID: 1f3fe9e7b3f418315da10c754b667149571e446cdf27d819ebb41d910c6f21bd
Opcode Fuzzy Hash: 23af32d4c92a6ab11021d2f4e14129b9f703828d51b8cf4e400a0c88f90c0d1e
Instruction Fuzzy Hash: 1E416EB47042009FCB18DB79D05496A7BE3AFCA3447558AB8E106CF7A6DE31EC41CBA1

Function 0709CE70 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

4'tq, xrefs: 0709CF23

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 380ef211679153fa88a848c967c43e279e0da264125ab1d824f9eb810c073035
Instruction ID: 77b3cc62cced308d9f8267a21e66249b63a9db7bf07b99ded118cecc339a1f10
Opcode Fuzzy Hash: 380ef211679153fa88a848c967c43e279e0da264125ab1d824f9eb810c073035
Instruction Fuzzy Hash: 3D319AB0A00205CFDB14CF68D488AAB7BF6EF49310B1045A9E8069B361DB30ED40DB60

Function 0713D4F7 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

@, xrefs: 0713D53A

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f37dc39e3816d964da1c79b5260a9b95cc02e4c19bceadeaf99e37b5792ef47d
Instruction ID: d0144dd203a69daa98af527660e7f603d3669ec288846f7c4ced96a1e02069c1
Opcode Fuzzy Hash: f37dc39e3816d964da1c79b5260a9b95cc02e4c19bceadeaf99e37b5792ef47d
Instruction Fuzzy Hash: AB21A3B6A002199FCB15CF69E885EBE7BF5FF88210F058426F558D7291D734DA44CB90

Function 07096360 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

4'tq, xrefs: 070963CD

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: ed922bb65eb505b789703ce2542c95382bc009daf2de3f2969764178d140a676
Instruction ID: f99b89ff0ce49e0526d5b44f7ce9cad7f4e156d381db4bbfef364f5ea354977b
Opcode Fuzzy Hash: ed922bb65eb505b789703ce2542c95382bc009daf2de3f2969764178d140a676
Instruction Fuzzy Hash: 47F028B13002016FC619E7BDE85096F7BD7DFC92603044B28E40A9B791FF60AC0687E2

Function 07096370 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'tq, xrefs: 070963CD

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: d95685e2fd58c6c412b4d0ed7d0d80eaddedbf1007511623abdcbb6d1899b358
Instruction ID: 6411e5c913595088e1cef690e2c6eec83ea74df0d077f8aef41afcbb2a01c52a
Opcode Fuzzy Hash: d95685e2fd58c6c412b4d0ed7d0d80eaddedbf1007511623abdcbb6d1899b358
Instruction Fuzzy Hash: 6EF0B4703002016BC219EB7EE85096F7BD7EFCD2503145A28E54A9F755FF60AD4687E1

Function 055DB7C0 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

4'tq, xrefs: 055DB7D3

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 47ef39e91793c560d6e126de6e1b7ae7f1a70b63cc2686fcaf14773a4fb1983b
Instruction ID: 443d1a8ed32154a32ef0c33440e4316c43ea18db854f4856f911336ef74894f0
Opcode Fuzzy Hash: 47ef39e91793c560d6e126de6e1b7ae7f1a70b63cc2686fcaf14773a4fb1983b
Instruction Fuzzy Hash: FAD0A73505985506D70A576D7C167E93F627F4D200B094548F5C2021A5CF040C8347C6

Function 07096D58 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e669ed225f194382c838e8918dfa1089477ef62ab21c998f96f98a7f2c449f5
Instruction ID: 427c9e9a76b196461df0060a7b612f4a9dc40c19f8c9cd2d69e980a8f0a4ce27
Opcode Fuzzy Hash: 4e669ed225f194382c838e8918dfa1089477ef62ab21c998f96f98a7f2c449f5
Instruction Fuzzy Hash: 863247B57006058FCB14DF3AC898A6ABBF2FF89304B1585A9E506DB3A1DB31EC45CB51

Function 0713BB90 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a21c8f1c0bc21e34769e870ef5e143a61ec1fd2c6389308f6acb802a4113f0
Instruction ID: ad7d5982c1224350064b0da25e70bd83fda1d53e3719e5c77aa35d611d6d6ab2
Opcode Fuzzy Hash: 01a21c8f1c0bc21e34769e870ef5e143a61ec1fd2c6389308f6acb802a4113f0
Instruction Fuzzy Hash: D84229B4600605DFC725DF69C98496ABBF2FF88310B158A69E44A9B691DB34FC81CF90

Function 0713C2D0 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c21ff67d0fc27b011b28f04bff2fb28126e39e9e148c7afff9f729d39e0b2f
Instruction ID: d14ccaf3d6d01e20af8ea783992e000eac25e7a9f0ad660a6ebf1b4b385aab8b
Opcode Fuzzy Hash: 64c21ff67d0fc27b011b28f04bff2fb28126e39e9e148c7afff9f729d39e0b2f
Instruction Fuzzy Hash: 2012D1B1B042819FD711CF69D440AAEBBF2EF85310F1585AAE545AB2D2C730EC85CBA1

Function 055D8920 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e62005f2f0afa44f048d97ffee57e5e5955559e4c3a5d967e3bb4e4f01873c2
Instruction ID: a8623ae0c3b6b81efb762ca5369bcdee44ffb1974c64b0e0f7a5091c9241e2f4
Opcode Fuzzy Hash: 0e62005f2f0afa44f048d97ffee57e5e5955559e4c3a5d967e3bb4e4f01873c2
Instruction Fuzzy Hash: 74F19F72F05209CFCB25EB69C848AAEFFF2FF84210F1584A9D446A7265D7319851CBA1

Function 0709C820 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a434fc2d523fef4835200daba015ebf5c6eb587485ae89fe310fda945d53b4
Instruction ID: a84f24190bc4da428af7c1072cfba794e89ab94318e5d32de983e1cf4607d374
Opcode Fuzzy Hash: e6a434fc2d523fef4835200daba015ebf5c6eb587485ae89fe310fda945d53b4
Instruction Fuzzy Hash: 09F16EF0B106068BEB15EB7DD85065F7BE2EF84744F108A29E416DB344EB74ED019BA1

Function 0709DF59 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab94593e98b1ac834f9ee42b6fd9e8609ccd365957b31a9b5c754b646d47f3c
Instruction ID: 5180369aa4579ceb8e58d6162cc3f469293e4188376b18a09f9ab7879ea22e84
Opcode Fuzzy Hash: 3ab94593e98b1ac834f9ee42b6fd9e8609ccd365957b31a9b5c754b646d47f3c
Instruction Fuzzy Hash: 3E31F0B17053459FCF059B74D84866EBBB5AF8A211B14867DE806DB392DF71CC00CB90

Function 07134800 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755c341313321ff63b6aabaaf4cd8c1c1e779ee010c86b78f2972f1c1a42c6ce
Instruction ID: ec03bcf979ee0c09fe6df7eb3b81cdae26b59c72ab5e13a0c636274e3178be5e
Opcode Fuzzy Hash: 755c341313321ff63b6aabaaf4cd8c1c1e779ee010c86b78f2972f1c1a42c6ce
Instruction Fuzzy Hash: 1DF18CB4B00245DFDB19DFA8D858A6EBBF2EF88310F148169E9069B395DB34DD41CB90

Function 0709F2D0 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5f8f7a2a2dfb80391aaf83c6073bb5d7a631adba57f74451f99c472f322d5d
Instruction ID: c86728d61e4b2b7e0ec2343c335d980514327a4e82cef9b2832438c8553d3d9a
Opcode Fuzzy Hash: cb5f8f7a2a2dfb80391aaf83c6073bb5d7a631adba57f74451f99c472f322d5d
Instruction Fuzzy Hash: 1CF168B57106028FCB54DF2AC489A6EBBE2FF89310F1984A9E556CB361CB34ED01DB51

Function 07138BC8 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ef6a70b597964b56a45302d504d923a347af99e83415336965ea443489215d
Instruction ID: bc3ae58afc286d4f6ed26aad464d5d50aab49cde72c8ff117ce796a78747f7be
Opcode Fuzzy Hash: 80ef6a70b597964b56a45302d504d923a347af99e83415336965ea443489215d
Instruction Fuzzy Hash: C8E1B1B1A013419FC716DF68D48499ABBF2EF85310F15C5AAE509CB3A2DB30EC45CBA1

Function 0709E8B0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28cc80f134ab23e1528bd977a61267c28e361fdc2ad8d5f50e165d2e07384099
Instruction ID: a562c9b3ac9753d099e3e975ae670c520e197616dd1726341351e88c3e5e4ad5
Opcode Fuzzy Hash: 28cc80f134ab23e1528bd977a61267c28e361fdc2ad8d5f50e165d2e07384099
Instruction Fuzzy Hash: C7D15BF5B002559FCB08DF69C88596E7BB2BF88300F148669E5469B395CB70DC82EBD1

Function 0709E1E8 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717f0f7de9506a36ec445a60de9f5e47a65c1e419277b3971ac74ce5518b3507
Instruction ID: ab69918d5a33e7eb80f7362bb4a11e941cc336ba01f54e34d8d25e815f287178
Opcode Fuzzy Hash: 717f0f7de9506a36ec445a60de9f5e47a65c1e419277b3971ac74ce5518b3507
Instruction Fuzzy Hash: 33C16BF6B05226DBDF24CB24C44872EBBE2AF85B01F158679E8069B395DB71DC41DB80

Function 07138838 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227a1d356f716269af92ec327410d4f2b9de6ceabf6000840be130d3c710fcd2
Instruction ID: 63c2dfab16b35b33d831f0c470bf8c5d374ce01ca1c5ab77e806ecc0f8812519
Opcode Fuzzy Hash: 227a1d356f716269af92ec327410d4f2b9de6ceabf6000840be130d3c710fcd2
Instruction Fuzzy Hash: B5C1BEB1700341AFD716CF69D484A56BBE2FF85310B19C5AAE559CB3A6CB30EC85CB60

Function 07133BA8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6d06103e733776b659fb0191888a8c46014f211e74e7ea14f3e2bfffaaa955
Instruction ID: a65a4e47dabcbc344598f0e24f8f74fbb92c5d6252ff716dee46dedc006ca754
Opcode Fuzzy Hash: 3d6d06103e733776b659fb0191888a8c46014f211e74e7ea14f3e2bfffaaa955
Instruction Fuzzy Hash: D0B17EF0710A029FDB25CF39C44466ABBFAAF45700F554969E466EB2D0DB34E880CB5A

Function 07096D48 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ab9426088052cbf616dce79130a00cd5a89de57773c97cd2be9f8956d093d9
Instruction ID: 7c389a89995c668d85b3417c40c42c4ddb4d2b1eea5dbd229ea010888d185ec1
Opcode Fuzzy Hash: 12ab9426088052cbf616dce79130a00cd5a89de57773c97cd2be9f8956d093d9
Instruction Fuzzy Hash: D3B13675710605CFCB14DF39C898AAABBF2BF89304B1581A9E446DB3A2DB35EC01CB51

Function 0713AC58 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b5b90e31beddeddd8e0f41d894f9a04b5d4e40127fd006e006b4ef9058b941
Instruction ID: 87721c59fa009b80708ae3ff14ab59f7a1f0b61ee9cc718cdb6a010fd23f2139
Opcode Fuzzy Hash: f6b5b90e31beddeddd8e0f41d894f9a04b5d4e40127fd006e006b4ef9058b941
Instruction Fuzzy Hash: 37B14BB1204341CFD722CF29C584B65BBE6EF41315F49C5A9E4898FAE2D779E884CB90

Function 071347F2 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923e031e5dad868eaaf91fe700646df5f801cb42fca7bd4d4f1580962b3ccde6
Instruction ID: 407bf104038d7bd573f43283536f9215328e6a51aabea8fb3915411ec472a0aa
Opcode Fuzzy Hash: 923e031e5dad868eaaf91fe700646df5f801cb42fca7bd4d4f1580962b3ccde6
Instruction Fuzzy Hash: 1AB17DB4B00205DFDB19CFA5D888AAEBBB2FF88310F148169E9169B391DB35D841CB50

Function 07131CD8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d1a3272801069e1db466cdb5a2f2097ad537cc3311ea5a267eee93e86f58e1
Instruction ID: be2d023258755a91da387e2d3fbec7e312779ce9b0217f350eca5982b20deebb
Opcode Fuzzy Hash: 58d1a3272801069e1db466cdb5a2f2097ad537cc3311ea5a267eee93e86f58e1
Instruction Fuzzy Hash: 7381C2B1B006059FCB15EF79C454AAABBF6EF89310B158569E50ADB3A1DF31EC01CB90

Function 055DCB10 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88fb4d0ddcc9a8573229662dae63295c4b369f87d53ac225a816ab17ced3405b
Instruction ID: 3ecd45bf6275417a6b1dda8dfa2a02d8390a2fe7d7edacd0e7c209e20c1f8762
Opcode Fuzzy Hash: 88fb4d0ddcc9a8573229662dae63295c4b369f87d53ac225a816ab17ced3405b
Instruction Fuzzy Hash: A0A15A746002029FC719DF79D88495ABBB2FF893107118A98E44A8F762DB70FD85CF91

Function 070975A0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf145f6133b8d25f29c242f1ad0fdd4533adf471de0a2f12af3ee5017da937c7
Instruction ID: 5aa9b48717588b118d0a3ac4f7d1142996b50c2fb68f9f1ccbd68ce0ee06df24
Opcode Fuzzy Hash: bf145f6133b8d25f29c242f1ad0fdd4533adf471de0a2f12af3ee5017da937c7
Instruction Fuzzy Hash: 028180B6B10216DFCF05DF68C8849AEBBF5EF89210B1581A9E815EB361D730ED41CB90

Function 07091878 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba9b354aa1016d1202fe0141780c9329f8c15faaf259440e8dd9a21ac932c5f
Instruction ID: 2438a4b49dbe11ddf1cab508bc5a47051bbf92faaedd9b81e246c2ec49553447
Opcode Fuzzy Hash: 7ba9b354aa1016d1202fe0141780c9329f8c15faaf259440e8dd9a21ac932c5f
Instruction Fuzzy Hash: BB71E4F1700105AFDB05ABB8D85549C7FA2EF99340F45CB6AE803AF351EE34AE458792

Function 07135040 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec99b8753facd088dc605dcfac714abfd0c0e7587994c26983d0d2264d0e201
Instruction ID: f52589e4cbad53935d6ed9ca15f884cf2bd4588b5236f24fba8b52c59322bc37
Opcode Fuzzy Hash: dec99b8753facd088dc605dcfac714abfd0c0e7587994c26983d0d2264d0e201
Instruction Fuzzy Hash: 4C7181B4A0030ADFCB21CF79C844AAABBF2FF48710F148669E405DB291E734E955CB91

Function 07135050 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b888c4a909b8d2e920e219dadc1b1350d0640e04f5b3cb64ddc4a1a5569af5
Instruction ID: a7d96600a8991100c25cfe535e8800b68786ec58edc5d15cfe54b3836d6475ad
Opcode Fuzzy Hash: a2b888c4a909b8d2e920e219dadc1b1350d0640e04f5b3cb64ddc4a1a5569af5
Instruction Fuzzy Hash: 4E8170B4600306CFCB25DF39C444A6ABBF2FF84614F158A29E806CB291EB74E955CB91

Function 0711D0F8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efcee9479d43400d0dd56bd1c6610f029433d0852dd83af982c1cfe29a36548d
Instruction ID: ce2a7b46faf5f81a953181593aa78efaa19df2cbed1ecc52068e136109c87485
Opcode Fuzzy Hash: efcee9479d43400d0dd56bd1c6610f029433d0852dd83af982c1cfe29a36548d
Instruction Fuzzy Hash: B561B0F0F542149BDB18DBA9E8417BEB7B2BF85300F118036E995AB3C5C7349942CB91

Function 0711D0EA Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955930e4413e37344f5aa66d765add46e20baa8711985eaa9b6492d74a57fab4
Instruction ID: 9cf72c2b7464555ee37b5698a360c6dd067ad7193cfc239bbb5c6674a0d29c46
Opcode Fuzzy Hash: 955930e4413e37344f5aa66d765add46e20baa8711985eaa9b6492d74a57fab4
Instruction Fuzzy Hash: C261B0F0F542549BDB14DFA9E8416BEBBB2BF84300F118036E995AB3C5C7349942CB91

Function 071176FC Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be31343e397bd34e6c851404c6716d264237466d14ec5cfd7b64bc4c7c163682
Instruction ID: 8bcca117b18f9a723d86cf9b5dd0e9f211b44bb8c3fd92f4b0d7269de981337c
Opcode Fuzzy Hash: be31343e397bd34e6c851404c6716d264237466d14ec5cfd7b64bc4c7c163682
Instruction Fuzzy Hash: A95149775487419BE323A774B8110DCFF7AAA96314748C0ABC6945FBD2FB200946C7D9

Function 055DEAE8 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa94d103a6b482ae8db13d06b8d199cffb5412bc00d41a0304539493b20fdbdf
Instruction ID: f5255395ef50d49165d0e3ee296ccffcdfb4317602d390f113edcbb136993386
Opcode Fuzzy Hash: fa94d103a6b482ae8db13d06b8d199cffb5412bc00d41a0304539493b20fdbdf
Instruction Fuzzy Hash: 4A619B716002099FC714DB6DC880AAEFBB6FF88310B14CA58E4199B241DB71FD468BA1

Function 070963F6 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34add26e4eb9897fcddcc35e545b708764d4cf05581b3679ba2e5790a60e8696
Instruction ID: f5aed65d21b5c9103c19799889bbc7af16eb682fe10f6a755693135d0a638797
Opcode Fuzzy Hash: 34add26e4eb9897fcddcc35e545b708764d4cf05581b3679ba2e5790a60e8696
Instruction Fuzzy Hash: F1515FB0B002169FCF54DF69C454AAEBBF6AF88600F158279E905EB354EB71DC41CB90

Function 07134E60 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83637c81191adb40f5c2ca0e798dfe65f98e98a48609088de320b428915ca81
Instruction ID: 791e0be2b4232e0110b47af44632378968c3a10571289c86d34d1d28c8ac6360
Opcode Fuzzy Hash: e83637c81191adb40f5c2ca0e798dfe65f98e98a48609088de320b428915ca81
Instruction Fuzzy Hash: 9661E4B4A002598FDB54CFA9C480A9EBBF6FF88310F14416AE919EB354E731D851CFA0

Function 071332E8 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a94ee25ef9ba700f9ff19641da8af5025ee47ed5383a1b75d71434944653dfa
Instruction ID: 884b8e8b612ddda4b7eb60793fdc7cc596a6964977fb7f6f457d3c69e33d459c
Opcode Fuzzy Hash: 8a94ee25ef9ba700f9ff19641da8af5025ee47ed5383a1b75d71434944653dfa
Instruction Fuzzy Hash: 58717EB0A003059FDB16DF69C484A99BBF1FF49300B14CA69E4199F362D771ED85CB91

Function 0711C528 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cff25b76cdecb61bcdb28e463e54baa08e2c994ad0197dcef9ef5529a436403
Instruction ID: c0330db0960e31c2978c364c44ecd3549816bc45a383ed5d46db250e3a528ab1
Opcode Fuzzy Hash: 5cff25b76cdecb61bcdb28e463e54baa08e2c994ad0197dcef9ef5529a436403
Instruction Fuzzy Hash: E151ABB5E84226EFDB058FA8D845ABDB7B2EF49704F018076E811AB2D1C7749941CBA0

Function 0711938B Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d991f2c9241aaecd2be46c991da3bebc5d792c3e1586e444211073306b75c3
Instruction ID: 4586019b3697f97097ccdead5582a5ee35e6a261e28cade335c1082d28d2bdc9
Opcode Fuzzy Hash: 84d991f2c9241aaecd2be46c991da3bebc5d792c3e1586e444211073306b75c3
Instruction Fuzzy Hash: 5A512170A04104AFD704AF78D4557ADBBB2FF88300F0488A9D991AF2D6DF35AE89C781

Function 07110EE9 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c913d96c62d8254f1af27541467ee9f2bf664d6634c5edb4cfff1aa608f48f
Instruction ID: 118760c394994918a7494fb3041e2ff2c3ca8793c67cc9846fc91681bf60dc9d
Opcode Fuzzy Hash: c6c913d96c62d8254f1af27541467ee9f2bf664d6634c5edb4cfff1aa608f48f
Instruction Fuzzy Hash: 5D516AB0A00345AFDB05DFA9C844AAEBBF3FF89310F24856AE5059B391DB749C41CB50

Function 07119398 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7035ede9ee7d0f0705959abd744165cb4a8ceb66065b088cbc439751ebca887
Instruction ID: e2e56ec5d821d15ab55bf298000f42f014c7c64f64fe34ebb42e38c401bc8d44
Opcode Fuzzy Hash: d7035ede9ee7d0f0705959abd744165cb4a8ceb66065b088cbc439751ebca887
Instruction Fuzzy Hash: A451E070B04118AFDB14BBB8D4557ADBBB2BF88300F1484A9D981AF395DE356E85C781

Function 07115288 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae534dc444758fcc47b6cb5d15b5e29b0ee0208956a5b312c9d2f3550796a84
Instruction ID: d81981ed317291f46ca8e4775cd2b2f6812f72236d673874ed1e8fcea51fec83
Opcode Fuzzy Hash: bae534dc444758fcc47b6cb5d15b5e29b0ee0208956a5b312c9d2f3550796a84
Instruction Fuzzy Hash: F5515DB0A00209DFDB14DF68D954A9E7BB6EF88304F248579E406EB3A1DF749C45CB91

Function 07134E5A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907c3daabd3acceb896f54349c391cdc1ab5f18975ae46bf515a6d37b2b26eec
Instruction ID: bb524c740c498fd4246e7ff5b534311824ff399289678832da201e7b7b0dfd7a
Opcode Fuzzy Hash: 907c3daabd3acceb896f54349c391cdc1ab5f18975ae46bf515a6d37b2b26eec
Instruction Fuzzy Hash: 6551F5B4A002599FCB54DFA9C88099EBBF6FF88310F15456AE919EB354E731D841CFA0

Function 07110EF8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c50985902f086ff920627aaa5cd0542d5be7941d0a80eaaa6ea4b4e346c759
Instruction ID: 85dffd2da896ef911d3160e63f34cf9d6906acad4098c5dd7aa012c6c55b097b
Opcode Fuzzy Hash: 99c50985902f086ff920627aaa5cd0542d5be7941d0a80eaaa6ea4b4e346c759
Instruction Fuzzy Hash: 31515DB0A00205AFDB05DFA9D844AAEBBF3FFC9310F248569E5099B395DB75AC41CB50

Function 055D6268 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceda987ef3cff4383d852bc5163240bde4c66dcc600bdba33e992c325c9def99
Instruction ID: e868669c6ed0a130cff5fb553252a26c16a5fc3635734e28aa33a4ca0b7c9802
Opcode Fuzzy Hash: ceda987ef3cff4383d852bc5163240bde4c66dcc600bdba33e992c325c9def99
Instruction Fuzzy Hash: 5951FB35A006198FCB10EFA8C8948ADF7B1FF89310B148669D916E7355EB34E986CB90

Function 071385B0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59a9c543a79d5543b6380549c052d5ea4530fecd9cd8eca43614b5ae05c9a7
Instruction ID: ce15c5b85d86a79a9349b23dc781dd56bee51ecdcc77b416bff6cca6ba9f3294
Opcode Fuzzy Hash: ef59a9c543a79d5543b6380549c052d5ea4530fecd9cd8eca43614b5ae05c9a7
Instruction Fuzzy Hash: 5B41B1F0304686EFD7254B76980062BB7EBAFC6242F154E29F557C66C0DB35E8808B71

Function 071150D8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076b1773cca3b9b252cfeedb6bf346507413262b98e68b342cd5756cf6a40abe
Instruction ID: 4c76ca7337c8d45355d7f87d8ec42751172d24e8a242433410252580489d8e4b
Opcode Fuzzy Hash: 076b1773cca3b9b252cfeedb6bf346507413262b98e68b342cd5756cf6a40abe
Instruction Fuzzy Hash: 205150B5A04256DFCF12CF68C884AAABBF2FF85320F1585A5E855DB2D1C730E954CB50

Function 0713A0B9 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea2e83ba5dcac5ffc9bc1dd403ee58264d6cd2477c09a72c53254a3953f2008
Instruction ID: 56c009526e9141938f4d80dd230318a470477a66204d6573ad6a11742568b86a
Opcode Fuzzy Hash: bea2e83ba5dcac5ffc9bc1dd403ee58264d6cd2477c09a72c53254a3953f2008
Instruction Fuzzy Hash: AF51F5B4A006458FDB15CFA9C884A9DFFF2BF48300F05865AE889AB7A1D775A945CF40

Function 07114AE8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e44cb6e8be9b0424a9cd7c778722b1df333dbd4a548a1aa53fe3fbe33d4295
Instruction ID: de88992f64166be91a4df00b4b218f52eddadef59ae23190e822a4cbab92b710
Opcode Fuzzy Hash: 07e44cb6e8be9b0424a9cd7c778722b1df333dbd4a548a1aa53fe3fbe33d4295
Instruction Fuzzy Hash: AB41A276600249AFCB12DF98E844CEFBFBAEF88321B108466F915D7251DB31D911DBA0

Function 071394F0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0032107307dab8ef9f0437d3ac1e0295e8fd0b267d120b1b384503d7a852b24
Instruction ID: bff627ed095eb19da6267b44efa24559c0aa51dc8dc8ac3a572e831ad338206d
Opcode Fuzzy Hash: d0032107307dab8ef9f0437d3ac1e0295e8fd0b267d120b1b384503d7a852b24
Instruction Fuzzy Hash: C6518C76A00209AFDB41DFA9D844ADEFBF6FF88320F14816AE905D7241D731A995CF90

Function 0709C810 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4832566b83c7237ab6a10841a404123ade20dcaa7903578719aa4d7e0491b443
Instruction ID: beb263b182094ef82fd4bb3fa74c85675ec1d650e8fe74fe1c48932311deadec
Opcode Fuzzy Hash: 4832566b83c7237ab6a10841a404123ade20dcaa7903578719aa4d7e0491b443
Instruction Fuzzy Hash: 954162B0A102099FDB15DF69D89199EBBF2FF88300F148629E416AB350EF74AD01DB90

Function 07136698 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceee7a76aceb2ced4fca2fd31a826af04f5ecd98d21353ce3a59ce2f7221096a
Instruction ID: 840ac0b6123683e15985b79aacce88b31ce4cee334da178643fe02a8ad0b7308
Opcode Fuzzy Hash: ceee7a76aceb2ced4fca2fd31a826af04f5ecd98d21353ce3a59ce2f7221096a
Instruction Fuzzy Hash: 8B41E3B4A04285EFDB06DF68C440EAEBBF2EF46301F5589A6E015DB391D734E885CB91

Function 055D6258 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160e1222e42e08a5ae482747c249959d2b684bc3628ef6376e3eeccbd952f5e7
Instruction ID: 63f72ca6b3ecc6f9aaa863bcb134aa7d09820b9201b3975af2415dac6a306834
Opcode Fuzzy Hash: 160e1222e42e08a5ae482747c249959d2b684bc3628ef6376e3eeccbd952f5e7
Instruction Fuzzy Hash: 53411B35A006198FCB10DFA8C8948ADF7B1FF89310B148669D856EB315EB34ED86CB90

Function 0713B458 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3351516cbabf13e8bd40e0f02248ddf1324b95cd480fca5c555084c35146e6ed
Instruction ID: ca89c8367c31b50036e378e065ef0e6c33d178e169db6f81c51fece6cfde3a0a
Opcode Fuzzy Hash: 3351516cbabf13e8bd40e0f02248ddf1324b95cd480fca5c555084c35146e6ed
Instruction Fuzzy Hash: 544190F16087459FEB318A25C188726BBF2BF85315F048A5ED48787AD1E774E8C8CB61

Function 07090438 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679ce0d5111d72ea859e703e7200c10d7797eacf25bfaeac8dc5fcf29e104e8b
Instruction ID: a40099de17afdf6a47c0279e8ee3166084cd7ed2d0dd3b35d46e98dbabad51b3
Opcode Fuzzy Hash: 679ce0d5111d72ea859e703e7200c10d7797eacf25bfaeac8dc5fcf29e104e8b
Instruction Fuzzy Hash: CE4170742006019FD329EB79D85962EBBA2EFC8304F448A2CE4468B791DF75AD46CF81

Function 0711836F Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe88b4ef83cfa02abc6a5ee474216f8c428ab62187bbd18f7f5dfddc9723447
Instruction ID: d280728e81fb7d30a47952ca83f97912aedc07917976829382595d442df6eaa7
Opcode Fuzzy Hash: afe88b4ef83cfa02abc6a5ee474216f8c428ab62187bbd18f7f5dfddc9723447
Instruction Fuzzy Hash: 834190B1D05258DFCB06DFA9D8505EEBFB2FF89310F1480AAE444AB362D7345946CB91

Function 07117733 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4afa69771ccc9f41a7b0aa613e3aae2fcb3d832f1f7efbbcadfbe7219a86491
Instruction ID: a5231e0a5d24e6cde2f6a2704284abb1fd6f9b4db9581053d2bac6e01189491e
Opcode Fuzzy Hash: d4afa69771ccc9f41a7b0aa613e3aae2fcb3d832f1f7efbbcadfbe7219a86491
Instruction Fuzzy Hash: D9310763548B4696F333577078110C9FB7AADE6324358D09BCB915EBD2F6104686CBCD

Function 0709AE24 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffc6146baf9df18d72dd52902cebfa15134e6650ac6dcbb84d531422e43d61d
Instruction ID: cdad9d0b9f1589db31b69eec142e7a8143a1063abd86e89b05c37b11b111c7bd
Opcode Fuzzy Hash: 8ffc6146baf9df18d72dd52902cebfa15134e6650ac6dcbb84d531422e43d61d
Instruction Fuzzy Hash: DC415EB5B00214CFDB18EB68D89466EBBF3AFC8310F244169E8169B395DF31AD42DB51

Function 07090448 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0de88dee69e85224267d8d1f18116e25d48c497a81745e939380cbfc53638f
Instruction ID: d7af27adf44771d408f9c4c638e7a600436d8dfe499a1660fbf08006fa764314
Opcode Fuzzy Hash: 9c0de88dee69e85224267d8d1f18116e25d48c497a81745e939380cbfc53638f
Instruction Fuzzy Hash: 3A4163743006019FD329EB79D95962EBBE2EFC8304B408A2CE4468B791DF75AD46CF91

Function 055D8911 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a565638f8e1437c78b3a8808fa35fdc9f6737a294172addfe8ea0312c5a4f517
Instruction ID: 1be6cc0789ebe5271b9c72927576b8560b179c31a8cafd6293aa377f72e46fae
Opcode Fuzzy Hash: a565638f8e1437c78b3a8808fa35fdc9f6737a294172addfe8ea0312c5a4f517
Instruction Fuzzy Hash: 06412E72B012448FCB28DF6DC558AADBBF2BF88311F148069E405AB365DB759C81CB60

Function 055DF31A Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a526b27d3aaca80a9e3bf422aa908a674f5b3694438ecb1ae12fe73165a22f46
Instruction ID: 6c95816c61f5646b4f813c51006ab90f4deeb54274a23f02caf60bdf373f8709
Opcode Fuzzy Hash: a526b27d3aaca80a9e3bf422aa908a674f5b3694438ecb1ae12fe73165a22f46
Instruction Fuzzy Hash: B1415EB02007006FD329EB7AD841B5A7BA2EF85354F50CF1CE1468FA52EB75B9488B95

Function 055DF320 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f061becdc0bf9b449e60e60c3b61f34cce8370397fd3597555d26be78848e9
Instruction ID: dd690f85248e6f9a6e0d68e8577c25c3e584e0945210808376e98b6b1cb7aaca
Opcode Fuzzy Hash: 72f061becdc0bf9b449e60e60c3b61f34cce8370397fd3597555d26be78848e9
Instruction Fuzzy Hash: 67415EB02007006FD329EB7AD841B5A7BE2EF85354F50CF1CE1468FA52EB75B9488B95

Function 07097660 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0669f81ddbd35fe76d8a18a9a0d91b89fa456ec83a94ea34a20f81a3b4635735
Instruction ID: 9996af9a63c03902ec3afcba28c78dc34d732f956aa617fb8e8f5f6a0acc09e0
Opcode Fuzzy Hash: 0669f81ddbd35fe76d8a18a9a0d91b89fa456ec83a94ea34a20f81a3b4635735
Instruction Fuzzy Hash: 56414CB9720106DFCF54DF68C58896EBBF5EF89250B1581A9E805DB361DB30EC41CBA0

Function 07139A27 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902bf5d13582d792b43e09a2e9bea3ab7a90b3c10be1f683cd693f3fd6b9e7c3
Instruction ID: 65d8147ff97744c605024570bafff755ef99758bdf3f1064ed0ffa0b49ea0ab0
Opcode Fuzzy Hash: 902bf5d13582d792b43e09a2e9bea3ab7a90b3c10be1f683cd693f3fd6b9e7c3
Instruction Fuzzy Hash: 764120B02007065FD725EF3AD84165E7FE2EF84314F048E2DE4868FA95EA74B9458B92

Function 055D8354 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf7e359171d62201bfd7faae0779358db38e59adee804fd2276feaa3b0ffc85
Instruction ID: 8184fdee9cd11700ad3de73a341467388deb871fb21d0a9af5015122e2969d8c
Opcode Fuzzy Hash: dcf7e359171d62201bfd7faae0779358db38e59adee804fd2276feaa3b0ffc85
Instruction Fuzzy Hash: C431C472F01116CFDB25AB2DC94857EFEB6FF80340B1548A9D4866B2A5D630D821CAE5

Function 07097A18 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae51600acaec2342238e68454ff7d46e4e29c806d676c8b02f67aa17de3cb12
Instruction ID: fddb1759fa606ee3fbafae16b123ed22b5bdc0d2706a72e41459c045273c4334
Opcode Fuzzy Hash: 7ae51600acaec2342238e68454ff7d46e4e29c806d676c8b02f67aa17de3cb12
Instruction Fuzzy Hash: 98317AB9B01645AFCB05DF38D89496A7BF2FF89340B008668E906CB356DB75ED01CB91

Function 07139A38 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef99dfcb33b7981c3f9c87458cd75392ca0cb6b1fd9cbc5e789162940d619cae
Instruction ID: 3c92bd9ac0c6fd4fc0a707558bc9519e961ec01a7d6e685f50a3b6953c983c29
Opcode Fuzzy Hash: ef99dfcb33b7981c3f9c87458cd75392ca0cb6b1fd9cbc5e789162940d619cae
Instruction Fuzzy Hash: 943112702007065BD725EF3AD84175E7BE2EFC4314F148F2CE4464FA95EA74B9458B91

Function 0709B56E Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95c53a751f284b827ff07cd431e9ef1ee255236440c7b1bd96b6bacdc0b2827
Instruction ID: e21cb0d651a7c7b43c01de106b32e7a4501af71b2b43bffcec4c7d73536a8294
Opcode Fuzzy Hash: e95c53a751f284b827ff07cd431e9ef1ee255236440c7b1bd96b6bacdc0b2827
Instruction Fuzzy Hash: 4A3181B5B00209AFDF05DF98E885ABEBBB7EF88310F248159E5059B2A1CB319D11DB51

Function 0711C138 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4be975c6a0377d4f5853112693e379b2f0bfc89fd37b1f80f3c9d9d54869db
Instruction ID: edd52c4163e45daba8e776263b18148e74d3a0a33fa4b8432904eaa7d2b1ccdf
Opcode Fuzzy Hash: fe4be975c6a0377d4f5853112693e379b2f0bfc89fd37b1f80f3c9d9d54869db
Instruction Fuzzy Hash: 22315AB1900209DFDF14DFA9D884ADEBFF5EB48320F14842AE809EB250D774A944CFA1

Function 071195CE Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b095e5fa29fa6ac4bb17f956b9654d3914af3df4a76a272a304698146ef2ec
Instruction ID: 660c9f7ecde3073aa97e05dcb26f33febb090856a26400ab4d6c1463eff8522a
Opcode Fuzzy Hash: f9b095e5fa29fa6ac4bb17f956b9654d3914af3df4a76a272a304698146ef2ec
Instruction Fuzzy Hash: FC31C27161E3D48FC7065F78A8286697FB2EF86211B0884A7E453CF296DB389C41CB75

Function 0709B578 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd93696c4c06bb9dd24c564fda67a7d087ebb7c7c4a214f9d3bbec34a05c065
Instruction ID: c47ddfb5b24d1ff2a184076ce9599a6aa1a661e29a6d1b254972b839be3994a1
Opcode Fuzzy Hash: 5cd93696c4c06bb9dd24c564fda67a7d087ebb7c7c4a214f9d3bbec34a05c065
Instruction Fuzzy Hash: 68318AB5B002459FDB05DF68D848AAEBFB7EF88210F14855AF505DB2A1CB309D01DB91

Function 07097A28 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b99dd18d67380e9f7650d0e73f6a6848ddecf6b0aa5c141f30bdb704ba95af7
Instruction ID: 871d7b418d780a5189f03557873dfd5d32df1086f90d4be2d150d984dd5cd9e9
Opcode Fuzzy Hash: 0b99dd18d67380e9f7650d0e73f6a6848ddecf6b0aa5c141f30bdb704ba95af7
Instruction Fuzzy Hash: 563157B9B01605AFCB05DF39D88496A7BF2BF89340B108568E906CB351DB75ED01CB90

Function 07133511 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f97e3091d1a89c0f22ce111b75c865d155424ce4f5d1c7d88120db8590006ab
Instruction ID: 22ed4459a45e4f937fb30056aa4f90b5bc5c61a774b122efb6477bb06c4255ff
Opcode Fuzzy Hash: 2f97e3091d1a89c0f22ce111b75c865d155424ce4f5d1c7d88120db8590006ab
Instruction Fuzzy Hash: 6031D1B17013409FD715DF39D488E4ABFB2EF85310B1589AAE5468B2A2CB31ED85CB51

Function 07110298 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df76172b9ee57259626480e7781cc2fb74c1736692f647273f2bb9fda002f773
Instruction ID: 10b31ba7e133217c201a3158cbf6f2aaa2f381a857a8272cd440bbd1155117d6
Opcode Fuzzy Hash: df76172b9ee57259626480e7781cc2fb74c1736692f647273f2bb9fda002f773
Instruction Fuzzy Hash: 0A31C4B1F082949FCB099BB8D42509D7FB29F89700F1104ABD50ADF391DB38EC458791

Function 071183D0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcd1ba706cfdc5fb1e5c9b1046730b02d7f5cce2e35976de016c02502607755
Instruction ID: 37cc8d1de70305a03727cc37286d5463f7667017805e8c145ee6a9cdd637514b
Opcode Fuzzy Hash: 7fcd1ba706cfdc5fb1e5c9b1046730b02d7f5cce2e35976de016c02502607755
Instruction Fuzzy Hash: 7541F675E01259DFCB05DFA9D844AEEBBB2FF88300F14806AE804AB361DB315942CF91

Function 055D8618 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4434fa9b96b7fdce650c6006aa95b4038d9e4accfb3b186b9f53363ac649f5de
Instruction ID: de4704568124e670058b97703ba6dd944517816183d89f6c70cf0f30b286bfd2
Opcode Fuzzy Hash: 4434fa9b96b7fdce650c6006aa95b4038d9e4accfb3b186b9f53363ac649f5de
Instruction Fuzzy Hash: 9D318475601209AFDB24DF69D854BAEBBF6FF88300F108929E406E7251DB75DD41CB60

Function 0711E65C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bcb8090e124ab657f5be2389ded94cfc0a4a559ec401f4c673d18d0f1e0efa9
Instruction ID: c77c663d901f9f5bb6d333c3ee4b8df169be6649c614c0d0645198521185151a
Opcode Fuzzy Hash: 8bcb8090e124ab657f5be2389ded94cfc0a4a559ec401f4c673d18d0f1e0efa9
Instruction Fuzzy Hash: C531CFB1918161CBD3048BECC8156B9B7B1FB41B16F4981BAEC51CF6E1E339D85AC312

Function 0709E8A2 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bab608c692c2a2e3a33072b0bc998c632c09a91ef030f0d49bf4ae73c029707
Instruction ID: 9352354f903bb47524a64ac9de918352b84ede8977246e88b3c406394d80d3ff
Opcode Fuzzy Hash: 8bab608c692c2a2e3a33072b0bc998c632c09a91ef030f0d49bf4ae73c029707
Instruction Fuzzy Hash: B7318EB5B002568FCB58DB39C8808AEBBF2BF896507158679E405DB364EA30DC01DB91

Function 0709F792 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36859a35af8b6bfb55a30fa74485af057926de3d6c98d553153d3046f67d3577
Instruction ID: 6abb92b731a22477f71401d2f0dd85bb19959169f30932647bcd1ab2e8476eec
Opcode Fuzzy Hash: 36859a35af8b6bfb55a30fa74485af057926de3d6c98d553153d3046f67d3577
Instruction Fuzzy Hash: 2131DFB5B006118FC711CB69E844A6FFBF6EF88210B10862AE556D7390DF34EC02CB90

Function 071183E0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25891ce36e9988fc964fd415cc4c8d176e98fa18bac56a73fcd202eeaeef5ecd
Instruction ID: 18b8f7836a66c675794cad584f40906d614e3fcc6e2b47f39055ffe1d487870c
Opcode Fuzzy Hash: 25891ce36e9988fc964fd415cc4c8d176e98fa18bac56a73fcd202eeaeef5ecd
Instruction Fuzzy Hash: C831B475E01219DFCB05DFA9D844AEEBBB2FF88300F148029E904AB365DB359942DF91

Function 055DF8C0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193147fc7155c5d2339ca136ccbccfceee3fd20fb819a4ce25fe1115f876357c
Instruction ID: 066092da1c5069dd4f7f268c7104be052706ccab2b1f3b15b1f6d2f36800fb47
Opcode Fuzzy Hash: 193147fc7155c5d2339ca136ccbccfceee3fd20fb819a4ce25fe1115f876357c
Instruction Fuzzy Hash: 9A218D743002053BE318A77AAC5273E7EA3EFC4350F098E28F9028F684DD79AD469391

Function 055D6B30 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a5c1a16a09ea404d1420e5d6e51f0c8142f2e741514f500d77fa5bd25cb907
Instruction ID: 583f1cefe1367cd3f957f2a9c1785c987be5efb5c305b49e0804754c479a738a
Opcode Fuzzy Hash: 15a5c1a16a09ea404d1420e5d6e51f0c8142f2e741514f500d77fa5bd25cb907
Instruction Fuzzy Hash: EA314171A10619DFCB14EFA9E84899DFBB6FF88310F10852AE415AB270DB709845CF91

Function 07131CC8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5c29a8e949e873e05db4dd9ca1bc5336de29464a0a2866aca39aea9a7040d7
Instruction ID: 344b3ad8d4d68d7184c7dc5bd838160f125ae1fa5a6ca98f00600c85bc0a1d7b
Opcode Fuzzy Hash: 7b5c29a8e949e873e05db4dd9ca1bc5336de29464a0a2866aca39aea9a7040d7
Instruction Fuzzy Hash: EC21B375710A048FC718DB39E8449AA7BE6EFC975531584A9E91ACB3B0DF70EC01CB90

Function 07119608 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d48509a06de5be4d870dcc87ab5feb14c3b5c4f04f0b7cfb4f260c4951bc31f
Instruction ID: fcc983557a2030c006cbee054f98e6721b34b19812d26e959b4ba052b090b5c1
Opcode Fuzzy Hash: 3d48509a06de5be4d870dcc87ab5feb14c3b5c4f04f0b7cfb4f260c4951bc31f
Instruction Fuzzy Hash: 9A217EB5A15254CFC7045F78E82C62E7BE2FF89201B188576E813CB285DB389C41CBA5

Function 055D6550 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2018d5dea5fd323d64236f9c94bd82353e24b1d3250460536ce2dcffe5fb77
Instruction ID: f83663fb20ae5775525e496a32ec129f1725f7125563212e8e85c7cdd6e72210
Opcode Fuzzy Hash: 5f2018d5dea5fd323d64236f9c94bd82353e24b1d3250460536ce2dcffe5fb77
Instruction Fuzzy Hash: A5313431A106099FCF04EFA8D854CEDFBB5FF89300F018659E5456B225FB70A98ACB91

Function 07139828 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc0cf354bc33a4f3d9a69a11a3555acbb335ebd841808eb23c705a7c8ee1af8
Instruction ID: 0f58776682c0705ddafc47037e550d88c0463cec1d9548f1c540c1e55ececb5e
Opcode Fuzzy Hash: 7bc0cf354bc33a4f3d9a69a11a3555acbb335ebd841808eb23c705a7c8ee1af8
Instruction Fuzzy Hash: 2A2180B07002199FDB049F68D8596BE7BE6FF88340F018528F952D73C1DB79AD008BA5

Function 055D6470 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872855e821ddd016a78bacb834d22897546a196af4ca0719482ca7d48eb86157
Instruction ID: 43276190821c35df9282cc09fa632f6e6d7899c1cdcafb93fd26359502bca145
Opcode Fuzzy Hash: 872855e821ddd016a78bacb834d22897546a196af4ca0719482ca7d48eb86157
Instruction Fuzzy Hash: F0314A36E106098FCB00EFACD8449AEBBF5FF89300F50816AD116E7314EB30A946CB91

Function 0713FE1F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77a617c231083ae0a5c95d4705f5ce8c002ba92653c38c0a16893a6a9937f64
Instruction ID: a30cbe937c4057de70a6ce66350c05a23997282e6ad17a9a676c9175c429a1ed
Opcode Fuzzy Hash: b77a617c231083ae0a5c95d4705f5ce8c002ba92653c38c0a16893a6a9937f64
Instruction Fuzzy Hash: AA21D1756093809FC702DF28D89489A7FF1EF4A320B1641DAE444CF2A3D7359D46CBA1

Function 0713ABC7 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1d78912c4c474f3b6709fd23e6c6b7fad9bfb90bfb29b5b841dee487ec86ad
Instruction ID: a72fa3ec6430fef5856dbb04f955f1678a1d6ff6c2724369c53ca0387562fce2
Opcode Fuzzy Hash: 8b1d78912c4c474f3b6709fd23e6c6b7fad9bfb90bfb29b5b841dee487ec86ad
Instruction Fuzzy Hash: 85216DA281E3E15FD7139B3998601D27FE49F47214F0A46DBD499CF1D3E518980CC7AA

Function 055D6560 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c024de0190307db9ff52610fd69e13d00e1afaa554df0b721e90391264ca74
Instruction ID: b5934b59301af41e2ab5c23a5f02cb8902d9342412193343a1c9346b09d1b44c
Opcode Fuzzy Hash: 48c024de0190307db9ff52610fd69e13d00e1afaa554df0b721e90391264ca74
Instruction Fuzzy Hash: 87312F35A10609DFCB04EFA8D894CEDFBB5FF89310F018659E5056B225FB70A989CB91

Function 00F4D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697260174.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9297411f8130badc51e580eb89ba1ff1035b7c563c114db5b7801cd1e58da772
Instruction ID: d4d9e0e13f14806ba79e571dc6888645251d67f2966822902708cf43df27a007
Opcode Fuzzy Hash: 9297411f8130badc51e580eb89ba1ff1035b7c563c114db5b7801cd1e58da772
Instruction Fuzzy Hash: 532107B2504244DFDB05DF14D9C0B26BF65FB98324F24C569ED090B266C336E856E7A1

Function 00F4D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697260174.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197d8bcb17fbf7c4d2b3a31b11352846ab190db566be54d34702c5b62233cfe1
Instruction ID: 4a8b95506356c3f38d7f67de6421a73261b807055459cbc380278fb4bf9ff008
Opcode Fuzzy Hash: 197d8bcb17fbf7c4d2b3a31b11352846ab190db566be54d34702c5b62233cfe1
Instruction Fuzzy Hash: 5A213A72904200DFDB05DF14D9C0B16BFA5FB98328F28856DED094B256C736D856DBA2

Function 07139818 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f45b9067f5ade7b663c3c270bc4af4ce71d79854bc93987dc0eef1d7c6ffcce
Instruction ID: 9a0300471b17c0fe6b4dab5b79579eb7eaff5fd6d7a5b25a214e115a013d52c1
Opcode Fuzzy Hash: 5f45b9067f5ade7b663c3c270bc4af4ce71d79854bc93987dc0eef1d7c6ffcce
Instruction Fuzzy Hash: 7921C1B0700219AFCB059F64D8499AE7FF6FF89340B008529F842D7391DB38AD14CBA1

Function 0709FC51 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a48bacde3c4e27cc811468ef1273db58fdea9d4c5e6e3d1a7f43441f9098b3
Instruction ID: 1a39145c613a17635077a0e00ad832f82ec0843d23c41ac96f98f3eceeacc52e
Opcode Fuzzy Hash: 63a48bacde3c4e27cc811468ef1273db58fdea9d4c5e6e3d1a7f43441f9098b3
Instruction Fuzzy Hash: C821ABB5A01616CFCB14CF28CA84A6ABBF0FF49301F15C9B9D805DB2A5C730E841DB61

Function 0711CD90 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d233d069724bedf43bfa2ec1e16931df82a1526d55fbb0eaf2c0886713da83f8
Instruction ID: e2a4689d44e5bd29e4db99ad7c1c6a55818008f6786d2bfe19f2bcf5fc974b9d
Opcode Fuzzy Hash: d233d069724bedf43bfa2ec1e16931df82a1526d55fbb0eaf2c0886713da83f8
Instruction Fuzzy Hash: 0621B8B2545206CFCB01CF68D840ABABBB6EB8A320F06816AE014DB2E0D334C951C7E0

Function 00F5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697464981.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e13439b7fd3007d40b585f4c4114055d2895a66d41f57f0f858fe2be85094a
Instruction ID: 762a8e03edb0af91865809a9d8d5004377baf54de89e17101a53e3f1cdbb2c59
Opcode Fuzzy Hash: 90e13439b7fd3007d40b585f4c4114055d2895a66d41f57f0f858fe2be85094a
Instruction Fuzzy Hash: CA212971905204DFDB25DF14D9C0B26BBA5FB88325F24C56DEE094F251C336D84ADA61

Function 00F5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697464981.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ff34ea235492ba3a4ecada55e4942b07d9816bd2fa6266760284f415e6a0a4
Instruction ID: f0cade79d99d6df0113ea2fd6c700c9d695f45d48c6d3d8fccb2d40f32d39738
Opcode Fuzzy Hash: c4ff34ea235492ba3a4ecada55e4942b07d9816bd2fa6266760284f415e6a0a4
Instruction Fuzzy Hash: 83210771505240DFDB24DF14D5C0B16BBA5FB88325F24C56DDE0A4B29AC33AD80BDA61

Function 07136688 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cee0c1403eb0675aec927c2b85915a3d8a5e2091ebda6477e90346e8165289
Instruction ID: 9058e19c084741874e356bdaceff4fa06e5effe45a972c2f14fd7ff99afddbbf
Opcode Fuzzy Hash: f4cee0c1403eb0675aec927c2b85915a3d8a5e2091ebda6477e90346e8165289
Instruction Fuzzy Hash: CF21AFB0E0525ADFCF06DF69C4805AEFBF1EF89210F24846AD454EB241D3309946CBA1

Function 07135308 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c933972e19e02b5d3c99f31a06134523c25f4ffde0d3a1b0404776c7fc6bbfcc
Instruction ID: a94c23dfb0b9a2110aa0d02ee984e3b48864cc66dacef728fc94e94e82f7d1b8
Opcode Fuzzy Hash: c933972e19e02b5d3c99f31a06134523c25f4ffde0d3a1b0404776c7fc6bbfcc
Instruction Fuzzy Hash: 5D1104F370821A8FE719DA79E8416AAF7E6EBC4330B098237E505C7180D7799421C794

Function 0713BB80 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48ecd2971af743a0d52350ec9de422a0fff1a7fd3a8ad59a1c584e4d8bc4ae0
Instruction ID: c8b81904918eb0424a517ea07e3cdf69a98ae352f5b3018c64f9766429f57a9a
Opcode Fuzzy Hash: a48ecd2971af743a0d52350ec9de422a0fff1a7fd3a8ad59a1c584e4d8bc4ae0
Instruction Fuzzy Hash: 942180717007018FC725CF29C844996BBF6FF88310B46C5AAE54ADB2A1DB38EC45CB90

Function 071368E8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c62ce02bcbf651457668ebf3610b9c2228911fcba4649efbd6fe48b8a8f38f9
Instruction ID: 71e37123f7942becbde8ab820648f947930fa649a7ae17e41cb9f73e04764a4e
Opcode Fuzzy Hash: 4c62ce02bcbf651457668ebf3610b9c2228911fcba4649efbd6fe48b8a8f38f9
Instruction Fuzzy Hash: 6F11A372301611AFDB255F3AF44416DB7EAEFC0266714417AE10AC7290CF3EC842C751

Function 0711E3D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c8dad210ded2374497a671fef159472dddbffc469ede279360d14ea28a1682
Instruction ID: c1f5eb845ff2a1566683d73f0c9ebac0c3f9b32326ba2169be7464709c156259
Opcode Fuzzy Hash: 21c8dad210ded2374497a671fef159472dddbffc469ede279360d14ea28a1682
Instruction Fuzzy Hash: 422102B0754215AFD7284AB98805B6AB653BFC5B12F51C436E802CF6C4CB709C46C791

Function 070987A0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0388ed0558b4c31161c4906fad07ada2fa971e1d29456d1b6e9d0e0ae23148
Instruction ID: ba5fd81d0aaddc616862a287932dafd662ca6a822497d43d660ac774d2183912
Opcode Fuzzy Hash: de0388ed0558b4c31161c4906fad07ada2fa971e1d29456d1b6e9d0e0ae23148
Instruction Fuzzy Hash: 39118E71B101159FCB19DF78D4848AFBBF6EF8961071581B9E805DB361EA34DD038BA1

Function 070987B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918602a5b3ffdc5737474eaa7885169c2940f7cc79a392d7eb8d1f857fe9590a
Instruction ID: 306212eb2e3d7e2a5445d77847115366379bf43b42403fbd96e71543cc446147
Opcode Fuzzy Hash: 918602a5b3ffdc5737474eaa7885169c2940f7cc79a392d7eb8d1f857fe9590a
Instruction Fuzzy Hash: 45216AB6B10115DFCB18EF68D4848AEB7EAEF892107108179E905DB361DB31DC02DBA1

Function 07115B80 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683a039c09764ebba3decc63994c29dca8be012b1af565d77523288d1e7bc7e9
Instruction ID: 929cec7015ae9c877cea2ad44a00229907e10694919a8ec0fe8501afc44ba910
Opcode Fuzzy Hash: 683a039c09764ebba3decc63994c29dca8be012b1af565d77523288d1e7bc7e9
Instruction Fuzzy Hash: 4821ACB5A0021ADFCB15CF65D58499EBFF2FF88210B1086A5D4089B762C730ED55CBA0

Function 07133A33 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bdc56d97730a09cd07a3cae4bb30b5a10ece5ffd4401004068c631bf47a701
Instruction ID: f1f82d3b9ac4440ad1e0899e80fa89276f56f7953a1060d62b149b1b88e5bc18
Opcode Fuzzy Hash: a8bdc56d97730a09cd07a3cae4bb30b5a10ece5ffd4401004068c631bf47a701
Instruction Fuzzy Hash: 3F11D0B2704210AFE715CF68DC55EAA3BA9FB49700F15455AF114CB2D1EB71E9028BA1

Function 07115B90 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696cbb502c4ce1c973046f98b3313cee2d3a57702a30013ef2f56b7faadde2f6
Instruction ID: e873d24f665ef855ac1ce6ad08a68113e6b3bad947ae807d64cbca726f3733ff
Opcode Fuzzy Hash: 696cbb502c4ce1c973046f98b3313cee2d3a57702a30013ef2f56b7faadde2f6
Instruction Fuzzy Hash: DB215CB5A0121ADFCB15CF65D58496EBBF6FF88310B1085A8E808AB761D730ED51CFA1

Function 07137F10 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f2b5a92a480f6a191cc858f09822205a2f2ebeaaac6d707903f9e21ce76e87
Instruction ID: 46b064b7259007573c264cd96d4e018d82c66f5e7400034c8bcb19afede9a454
Opcode Fuzzy Hash: 22f2b5a92a480f6a191cc858f09822205a2f2ebeaaac6d707903f9e21ce76e87
Instruction Fuzzy Hash: 88219F71A00248AFDF15CFE5C890A9EBBB5FF44320F108556E921AF399D735D855CB41

Function 07133520 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989e6ad1f7c1d56db7a2aeeaca1fc77606c5768806c45f2e95230b90fdf2ce72
Instruction ID: fd1c9935c982bb857de4b3d1adec467ff5c1680a6d3de5c2ca069e966aeac9f5
Opcode Fuzzy Hash: 989e6ad1f7c1d56db7a2aeeaca1fc77606c5768806c45f2e95230b90fdf2ce72
Instruction Fuzzy Hash: 36219D71301340AFD325DF39D448E1A7FB6EF89324B1585AAE5868B3A2CB31ED85CB50

Function 07136A38 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc5d2e174e2a40389f788cb5485c5bbe49639881bb2614c9653370611213c43
Instruction ID: 754f3b3542644233d32be3fcee9886a9ba0a1b189f9792291856916a26658456
Opcode Fuzzy Hash: 7dc5d2e174e2a40389f788cb5485c5bbe49639881bb2614c9653370611213c43
Instruction Fuzzy Hash: 8F1129B5704341AFD3268FA6E480913BBA6EF85214B14857EE54A87352CB31EC80C750

Function 0711E3C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aafe36a23f72c8e699aceec707f1d5f091202dede5e39cffcd71bcc4a8c6de7
Instruction ID: a8442bd26777721887710424a542a835d8c679d00a9581e8cab8a7b0ad64ef94
Opcode Fuzzy Hash: 2aafe36a23f72c8e699aceec707f1d5f091202dede5e39cffcd71bcc4a8c6de7
Instruction Fuzzy Hash: AE1100B0744210EFE3254AA4C805BA5B762FFC6B22F95C476E802DFAD5C7709896C792

Function 0709F7A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da241fae13174c4105c1e46eff29405fcd99463596ac3f5e8935b95697e71d4
Instruction ID: 004ef3662d39fc4ba468303d8fe4d4486d006dea6e6cd8425e55393c5c5d2d62
Opcode Fuzzy Hash: 9da241fae13174c4105c1e46eff29405fcd99463596ac3f5e8935b95697e71d4
Instruction Fuzzy Hash: 3411A1F2B006255FD765D66C9850B6BB7DADBC8660F10463AFA09DB390DE30EC0187E0

Function 07098640 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca00e13308203b5eb5b0bb3e6c0b3310e99cc97867334634a8ab1c2be6e3d1d
Instruction ID: dca90b984863f344b1e7b1bff638168959158fbccfc03fa28ab352b517da116e
Opcode Fuzzy Hash: 8ca00e13308203b5eb5b0bb3e6c0b3310e99cc97867334634a8ab1c2be6e3d1d
Instruction Fuzzy Hash: 22116D72B00109CBDF549B69D8686EFBBB5EF89220F144239D516E73A0DFB14C41DBA0

Function 00F5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697464981.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7717da983e8a194808c06900bcb355dd1acd523585618b7052283c923074a
Instruction ID: 4981a9977e3a979465ca3b77e27605da9a1234b92cd067efaaa5883e44d25a1f
Opcode Fuzzy Hash: aca7717da983e8a194808c06900bcb355dd1acd523585618b7052283c923074a
Instruction Fuzzy Hash: AA2192755093C08FDB12CF24D990715BF71EB46314F28C5EAD9498F2A7C33A980ACB62

Function 07116A40 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7f8428086534ca79c78e6c765e13fc8746456587622e064278ea4c58db44b8
Instruction ID: b31ba6ecf1bd22f1749decaac64f0a99ddcca18b27377e39e1f96a27e9cc8c62
Opcode Fuzzy Hash: ba7f8428086534ca79c78e6c765e13fc8746456587622e064278ea4c58db44b8
Instruction Fuzzy Hash: 4F11C2F270012997C615E76EE84092EB796EFC8A00B01CB39B5098F398EF71DC458BD2

Function 0711988E Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be7af8efcb8b8d871739b0c4d45c67510b4bbc6274012136679ff07f05fa1b1
Instruction ID: 15df7cff4320a6da345d1474ab962442cef7e915c613fe3a83aa9ffef33a96be
Opcode Fuzzy Hash: 0be7af8efcb8b8d871739b0c4d45c67510b4bbc6274012136679ff07f05fa1b1
Instruction Fuzzy Hash: 2E21A1F2D1458ACADB208B69C9222BEB3B0FF01319F04853AE0B59E5C1E334F654C656

Function 07116A31 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f601c762a60021b585bff2a42d4c5b9bf4eb374661a084526bbbd0c0d72e795
Instruction ID: 3f3b9e5231d54e1ef368e86dc312802b2a1540d779e796e4817e49fd85ee2ee6
Opcode Fuzzy Hash: 5f601c762a60021b585bff2a42d4c5b9bf4eb374661a084526bbbd0c0d72e795
Instruction Fuzzy Hash: 021106F13002119BC615A769E840AAEB792EFC9700F05CB7AF5058F295DF619C458BD1

Function 07119904 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623a273a5e95e93644ab3236af5a866b917b15c23b3e4e26bc89d50d6110aa5b
Instruction ID: d9d8097acbb9b798a3aac8d18a6491c3d9c1a2d1e43bd4b1ec1676bd518d18e4
Opcode Fuzzy Hash: 623a273a5e95e93644ab3236af5a866b917b15c23b3e4e26bc89d50d6110aa5b
Instruction Fuzzy Hash: 56219FF1C1469AC6DB248B69C9222BEB2B0FF01719F04853AE0B69D5C1D338F694C646

Function 07139010 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c09d8804b0968e0d054a57f048c7ff2194d0339e0e3db79af906c3daa19f82
Instruction ID: c6789c36c1ef6b5f9bb44f732d970e4c68a30f508ebbe6fc00344c867a6d9a00
Opcode Fuzzy Hash: e6c09d8804b0968e0d054a57f048c7ff2194d0339e0e3db79af906c3daa19f82
Instruction Fuzzy Hash: 6B01B5F07182426BE725166FA80477B69DF9FC4648F14413AB51ACB3C0DFEEDC8186A1

Function 0709B451 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf50657c3ae5e3ce5706849fdf6166dd7364b4c9b9fd0346f2e64613a114a3b
Instruction ID: 882092617a2c7a8d47b09508cf849545ae443d0df69f2deeff747d44dd8a436b
Opcode Fuzzy Hash: acf50657c3ae5e3ce5706849fdf6166dd7364b4c9b9fd0346f2e64613a114a3b
Instruction Fuzzy Hash: 9C216DF59012099FCF14DF94E484AEDBBF2EF48320F148228E51167251CBB09941EF90

Function 071160C8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3978af09c18af572ab1214d209f588af0844a46b90686bf63b32f5ca715ada2
Instruction ID: ef6661560349fdb74a7523104520a6d5ef82c5ded669f858528105580e668712
Opcode Fuzzy Hash: d3978af09c18af572ab1214d209f588af0844a46b90686bf63b32f5ca715ada2
Instruction Fuzzy Hash: 8311E9F57183554FCB1A5778981102A3FE65F86540B0641B7D40ACF2C3DF25DC41C7A2

Function 055DF9DA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a09c4ff4ac3608d877f5f109c4dc377f33d67ee2a102cc483bc5ec8b71fdbc6
Instruction ID: 401887c49005c1bb0a2c979f310f02dd8fdf082a57c5eb2d37d57be98d4f7c1f
Opcode Fuzzy Hash: 9a09c4ff4ac3608d877f5f109c4dc377f33d67ee2a102cc483bc5ec8b71fdbc6
Instruction Fuzzy Hash: E011B6763007168FDB249B7DD484A6ABBA6FFC4314B144A2CE54A8B701EB79DC018B95

Function 0713CF40 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38034d451dab6830a9048877ae8859024d0b08830f9c2099fac84cc2563bd289
Instruction ID: 36f62067bfc0b36abde8b0f288b9a88246d41f8e1ad577e6409c295b3ca8521d
Opcode Fuzzy Hash: 38034d451dab6830a9048877ae8859024d0b08830f9c2099fac84cc2563bd289
Instruction Fuzzy Hash: 29119AB0A002028FC761CF69C644BAABBF5EF45350F458566D448DB692D334E905CFA0

Function 07131218 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf9004828d0ed197f97b41c5a0cb16906a291a3975b0a20bc83adec71bdc76c
Instruction ID: f9405734276314f77e806b8e3ecc7d10e0baea991a010e7bf5ce6c30c3988266
Opcode Fuzzy Hash: ddf9004828d0ed197f97b41c5a0cb16906a291a3975b0a20bc83adec71bdc76c
Instruction Fuzzy Hash: 1111C6B1A05649FFC715CB99D850D9EBFB9FF89220B25825AEC08D7341DB319E009B91

Function 07090EC9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0f68147b68a441d1e9c8ea71abb3bb65a095e945cf3d6dcfe648cbcd33f265
Instruction ID: eeb1e0604525859878263b8e03d4f1f79e891421536f52d9e644eb82d25ea794
Opcode Fuzzy Hash: 6a0f68147b68a441d1e9c8ea71abb3bb65a095e945cf3d6dcfe648cbcd33f265
Instruction Fuzzy Hash: 961193B0A0060ACFCF14DF55D8C48AAFBBAFF84310B108665E905D7651E731F910CB60

Function 07098870 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093bfa8213c87eba85ae704437ccbacc9c14b55bc475e9b5bb28311cb8a6a1b3
Instruction ID: a7f94f5f95333909ecb046ebe15fc24b465ecef058a7a5b99aa88d6f91d6bdae
Opcode Fuzzy Hash: 093bfa8213c87eba85ae704437ccbacc9c14b55bc475e9b5bb28311cb8a6a1b3
Instruction Fuzzy Hash: 7C110EB13042008FD720CB69D804F52BBE0EB86320F048A66F259CF6E2D7A0E846E761

Function 055DF9E8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88194f41057983555758fe2dcb1c0b625e7adbda6a3ddeac50a68bcd348bac76
Instruction ID: 727622a9f67e0847beb550f7693a5d70242b5a32498ff83899149c4b130d08f0
Opcode Fuzzy Hash: 88194f41057983555758fe2dcb1c0b625e7adbda6a3ddeac50a68bcd348bac76
Instruction Fuzzy Hash: C811A3B27007168FCB249B6DD484D2AB7B6FFC82147104A2CE50B8B700EB79EC018B95

Function 07133A58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9c12e2cce3131ea4d18270e11745c1621c6a4f49179f7604ba28ae7edb30ac
Instruction ID: 19846ccdd60a6bac28391ba00de2accb8fdfc839105ca99ba3e0b7e59793fd65
Opcode Fuzzy Hash: ee9c12e2cce3131ea4d18270e11745c1621c6a4f49179f7604ba28ae7edb30ac
Instruction Fuzzy Hash: 6A11A5723102046FE714DFA8EC45E6B7BE9FB88720F14452AF504CB280EB71E9018BA1

Function 0709BC00 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d9b5c9f0dde13493433135231828ffce9f05ede2127111d515c6104e6f5a0e
Instruction ID: 630396f64655f5ac5acc3e89c113d641a77b528aaca06bbe388eacd74af1caba
Opcode Fuzzy Hash: 41d9b5c9f0dde13493433135231828ffce9f05ede2127111d515c6104e6f5a0e
Instruction Fuzzy Hash: 6E1191F4B10241AFCB14DB69E844A6EBBF6FB89210F000629E5419B750EBB0AC418BA1

Function 07099311 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18dc6172ea51d13415f6daf2acc9002bf19c31beac2d99987784d5ccc1051787
Instruction ID: 4cc2ee2af591a5e8eff1b925e787ec6246462cc476aa767a98743419a6a63276
Opcode Fuzzy Hash: 18dc6172ea51d13415f6daf2acc9002bf19c31beac2d99987784d5ccc1051787
Instruction Fuzzy Hash: 370192762082D46FCB178E656C61AF63FF89F4E111709029BF9D5D6192C128CA10DB71

Function 07119D84 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e388276cfc536f90d6e0152c43d84c51fbec1c8d2e11c991b260b62b020a33
Instruction ID: 6446ef96a158a16f43fa53030cc4911e41da48878d2883368a76987a877f36bb
Opcode Fuzzy Hash: 35e388276cfc536f90d6e0152c43d84c51fbec1c8d2e11c991b260b62b020a33
Instruction Fuzzy Hash: 622100B58002499FDB10CF9AD884ADEBBF4FB48320F14842AE919B7200C379A944CFA5

Function 00F4D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697260174.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 7c04a27bd8a597a6f5346b65382d057d5041624ab9df1e988f0f9e93cda1584e
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 8D112672804280CFCB06CF10D5C0B16BF72FB94324F24C6A9DD090B666C33AE85ADBA1

Function 00F4D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697260174.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f4d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 3a3a04cd399e80099781b8ca59a51c51fdd7c4618724de73f21ded92a36158e8
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 6911E676904280CFDB16CF14D5C4B16BF71FB94328F28C6A9DD094B256C33AD85ADBA1

Function 07138F59 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8ef8fe603bbc9c16a1ad8f3171eee5baa6deab2dfc3fc422b770a4337fb979
Instruction ID: fcee81ab7fcc20c50e54e0ff6d084fea7cb4205f2a676c415d1ce1fa1c980600
Opcode Fuzzy Hash: 7f8ef8fe603bbc9c16a1ad8f3171eee5baa6deab2dfc3fc422b770a4337fb979
Instruction Fuzzy Hash: 041186715047019FD315EF7AD84094ABFF6FF89350B008A29E4458B665FB70BA44CBD1

Function 055DB517 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117ab4113c2c543436b04315d818790eba93ec837d09daa5a1e6b22bbfba2ca8
Instruction ID: e5a7289632ec267d27e0630b3a1241af09a35480822268e06e8e90067c29985e
Opcode Fuzzy Hash: 117ab4113c2c543436b04315d818790eba93ec837d09daa5a1e6b22bbfba2ca8
Instruction Fuzzy Hash: D41108B22043414FD716DF69E8945C9BFB6FFC62507064A5BD046CF292FA709D0A8BA1

Function 055DECF0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83317cc71330eae74c05796df0c9a57be914740b9004fc25a10740090f6f3a92
Instruction ID: b4e56fe71369774172093aa333d9b2594f25d4416481ebc3104c0f5587ccc1c8
Opcode Fuzzy Hash: 83317cc71330eae74c05796df0c9a57be914740b9004fc25a10740090f6f3a92
Instruction Fuzzy Hash: FB1182702017059BC729DB7DE88495ABFA2EFC93147148E2DE05A4F251EF71AD478B81

Function 0713E168 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f78d98f849c69dec435e6bc74c47da9eee2e256ec32ef0b2b83bef0a000b7b
Instruction ID: a9d0960887056b413b2c9a59b8eb4d87dbd525ae15445fc477452b10ec8fa015
Opcode Fuzzy Hash: 35f78d98f849c69dec435e6bc74c47da9eee2e256ec32ef0b2b83bef0a000b7b
Instruction Fuzzy Hash: 6A118B71B01216AFCF019FA4E9498AEBFF6FB88210B0445AAE505D7251EB349906CBE1

Function 00F5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697464981.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: d72967cfb63b489161fc6c5173ff49f131680facdeef9627622df3d93f2b402a
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: 9711BB75904280DFDB26CF10C9C0B15BBA1FB84324F24C6ADDD494B696C33AD84ACB61

Function 055DED00 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b15c0c08bc206c7803bd930a869a4ffac545873ee3541858bb92b21425c140
Instruction ID: 07aab159d93b8f6b28898bca461c016f0404513344be8f1e043fd4f2035d88a9
Opcode Fuzzy Hash: 54b15c0c08bc206c7803bd930a869a4ffac545873ee3541858bb92b21425c140
Instruction Fuzzy Hash: 171173702017019BC729DB3ED88485ABFA2EFC9314314CE2DE45A4F251EF71AD4A8B81

Function 0713B71B Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7d14a46514c8dac1cb34fd9f5fd0af5a7591b654d5889d4d5eb1b27524b1d3
Instruction ID: 074f2e753085867c7571213d7b4a2a6ebb4c7db4901ea7891b7664ec6122cbbc
Opcode Fuzzy Hash: de7d14a46514c8dac1cb34fd9f5fd0af5a7591b654d5889d4d5eb1b27524b1d3
Instruction Fuzzy Hash: DA01D6F570D781CFD7368A98D081766BBB1EF45211F1885AEC405873C1E775D84ACB40

Function 0713FE60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8dc81e4261bdc129a260eddefe1be2f653083c8a0c9f4cb623687a26ebd6b6
Instruction ID: 6659ddfcf343a8d5f91370a9c302e26cb048bed6cde9c4975a346678a70d0b46
Opcode Fuzzy Hash: cf8dc81e4261bdc129a260eddefe1be2f653083c8a0c9f4cb623687a26ebd6b6
Instruction Fuzzy Hash: AD119E756002059FC704DF69D884D9EBBF6FF88324B108599E8098B362DB71ED02CB90

Function 07133AE8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b352f88e547cfe843f29fbdc714bd08e8a1f24b36ef4008589070d061c7f06d8
Instruction ID: 5955de93e25f045d0ebcc1a93858e4651662105358ec129dfdd9b4b28693d4df
Opcode Fuzzy Hash: b352f88e547cfe843f29fbdc714bd08e8a1f24b36ef4008589070d061c7f06d8
Instruction Fuzzy Hash: B4115E712047058FC721DF2AD88098ABBF5EF893107108B29E45A8B661EB71FD49CBA1

Function 0713E178 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75cf38d33c8357234330c1968b09145364601e4c3ca1ca78a4c1adedd103d15
Instruction ID: 056ac87443e98adb36403173e751c8d30838611fc4a55b3d12b576b93d47e06a
Opcode Fuzzy Hash: a75cf38d33c8357234330c1968b09145364601e4c3ca1ca78a4c1adedd103d15
Instruction Fuzzy Hash: 28115E757002199FCF04DFA5E9498AEBFF6FB88210B104569E905D7250EB349901CBD1

Function 070985B8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f4ebb2008aaa70fa74d6b8ea21baae69f12d7c6a79ccddcaffdf85893bfcb3
Instruction ID: a24868db5977f78fa8e41ffe07350829b5e7466a4ac7c050d433e42edb9ce4d2
Opcode Fuzzy Hash: 20f4ebb2008aaa70fa74d6b8ea21baae69f12d7c6a79ccddcaffdf85893bfcb3
Instruction Fuzzy Hash: 41011B757101059FCB44DF2ED84895ABBFAEF89210715856AE505CB362DB71EC41CB50

Function 0709F837 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff68cbd34b886fdb1863ef1c4e4fa3310f86241df6f961d4eb5769321756d74
Instruction ID: a2c8add271449d777433b86240d1c969044659547f41121b1c32ade81ee271a0
Opcode Fuzzy Hash: dff68cbd34b886fdb1863ef1c4e4fa3310f86241df6f961d4eb5769321756d74
Instruction Fuzzy Hash: 1D0149F27056626FC7165368B8506AABBD5CFC9750B144777E640CB344DE20DC0287D1

Function 070985B6 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d262cef890db10baa2038166a8696603a80e860928c8ad6e595b5ec0b65a7519
Instruction ID: f7db89f597b3e17734e6bf90bee06144c6365e42c5e12aca56ecb27ff2c12cd0
Opcode Fuzzy Hash: d262cef890db10baa2038166a8696603a80e860928c8ad6e595b5ec0b65a7519
Instruction Fuzzy Hash: B00129753001059FC744DF2ED88895ABBF9FF8932071585AAE505CB362DB71EC41CB50

Function 0711E1B8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d29db9b51e1a10be54937aed2616c7834f6cb03c9e3a18ddbb05949b7bbe479
Instruction ID: 61010e3c4a92d2c017b9bfac9e5c4bda527e6b8ffe87227c8a9883e952f604b2
Opcode Fuzzy Hash: 3d29db9b51e1a10be54937aed2616c7834f6cb03c9e3a18ddbb05949b7bbe479
Instruction Fuzzy Hash: 7001D2B26051199FC30147E5C4197A57BA2AF45309F18C4FAE818CF1C1DB3AC8468B52

Function 0709A310 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac4200f34a465d3b6f14940618b7b80b148318e2117466a61bb2cbaab745cdc
Instruction ID: 32f7e7803ada52bf7da1875bc83ba81ef3753ce32590d856c8901b243bc4213f
Opcode Fuzzy Hash: dac4200f34a465d3b6f14940618b7b80b148318e2117466a61bb2cbaab745cdc
Instruction Fuzzy Hash: 12F08C72304219AF9B109EA9FC458BFBBEEFB88220714822AF519C3250DB3598059B60

Function 0711787B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17545f34cf8470cc0ff353fad83e7633ed2a96f4caf6f4a4ec0486107fc598d7
Instruction ID: 1c81cc59f026c2b8af4e6ae77fe824f61f4b1355a1dfe786bce9b15c463bef33
Opcode Fuzzy Hash: 17545f34cf8470cc0ff353fad83e7633ed2a96f4caf6f4a4ec0486107fc598d7
Instruction Fuzzy Hash: 5B0126763042009FC7069738AC968AA7FE2EBCD21131943BAE44DC7B91DE385D05C792

Function 07138510 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee733c7342a58f69f35faddc497be281bf36920dbe474faa8bb3cdd955853ba4
Instruction ID: 4e232e5e0186fb6d49cb635d62ce485f6086743dfd97930b24ee043cce693036
Opcode Fuzzy Hash: ee733c7342a58f69f35faddc497be281bf36920dbe474faa8bb3cdd955853ba4
Instruction Fuzzy Hash: 1E0125B12006068FC725DF3AD98098FBBE5EF883507008F29E55A8B665EB70FD458B91

Function 07138518 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610f92223f2fe8b06e8ecdf46c4b2e283184303871448f79957554331e1fb7c2
Instruction ID: 37a7cabe1fa35379a5bde4cc80682c04636e6221aa9658797192e35b35c7482c
Opcode Fuzzy Hash: 610f92223f2fe8b06e8ecdf46c4b2e283184303871448f79957554331e1fb7c2
Instruction Fuzzy Hash: 8801A1712006069FC725DF2AE88094BBBE5EF883547108B29F45A8B665EB70FD458B91

Function 070979A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948c1f9aa94ea6b807793807012818f4aff497174017b1e9b50911d1c597b9ad
Instruction ID: 2498fb191886f85d559b1a65c5e2f5f19a8e5a877a164f6d2e8430a3726d3663
Opcode Fuzzy Hash: 948c1f9aa94ea6b807793807012818f4aff497174017b1e9b50911d1c597b9ad
Instruction Fuzzy Hash: 0B01F4B2221703CFCF758A3AE404627B7E2FFC5205B149A3DE4428A544EA71E880EB90

Function 07133AF8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef15f6c6cf4359d381014fd5906cc071fdf6acfea367e7ca6758a0147ea5fdc
Instruction ID: 4eebf03cfdff6b7a4c5c9b1f22cdee7f38251f98f8d04e098a2a2b81d5709caa
Opcode Fuzzy Hash: 3ef15f6c6cf4359d381014fd5906cc071fdf6acfea367e7ca6758a0147ea5fdc
Instruction Fuzzy Hash: D50125712007058FC724DF2AE88094FBBE5EF893107008B29F44A8B725EB71FD458B91

Function 07110228 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6c876306e1b52e95714f5a4af9b8ef22cc0f3acbf56aa7e215ebc80f0c6056
Instruction ID: 99aeb93486c5527dd98059107e4d5195981d4a433fa4572ae99de4e11a3fc7b8
Opcode Fuzzy Hash: 2b6c876306e1b52e95714f5a4af9b8ef22cc0f3acbf56aa7e215ebc80f0c6056
Instruction Fuzzy Hash: 1EF0BBB2B181159F9F09DEA8F4054A977D9EB89521B1440FBE50DCB680EB31D580C744

Function 055DB548 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b45d2a89021b98c8cbb5de89cd5ad6cdfcf9e4de4d28721c5cbeae8428326d
Instruction ID: 74a56fc821d45e9a86fce5eb660a2521520f9033ee9c18c32d85d9db284b8b0f
Opcode Fuzzy Hash: a0b45d2a89021b98c8cbb5de89cd5ad6cdfcf9e4de4d28721c5cbeae8428326d
Instruction Fuzzy Hash: FEF0A4313102054BD724EF6BE88055EBBE7FFC83607504A29E40A8B340FF71AD058BA1

Function 0711CA38 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9b49690ceb50c659d95e46ab1a541eb8dbce21b98e145c28335241b84fdd29
Instruction ID: 2e8033a2125d838f4e8af8948dbc115ed620f2986c1a4f705f3a19ec2642e7c5
Opcode Fuzzy Hash: 2c9b49690ceb50c659d95e46ab1a541eb8dbce21b98e145c28335241b84fdd29
Instruction Fuzzy Hash: 31F0E972208108AFDF09DF58D8418DE7FBADF45260B198177E408DF251E731D941C7A1

Function 07111161 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7589355213d7ca508789c5df1b644da6c04838f2d205ca087180ed570b74648
Instruction ID: 59192dec6bc9e33b558331cb392db72b937b99e7813e27fc7e6defa65123f976
Opcode Fuzzy Hash: f7589355213d7ca508789c5df1b644da6c04838f2d205ca087180ed570b74648
Instruction Fuzzy Hash: DEF0F671605659BFC711872D9844C4AFBB9EB81370717C262D529DB2D2CB24EC4187D5

Function 07131C6A Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc57e8267e7365d403380486338e1b59baafb1c1db060f5bc545e1a8fbcec55
Instruction ID: f920a009d7cc3e86f2cf1458100bc30be78b3b67abf76e483c5d75ba4904f44c
Opcode Fuzzy Hash: fcc57e8267e7365d403380486338e1b59baafb1c1db060f5bc545e1a8fbcec55
Instruction Fuzzy Hash: 9FF06D79320A008FC745DB3DE4548687BE7AFCA25531A80E6EA06CB3B1EF70DC028B50

Function 07131C78 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f338959a92b60d11fa0e40b617413a4471cadd24ff006cba1727ecddd20fe9
Instruction ID: d6f9d2fc50c309857b2527577adb8e3f764ab302ea20fd58629ed10c0d4ded58
Opcode Fuzzy Hash: 93f338959a92b60d11fa0e40b617413a4471cadd24ff006cba1727ecddd20fe9
Instruction Fuzzy Hash: 41F0FE79320A118FC748DA3ED45487977EBAFCD65131590B9E606CB370EEB0DC029A50

Function 07099340 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f0154cd58219f519a36806316337e2ab9dcc0e656933c8516edb4c37b6b1f5
Instruction ID: 9daf7927193dcca9cb7741afff5459de029c9a471f88669c65e0374f0601e00c
Opcode Fuzzy Hash: 55f0154cd58219f519a36806316337e2ab9dcc0e656933c8516edb4c37b6b1f5
Instruction Fuzzy Hash: 67F0A7722041E83F8B158EAA6C10CFB7FEDEE8E1617094156FEE8D2141C42DC920ABB0

Function 0711E080 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e970d6cae99dc10b5baf3f84e27c3aa8f8618c1ca07c1f7db84c11c486e2f9c0
Instruction ID: 0aaedd08b6481cb7f9f85a08309c269127cd4ff9508647d30828b6cb748f483d
Opcode Fuzzy Hash: e970d6cae99dc10b5baf3f84e27c3aa8f8618c1ca07c1f7db84c11c486e2f9c0
Instruction Fuzzy Hash: 0FF049B0D0420ADFDB04DFA8C4426EEBBF0BB18210F524969D614EB241D37486468B90

Function 07117888 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a1f72fcdf0d3b119c9f068fdf8a1686ef2c16702bc0c6c7284844ad5d2407b
Instruction ID: 9d2952a3b27073c29e6886563bd833db0237d4f628b02e28ad15780ee2237f0d
Opcode Fuzzy Hash: 07a1f72fcdf0d3b119c9f068fdf8a1686ef2c16702bc0c6c7284844ad5d2407b
Instruction Fuzzy Hash: 65F05EB63001119FC608A779E89592EBBE6FBCC2513150338E54EC7750EF78AC0187C5

Function 0709885F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb7eddbb12652b4baab50eb585217c059fc7b46896202dc7ab9a8495ab929b0
Instruction ID: cf52409201fdf131a4eafbb2162da174b1522c25e66c6eb94456cc03ec5385a4
Opcode Fuzzy Hash: dfb7eddbb12652b4baab50eb585217c059fc7b46896202dc7ab9a8495ab929b0
Instruction Fuzzy Hash: 3BF0B432B043019FDB229B28EC45B957BE1AB41715F058666F259CF2D1D7B0D845EB50

Function 07136A28 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1815092dc49fb597c6954409122566fb6d38b97548f9fe5b61eafd6ba1354336
Instruction ID: 1a537fd5201c7afe26e17193bbd120e78ca73dd3d3a85a8b699d0c98bf82a357
Opcode Fuzzy Hash: 1815092dc49fb597c6954409122566fb6d38b97548f9fe5b61eafd6ba1354336
Instruction Fuzzy Hash: 4EF0E9B27053C06FC322CF6AE854912FFF6EF8665030885A9E509C7661DB30EC00CB60

Function 055D7CA0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e94e1c5dfc9e8cbf1972d7f108239dea5788e23ef4d57d3e4062d8fffbff40c
Instruction ID: b05df25c6725a9a36cc9774013b09b71af1ca4911448015b033d6ec5080ceecf
Opcode Fuzzy Hash: 4e94e1c5dfc9e8cbf1972d7f108239dea5788e23ef4d57d3e4062d8fffbff40c
Instruction Fuzzy Hash: 23F012363102049BC315AA6AF408A5BBBB9FBC9761B51C03AF545CB380CA35C805CB60

Function 07133B99 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0668ca8db7afdd000c2ca786617cd40a0168d927f880c416f89d2846cb6d6a
Instruction ID: 3aca1aa3c6aac1190093b2738453d7c464d0f96036aae71cf5ac5ba79c33b9bf
Opcode Fuzzy Hash: db0668ca8db7afdd000c2ca786617cd40a0168d927f880c416f89d2846cb6d6a
Instruction Fuzzy Hash: 2BF0E2B2B147459FCB31CE75A8846A2B7B8EB41610B0506BD9929C3140E738A604C7A6

Function 0709B460 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81418d834c7c8b315b6bb45ce588edddd84e76d21f026d0127b6edbf87635cbb
Instruction ID: 6502f17da5edaa85985d40def91c88fa49fa84eecfb73c5ff95bce32d823836c
Opcode Fuzzy Hash: 81418d834c7c8b315b6bb45ce588edddd84e76d21f026d0127b6edbf87635cbb
Instruction Fuzzy Hash: 7001EFB9D11218ABCB04CFA9D984ADEBFF6AF8C310F148169E80477350DB719940DFA0

Function 055D6462 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841a0ca6f81feaca0c3c68b5c2906b5da922a696c4a66168023ac125875b218e
Instruction ID: 3c8285d41f34f0853c6f68cb54b0a806895d7557a5186a296416c337f2e41bbf
Opcode Fuzzy Hash: 841a0ca6f81feaca0c3c68b5c2906b5da922a696c4a66168023ac125875b218e
Instruction Fuzzy Hash: 78F0BE72D002099FCB00EFBCE8056AFBFF8FB85211F04812AD148E3200E7305606CBA1

Function 07118500 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e956bd2d35bb08f2795965c018cfc6a8aadf28838bb3f0df57f77cd18d31145b
Instruction ID: 30986e1a390f2a931c968709670131be8785d4640546aa5ba2ada027d1eba811
Opcode Fuzzy Hash: e956bd2d35bb08f2795965c018cfc6a8aadf28838bb3f0df57f77cd18d31145b
Instruction Fuzzy Hash: B4F0F0B2904248DFCB018BB8C9406CCBF72FF89211F1440A6E1449B664C7309452D780

Function 071160BB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050ff2bcea852b829bf6f4da659b9d67057cd9311c8719f68e42d88ec2eb2207
Instruction ID: c17c2ab775902eef2da2e430eace794acbeaba1da4684afd8585dc47ee050644
Opcode Fuzzy Hash: 050ff2bcea852b829bf6f4da659b9d67057cd9311c8719f68e42d88ec2eb2207
Instruction Fuzzy Hash: 4DE065B93093258FC7159B24E9104A23BE9AF4D25174602E7D448CF292CB25D980C7F1

Function 0711E027 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba29da28890f0c26c655ed5467ed4263b99518d001d4918353af35f8b5fec53a
Instruction ID: 5ed1f141d3bfee55a82cf7baecfb183e5f9f23ef14facbb0b9c8ae08256974c1
Opcode Fuzzy Hash: ba29da28890f0c26c655ed5467ed4263b99518d001d4918353af35f8b5fec53a
Instruction Fuzzy Hash: C9F0A9B2D401059FD700DFA8C4462CABBF0EB08210F218975C096EB201E33882068F81

Function 0711E090 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f192bd4cb730758f0563cdf9c814d864527436bc083b2baa49ebea334f0879f7
Instruction ID: b24937441e1b55d0cd3301e536b03ec2313fae5547e6acf90e7f427d6bb600fe
Opcode Fuzzy Hash: f192bd4cb730758f0563cdf9c814d864527436bc083b2baa49ebea334f0879f7
Instruction Fuzzy Hash: 5EF0D4B0E0420ADFDB54DFA9D846AAEBBF4FB48201F1149A9D918E7240E77596048BA1

Function 055D7C90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ba0a9f3fcf375b05a5f6f72967edcc322f6eb724d8569366fcc981a9bea993
Instruction ID: ddd44f5b5442aa29912f8a42c5972d5d618541c0dbb4db4efcaaac23118e8c11
Opcode Fuzzy Hash: 39ba0a9f3fcf375b05a5f6f72967edcc322f6eb724d8569366fcc981a9bea993
Instruction Fuzzy Hash: B4F0E535224244ABC7251B69F409B9A7F7EFBCA351F40802AF5458B281CE34C803CB60

Function 0713B6A8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6429911c12138511648fad86904c458c7dd8d646b7fffebdc0705aa45ee16fed
Instruction ID: 3641117cce2895ce7935fd67f387a86051271db46a62e7f4a5c16e7acf2fd3e1
Opcode Fuzzy Hash: 6429911c12138511648fad86904c458c7dd8d646b7fffebdc0705aa45ee16fed
Instruction Fuzzy Hash: EEE09BF5A0CBB50ED733556960143E2BFD44B52124F0C896ED4CA856C2E655D55887D0

Function 07111120 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71777359428adfe747d649f4d12a68582df1d187754f91805551a84a63875b5
Instruction ID: 33e5364533efb64ce1917ab26b556bd90d5c04430405540adae7eba296844db1
Opcode Fuzzy Hash: e71777359428adfe747d649f4d12a68582df1d187754f91805551a84a63875b5
Instruction Fuzzy Hash: 19E026777193901B5703021A28C80A7BFADDACB86431540F7F908C7381ED548C0683D1

Function 055DB0E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831b3f5278977f8105951bf6d67fe25f7f0d6715b3fdeda1666fda33351ec66e
Instruction ID: 56d2f836c805199e0043516f6d3e8bdafbf8af35d40010dbf90f9066074e1275
Opcode Fuzzy Hash: 831b3f5278977f8105951bf6d67fe25f7f0d6715b3fdeda1666fda33351ec66e
Instruction Fuzzy Hash: 12E0D8623042915BE72416AD2894BB76F97DBC5265F45003AF68282145C618CC46C320

Function 055DFAC0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cc6ed5b5c41bb6f72786389cc7a4f7f6052d814bf4d2895b1ffb52664815da
Instruction ID: 623ba37492c7b2ab3029fe2922e6a45457f9532a851eb4e58ac13c042bc11070
Opcode Fuzzy Hash: 18cc6ed5b5c41bb6f72786389cc7a4f7f6052d814bf4d2895b1ffb52664815da
Instruction Fuzzy Hash: 35E06D74D0560CAFCB50EFB8D405A9CBFF5BB48304F0085A8D498D3320EA381A858F81

Function 07111130 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cdfe290c37799b2905da9edced99b2f0ea50ac6c53b01875ef058d10dff697
Instruction ID: 82e4d9169c3ab6d2aa09c86072cc4da137b9f7aa002f9d31378d98dc6c054365
Opcode Fuzzy Hash: d6cdfe290c37799b2905da9edced99b2f0ea50ac6c53b01875ef058d10dff697
Instruction Fuzzy Hash: 8ED05E36354115172615165E78C846BBADEDBCD929314007AF60DC3380DEA08C0646D0

Function 0709F1EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04759307b4e2a05e2cd59124ee957bcc8f1c3b95bd99c7b7bb144c07e62ba9cd
Instruction ID: 004fd4c3c82d942029c448d1816e986dd123216e68ce57bba2544c38a8bb21f9
Opcode Fuzzy Hash: 04759307b4e2a05e2cd59124ee957bcc8f1c3b95bd99c7b7bb144c07e62ba9cd
Instruction Fuzzy Hash: D1E06D70A1024ACFEF14CFA0C450FAEBBB1AF80304F208115D811EB259CB706945CF40

Function 0711C0E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f78890c333adfc26dcf8b22da9b886c5cc20356e83eb2a7cd5816a42514606f
Instruction ID: 7474713bf59943fa2b3d9b3b718aa10b2c155f39f2a5ea56fda6726720688b5e
Opcode Fuzzy Hash: 0f78890c333adfc26dcf8b22da9b886c5cc20356e83eb2a7cd5816a42514606f
Instruction Fuzzy Hash: BBD02B6420B3C41FC7011771F4152443FE1EB8A220B1944D2D0458FA93E8294C028322

Function 07117838 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5b8e25fd3a3372a1d0aefe44450816a6a2d53cd0898098cd21e3548babf8c5
Instruction ID: 594b323d4dbf1303e784f64a2155f656df424c5f96c960e293d9b543831d6181
Opcode Fuzzy Hash: fb5b8e25fd3a3372a1d0aefe44450816a6a2d53cd0898098cd21e3548babf8c5
Instruction Fuzzy Hash: 7DE0C2F17002249F8208F3ACE85085E3B96AF8C21030107E8EA0C5F361CE60AC404BC6

Function 055D641A Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc5dd8148361ccdc86baf3cf3eb62f6aa0305589e4a3f64490370f7d884c117
Instruction ID: 18a9f0bd3bed5c42fb91748bf660e330c81f6f7d857f069ae20bd3efb3e3c914
Opcode Fuzzy Hash: 0dc5dd8148361ccdc86baf3cf3eb62f6aa0305589e4a3f64490370f7d884c117
Instruction Fuzzy Hash: 7DE0863288474CADCB51EF7DD9446BE7FF8BB06220F40C17AE9898A011FA30D195CB91

Function 055DFAD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b9bf6eda389debdc6676cdb19f09f13a7061c75c8653ef5cb3436d6be15799
Instruction ID: a65558395a131468415cc6aadc2ed22b009ed457b60936f83d986810a7d6cefe
Opcode Fuzzy Hash: 62b9bf6eda389debdc6676cdb19f09f13a7061c75c8653ef5cb3436d6be15799
Instruction Fuzzy Hash: 1BE09274E0520CAFCB44EFB9D44559DBBF5AB48304F0085A9E819E7350EA745A448F81

Function 0711E038 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7390e90042b93288523f1def2e9d67495f63fa642380656a73f739a6156971d6
Instruction ID: 7ad707456902c53a50e87f1784a8284e9872b488f36e83aa4343b24e64b52386
Opcode Fuzzy Hash: 7390e90042b93288523f1def2e9d67495f63fa642380656a73f739a6156971d6
Instruction Fuzzy Hash: D2E092B0E40609DFD740EFA9C905A5EBBF0AB08601F2185A9D419EB251E77496058F91

Function 07098270 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b69239f912f8d29b48813b75f7efcbf9764377ec7ebfa02b11e38c27687f0b
Instruction ID: f31093816776bcb9ba8f7f483636507292a6f216ffc83bccef4ea70f81854fb0
Opcode Fuzzy Hash: 75b69239f912f8d29b48813b75f7efcbf9764377ec7ebfa02b11e38c27687f0b
Instruction Fuzzy Hash: F9D05E71200A1647CA14976BE84049677DEDF88260B008929E50A8B651EE64F84187D0

Function 07110288 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e16bef2b22c8110d88ccc0a552273275df022fdfaa28eb236fbba15176b7488
Instruction ID: 34d18885024ebf7a48ded8129900d58a7d6212d14ca21cbd563cf9fac7988c46
Opcode Fuzzy Hash: 5e16bef2b22c8110d88ccc0a552273275df022fdfaa28eb236fbba15176b7488
Instruction Fuzzy Hash: 39D0A922A0E3E20FC32B43242C10098BFB28E8790433D44EBD0C8CA063C2080A4A8BC2

Function 071109E2 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880b4862891b950c2d45df552b7470e877ee52453e3f5098535141d1c7440a71
Instruction ID: e5c67849bb9b1981e6913739834fea40f758f019c6534642da024debaa802b30
Opcode Fuzzy Hash: 880b4862891b950c2d45df552b7470e877ee52453e3f5098535141d1c7440a71
Instruction Fuzzy Hash: B7D05EB5B10058CFDF0496ADD0225ED7BB09B8A215B0100AAE209DF660D7209C85CB42

Function 055D6428 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815aca980c255db0bee40c79ae6f5c33642357c347cdf0937c50a34925c2c919
Instruction ID: 130f1417324605f52048298f4c01c6e6f95d8de5c7b7364ea09b66b0b5c87fb2
Opcode Fuzzy Hash: 815aca980c255db0bee40c79ae6f5c33642357c347cdf0937c50a34925c2c919
Instruction Fuzzy Hash: 1BE0123185071C9DCB50EF78D5448BD7BF8BB05220F40C53AE90D9A100FA30D294CF91

Function 07116B40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d7de54ab06886af66d488fa657297d1bc8b5b9e9c3b6d03f064b213cb2bf01
Instruction ID: 88541c75d5cdcc3c8e505dd2c3285d22f4f2a67916e8049729ac3b84230e3eb2
Opcode Fuzzy Hash: f2d7de54ab06886af66d488fa657297d1bc8b5b9e9c3b6d03f064b213cb2bf01
Instruction Fuzzy Hash: 3CD0C922A0AAE14FC342823828110C5BFA19A4745831A41D7D588D7623D61C094A83E1

Function 055D6F50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d432860946c1eb9d50b9cdb87e4d6279f57565693409d56fb147ecb8c4de0329
Instruction ID: fcc7fbef2781e264de455a867607090ebb5b463ed86e261b011ab43b1e966453
Opcode Fuzzy Hash: d432860946c1eb9d50b9cdb87e4d6279f57565693409d56fb147ecb8c4de0329
Instruction Fuzzy Hash: 3EE09A719093C18BD31A8B289409300BFA0BB56304F1945DEE1958A387D775D584CBA6

Function 07091308 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df24d6a804552eb99b38553dc04b4c3f63ded54798ddbaf250db412054c6127d
Instruction ID: 8c6aeb576f3c0280ec969e9bfe39cbf554e8c2ea64fe8c9a335f839ff0872107
Opcode Fuzzy Hash: df24d6a804552eb99b38553dc04b4c3f63ded54798ddbaf250db412054c6127d
Instruction Fuzzy Hash: 12D05E6000D7CA1BC3031BB1DC047417FA84B03306F0A44C2E5848D0C3E6A81481CB21

Function 071197C8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0cf87baab6ddba3194a219a3dab63c55ed6f03bf54cd8d57e89c2870df1300
Instruction ID: a4b97fcd789893ce39f007e587439b62a1ac715117dcecfdf786c25061c29875
Opcode Fuzzy Hash: 1b0cf87baab6ddba3194a219a3dab63c55ed6f03bf54cd8d57e89c2870df1300
Instruction Fuzzy Hash: AAD0C93241E3C59FEB03933498295C87F75EF872187AD88EFC0808B893C219191BC312

Function 07110434 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eeb0b7c047a0c98a0de73405054bdeefb6e1139e5800771529aee7346c7de0c
Instruction ID: b08d1b7e1adaa13499dc2699440f14d850051f9296ce0602e6b99eb27a13a365
Opcode Fuzzy Hash: 2eeb0b7c047a0c98a0de73405054bdeefb6e1139e5800771529aee7346c7de0c
Instruction Fuzzy Hash: AAD0C9B5B000049F8B44DBAEE0514EC7BF1EF89215B0100AAE209CB660DB3198558F80

Function 0711E130 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f0715cb6108e07def4350b65db14bd18b5009ee27b1638c09d422e430e369e
Instruction ID: 5f9c726b14c73a5bc240ee787744a2ba5fa500ea4f9787911ecbfd7ae6a3da31
Opcode Fuzzy Hash: 77f0715cb6108e07def4350b65db14bd18b5009ee27b1638c09d422e430e369e
Instruction Fuzzy Hash: 6AD012321841089F9B41EED4E800D627BDDBB147007018472E544CB121E721E578DB91

Function 0711D948 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8fc2c08bf6c03decbc6518f4ef41c6eda3a3270d6fb0e6ad2cf78f49c83ccc
Instruction ID: 10731ce2552b9a35e8c4835e9934f99be28500ddea0efd362bfbfb49c2b527cf
Opcode Fuzzy Hash: dc8fc2c08bf6c03decbc6518f4ef41c6eda3a3270d6fb0e6ad2cf78f49c83ccc
Instruction Fuzzy Hash: 80C08CC050E2C03FE34302608C20EB10F926A86010BED05C2A4C1CB36AEC198E2282B6

Function 0711069C Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73973e0b1d415aefc8d1d8fe5f8b7314a3549cb231d90e907d995749792314f
Instruction ID: 5f70f8014f65cf987784c006b18637b280e56d69fa24307ecae9e23c7ce64edb
Opcode Fuzzy Hash: b73973e0b1d415aefc8d1d8fe5f8b7314a3549cb231d90e907d995749792314f
Instruction Fuzzy Hash: 31D012757400109F8B08DA9DD0114D877A1DFC8315B0104A5F20ACFA70CB30DD958B80

Function 07116B00 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c147d8ff202ac5adf812e1075cf34344e8b16485b61226b8e73edec10e0790
Instruction ID: 244b172456c6c73dcb567a63cb88a69e89c47149f2db2352cb4418175a1438e8
Opcode Fuzzy Hash: 58c147d8ff202ac5adf812e1075cf34344e8b16485b61226b8e73edec10e0790
Instruction Fuzzy Hash: 9FD012312493828FC3528B34E944EC0BF70AF0A624B1A82D7F048DF273C7355954C751

Function 0711B720 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078941ddaba3a89a76bc08ae4cf2bb5542a30bae81c60ddeab936218e6d6ee78
Instruction ID: 6937a911baceb00b482e0c18c74f9d08a31024a216863b870d28a563f03d0092
Opcode Fuzzy Hash: 078941ddaba3a89a76bc08ae4cf2bb5542a30bae81c60ddeab936218e6d6ee78
Instruction Fuzzy Hash: 59C0120150D3C10FE713077408221881F225783004B8C40C6C091EA193E618C54783A1

Function 055DFA98 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703777520.00000000055D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_55d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6e7128d20e5079e7f9aeea83a536abda48bb794c51eddb7a37c26d265a58dd
Instruction ID: c0e8dafe76050faf21439322699a0ae01c3587b79171d03a1a8cc7cc48b1d779
Opcode Fuzzy Hash: 4a6e7128d20e5079e7f9aeea83a536abda48bb794c51eddb7a37c26d265a58dd
Instruction Fuzzy Hash: 2AD0127058878C9FC721DBEC9840B96BFAC9F0B614F4501CAE9D847216D5215452D7A6

Function 0711C0F8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232bd583c035f9615abd92fb88e0b1c94d7258e2ea06da56bb728e03e7161bfb
Instruction ID: 07b94bab294f1a4e466b9114d6bfe5f2ddba6568fb7f3acbb678b8a7e3d7c895
Opcode Fuzzy Hash: 232bd583c035f9615abd92fb88e0b1c94d7258e2ea06da56bb728e03e7161bfb
Instruction Fuzzy Hash: E7C08C2430024C1BC6082AF6B808B1A7BCBEBC8720F204860A40B8B786EC3A9C008625

Function 070906B0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99da2248c6438fe628e154e8317af0c1c1f1d5e7b588dd25432a0f46ac8a9957
Instruction ID: c34d0be1325bac240101a887dbc28e2dbf1a00e53fed865ba2816f2af5897e02
Opcode Fuzzy Hash: 99da2248c6438fe628e154e8317af0c1c1f1d5e7b588dd25432a0f46ac8a9957
Instruction Fuzzy Hash: 66C08C117041408BEB0A8528A0252362B22CBD2348F1104DA91868F2C1DA348D008752

Function 070906D8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af829353e26cb1debb18ecb9a9cfd5cd935ef89826c9256754fd3b8d44d2b3c8
Instruction ID: 2e6efeaf3c9b6b2801f813ac1efacb6d81f0e23f8794d735d0e8a9842c91929b
Opcode Fuzzy Hash: af829353e26cb1debb18ecb9a9cfd5cd935ef89826c9256754fd3b8d44d2b3c8
Instruction Fuzzy Hash: 2CC08C7804828E8ECB2163BDB9193EC3F2BDF91204F801151F0C80857AE8A814C38B8A

Function 070912E0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac083a2fc7022e27f7ac340a26312aa7602062d2ed090990cdce015df503fe07
Instruction ID: 2e48c823504b949ca187688d3146b779eb308d84e7bd27e19dedf4c3061286b3
Opcode Fuzzy Hash: ac083a2fc7022e27f7ac340a26312aa7602062d2ed090990cdce015df503fe07
Instruction Fuzzy Hash: 5AD0C9605492C11BDB03526888113553FA24B83244F4B88C284C09B2C6D12C9846C355

Function 0711764E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c060252cd2c72273192d7ec35f46dd57b7f2019861444a8cebe727a3fa7773
Instruction ID: 9a674a2b6e75c7cdaa808f2c0b3da8d3feb693a65111b58643e5a92ebd62f16b
Opcode Fuzzy Hash: e0c060252cd2c72273192d7ec35f46dd57b7f2019861444a8cebe727a3fa7773
Instruction Fuzzy Hash: 2FC08CF2E48188DBC3018A28B80A3D43B70EB22216F060389D80A09441D72405548A91

Function 07091840 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a495f720048db32472943c6d1e2be6df5cbb640bd85755622361e45bacbdd7
Instruction ID: 897474d7481b014b8d0dd38f9964af0a45fa68deab07ebf2cac39664e10aa4e6
Opcode Fuzzy Hash: 38a495f720048db32472943c6d1e2be6df5cbb640bd85755622361e45bacbdd7
Instruction Fuzzy Hash: 1CC08CF82002006FD3048F78C848A27BEE3EFD8311F21C81871008A268CE308880CFAA

Function 07095BD0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a339723bdb2689b5197cbb83dd39aa7297d4608fe56cfcea471f005873e471
Instruction ID: bcf743304a35efd9089a19350f1d9869886b514af7b7a22e0261372e9a425830
Opcode Fuzzy Hash: 07a339723bdb2689b5197cbb83dd39aa7297d4608fe56cfcea471f005873e471
Instruction Fuzzy Hash: 36C02BF11C42843FEF225394552A7D27FF16720310F070401A3CC04006C46C4063D30A

Function 0711C128 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57bdfac7c291e376700347bb867d5362571e8159ad508ec1854b7fa4379c7a2
Instruction ID: 63ddc43e55c0643c3ebaabd919f5515f08cfbd9c83c29f42adea6e3f3b18c4e9
Opcode Fuzzy Hash: e57bdfac7c291e376700347bb867d5362571e8159ad508ec1854b7fa4379c7a2
Instruction Fuzzy Hash: 5EB012F51F8150E17101FB645981A6E5903EFAAB14F51EC26B2491C0C09672946591BB

Function 070906E8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3acb2def288c9b3f29fa81789867ff071b95f79cb6d44b40d4e1ee6498777c
Instruction ID: d1fcca252b5d6566a4dd4f9de298b99d4e58303fb3743f3115542db015585ac5
Opcode Fuzzy Hash: fe3acb2def288c9b3f29fa81789867ff071b95f79cb6d44b40d4e1ee6498777c
Instruction Fuzzy Hash: 07B0123400430E4FC64077BAF9095553B5DDE80204B401520B40D0D575BD7428C14AD5

Function 07091318 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c4414d4107190f069425d73bd10da4823f780036c1b7d07f752acc5677bde0
Instruction ID: 917c97d098158e08e5ba4fb3f995e1d67dbcd82bf0f3146635a05777aefd26e7
Opcode Fuzzy Hash: 54c4414d4107190f069425d73bd10da4823f780036c1b7d07f752acc5677bde0
Instruction Fuzzy Hash: 45B0127100470E4BC60177A6F84565437DCD644306B40CA20B00D0D185AD7C2841C695

Function 07116B10 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Function 07111108 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501b69600ce6a34d8687116e3be97b04916a5a4523ab29b84a2670ddbfe8c545
Instruction ID: d924be37a45e67db2ddfcc6a87fe7347f7bf7db06e071536ef9fb0015590986d
Opcode Fuzzy Hash: 501b69600ce6a34d8687116e3be97b04916a5a4523ab29b84a2670ddbfe8c545
Instruction Fuzzy Hash: 37C09270501340CFCB06CF30D0488007F72EF4630535984D8E0098B662CB32EC82CF00

Function 0711768A Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5fee066a44f8340e3719537b74c14d6e5ad87e3c32468f3be4e8564e26320c
Instruction ID: 89adda4c0712e3d3facd18d19e56094f392251aafcd101b05153d81d97fa252e
Opcode Fuzzy Hash: ac5fee066a44f8340e3719537b74c14d6e5ad87e3c32468f3be4e8564e26320c
Instruction Fuzzy Hash: 38A022F28080088380280A00380F030B320C302002B0223C2EC0E08A88AB0A08208280

Non-executed Functions

Function 07134200 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

%, xrefs: 071345F4

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 4a246a91f2940b89bd9dfecc4b255ad79c8167bacd956d9c8084bf2d88fea624
Instruction ID: d6d7c60a2c8405c29b4ca012f59a2a742ae95167189e55967a23655d8f9a0695
Opcode Fuzzy Hash: 4a246a91f2940b89bd9dfecc4b255ad79c8167bacd956d9c8084bf2d88fea624
Instruction Fuzzy Hash: 1A025BB4A00209DFDB19DFB9D844AAEBBF2FF88300F148529E9069B395DB349945CF51

Function 07136AF0 Relevance: 1.3, Instructions: 1271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e835eb9ce12b272d10b6db03f0a67ce5e5a50861d95a4f5d3ba3811683e184a
Instruction ID: 3a69cdb23f00a77a9ca8ae8da7f179992c5a7c577f33be3e39216e270969ca11
Opcode Fuzzy Hash: 7e835eb9ce12b272d10b6db03f0a67ce5e5a50861d95a4f5d3ba3811683e184a
Instruction Fuzzy Hash: 78C2F7B4A00219DFDB25DF64C894BADBBB2FF49301F1085A9E909AB390DB359D81CF51

Function 0709948A Relevance: .8, Instructions: 785COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4e0b7cb07b21f515e2aa533cb814e5668f9db308c655b218307a7eb44e07bf
Instruction ID: 5f691009b58be699b7b80df43cdc9532ffad6a3685fb61e87a8925c8500e1321
Opcode Fuzzy Hash: 4f4e0b7cb07b21f515e2aa533cb814e5668f9db308c655b218307a7eb44e07bf
Instruction Fuzzy Hash: DC6230F0600201AFE748DF69D85471A7AD6EF84308F24C66CD1099F396DBBAD94B8F91

Function 07099498 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a2743e90928c0133f5cd94f4a15bf4dc7a23d6b241dbfec87d18ef6567cc8a
Instruction ID: 82acb7ee6739be4bc25e138f9d1c0347239874253ee9ef93f9b2adde7503ef0a
Opcode Fuzzy Hash: 92a2743e90928c0133f5cd94f4a15bf4dc7a23d6b241dbfec87d18ef6567cc8a
Instruction Fuzzy Hash: 346240F0600201ABE748DF69D85471A7AD6EF84308F24C66CD10D9F396DBBAD94B8F91

Function 0713E3D0 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4eb73243318232733c991577e29c1dfdd741728cbd7198e280ce0f0def6b3fc
Instruction ID: e87e310101ec2663660d349be9e5a03c84ef203689cd9cc85e7845cd7e8d667c
Opcode Fuzzy Hash: d4eb73243318232733c991577e29c1dfdd741728cbd7198e280ce0f0def6b3fc
Instruction Fuzzy Hash: D22238B0A00319DFDB29CF65C844A9DBBB2BF89305F1181A9E809AB391DB35DD85CF51

Function 07098D00 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704673407.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65266a271ada179f4c347ac2286f011a07cfd88509223c9405e6915ef175f7fe
Instruction ID: 2cf2cda3f27395ba658dc54e47b8086270ceac889e612f8ab6203df2c0ce7697
Opcode Fuzzy Hash: 65266a271ada179f4c347ac2286f011a07cfd88509223c9405e6915ef175f7fe
Instruction Fuzzy Hash: 17E1C1B0A0020A9FCF55CF69D854A9EBBF2EF89304F148669E405EB391DB34ED45CB91

Function 028DE504 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697829480.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4409c6b7c60c42a3fd0f5fb092269a6e0705866dac6120d3a7034937adb4706e
Instruction ID: 2c4698910677da93a04033f1f303c89a79bfcc38a70d91e3675e693a5ba5ef80
Opcode Fuzzy Hash: 4409c6b7c60c42a3fd0f5fb092269a6e0705866dac6120d3a7034937adb4706e
Instruction Fuzzy Hash: 2EA14F3AE002158FCF15DFA5C8505AEB7B2FF84304B15456AE906EF265EB31E959CF80

Function 0711B8B8 Relevance: 6.5, Strings: 5, Instructions: 277COMMON

Download Yara Rule

Strings

LRtq, xrefs: 0711BB50
LRtq, xrefs: 0711BC3E
$tq, xrefs: 0711BC81
$tq, xrefs: 0711B9CD
$tq, xrefs: 0711BCCB

Memory Dump Source

Source File: 00000000.00000002.1705030173.0000000007110000.00000040.00000800.00020000.00000000.sdmp, Offset: 07110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7110000_39382629.jbxd

Similarity

API ID:
String ID: LRtq$LRtq$$tq$$tq$$tq
API String ID: 0-481670580
Opcode ID: 9d2d203b36816a88bf7fc6a9ff88e1f0c6b49851751f7bc198252646a4422d60
Instruction ID: 07b6bed7c53661c0338e6445aed86822f93a57cd867a2f9c2ba219c68755565e
Opcode Fuzzy Hash: 9d2d203b36816a88bf7fc6a9ff88e1f0c6b49851751f7bc198252646a4422d60
Instruction Fuzzy Hash: FFC14FF0E18119DFCB29CF99C481AADB7B1FF89300F15816AE805AF295DB34AD41CB55

Function 0713003E Relevance: 6.5, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

4ctq, xrefs: 0713028F
$|q, xrefs: 071301DA
4ctq, xrefs: 07130285
h|q, xrefs: 07130217
h|q, xrefs: 07130252

Memory Dump Source

Source File: 00000000.00000002.1705102744.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7130000_39382629.jbxd

Similarity

API ID:
String ID: $|q$4ctq$4ctq$h|q$h|q
API String ID: 0-1496539775
Opcode ID: 5c0d97315786d35240f8673ba872e5930fbc17338082798fa0db963c451acefc
Instruction ID: 1a90b0a954fee516a9bd11681772d8d48353319290fbc69df8b04fb2b53e6638
Opcode Fuzzy Hash: 5c0d97315786d35240f8673ba872e5930fbc17338082798fa0db963c451acefc
Instruction Fuzzy Hash: C6A12AB4A00205CFD719CF69C484A69BBF6FF88310F19C599E8099B3A2DB31EC84CB51

Analysis Process: 39382629.exePID: 7712, Parent PID: 7544COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	6

Executed Functions

Function 080C0D98 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 080C15FE
$tq, xrefs: 080C10BD
$tq, xrefs: 080C1181
$tq, xrefs: 080C1531

Memory Dump Source

Source File: 00000002.00000002.1838891345.00000000080C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_80c0000_39382629.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 533db7f640a0097d206d13bb6974b2be8fc9e56758e46cb464ea6fc41583c247
Instruction ID: 8f049d1da43f21a2d44515b98cdbfd1dac40de63aba361035aa77188a384f1a7
Opcode Fuzzy Hash: 533db7f640a0097d206d13bb6974b2be8fc9e56758e46cb464ea6fc41583c247
Instruction Fuzzy Hash: E332AF74E01229CFDB64DF65C850BDEBBB2BB89301F5081E9D40AAB251DB359E85CF90

Function 080C1A78 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 080C1C29
$tq, xrefs: 080C1C13
$tq, xrefs: 080C1CC3
$tq, xrefs: 080C1CD9

Memory Dump Source

Source File: 00000002.00000002.1838891345.00000000080C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_80c0000_39382629.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: 9cf996a4a38dfbd36f5172f9e43e60f5af5ddb7cbf4c914ff852d7baf3b07190
Instruction ID: 2584fc77a2b051c0cb61df2766669b6e1af0626d18ded419286e02f0051bd5c2
Opcode Fuzzy Hash: 9cf996a4a38dfbd36f5172f9e43e60f5af5ddb7cbf4c914ff852d7baf3b07190
Instruction Fuzzy Hash: F6C1D774E0021DCFDB68DFA9C890B9EBBB2BF89301F5081AAD409AB255DB345D85CF54

Function 0149AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B086

Memory Dump Source

Source File: 00000002.00000002.1822923714.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1490000_39382629.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fc9dde664c2d605021ca041f12bb96475f8e2ae05a95e264e2013f7c48b39356
Instruction ID: c8ab79c2f62ccb11b9ec92171345ca02691a1bb01627ee4c4081c89bc640fcee
Opcode Fuzzy Hash: fc9dde664c2d605021ca041f12bb96475f8e2ae05a95e264e2013f7c48b39356
Instruction Fuzzy Hash: A47134B0A00B058FDB24DF2AD05475BBBF1FF88214F14892ED58A9BB60D775E845CBA1

Function 01494248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014959F1

Memory Dump Source

Source File: 00000002.00000002.1822923714.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1490000_39382629.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: aa2bf0e4733f01c2ef9f0f27c02c2060535512f73d7b3d25db08d22f9e30b24d
Instruction ID: b20bbdf950fcdbfe20aa925511301d9b218a1213e8e84335a5a0ec1acb26e234
Opcode Fuzzy Hash: aa2bf0e4733f01c2ef9f0f27c02c2060535512f73d7b3d25db08d22f9e30b24d
Instruction Fuzzy Hash: 9841C1B0D0075DCADB24CFA9C884B9EBBF5FF49314F20845AD408AB251DB756945CF90

Function 01495935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014959F1

Memory Dump Source

Source File: 00000002.00000002.1822923714.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1490000_39382629.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ca64048493780f72903edc72793408a12a30ad16990a9e620bad2afadcca2c66
Instruction ID: f853fb56120de808ba6edd93bb4536b9ad0da220b71d06f6a8d18062478a8b59
Opcode Fuzzy Hash: ca64048493780f72903edc72793408a12a30ad16990a9e620bad2afadcca2c66
Instruction Fuzzy Hash: BE41C0B0D00759CEDB24DFA9C884B9EBBB5FF89304F24845AD408AB251DB796946CF90

Function 0149C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0149D2C6,?,?,?,?,?), ref: 0149D387

Memory Dump Source

Source File: 00000002.00000002.1822923714.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1490000_39382629.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fc95219ebfa49f44753b50b20ce4f2fcdc4cabd4bc8963082c8d21de7273f2fd
Instruction ID: ae16c86bd279810e8a843ecea5db17bf4219e93744c5a7d9b569070bcf4d93bb
Opcode Fuzzy Hash: fc95219ebfa49f44753b50b20ce4f2fcdc4cabd4bc8963082c8d21de7273f2fd
Instruction Fuzzy Hash: 1121B4B5D00248EFDB10CF9AD984ADEBFF8EB48320F14841AE914A7350D375A954CFA5

Function 0149D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0149D2C6,?,?,?,?,?), ref: 0149D387

Memory Dump Source

Source File: 00000002.00000002.1822923714.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1490000_39382629.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 161bde55c343ec533d728ba9ff5a1e5e3ee130df46429e67369f94d5fc081caa
Instruction ID: 623ccf267dfde04ca3974b07d052e2b15b2a499b1be495a0bc85e0c8e6bc0031
Opcode Fuzzy Hash: 161bde55c343ec533d728ba9ff5a1e5e3ee130df46429e67369f94d5fc081caa
Instruction Fuzzy Hash: 8821E3B5D00249DFDB10CFA9D585AEEBFF4EB48320F14841AE918A3350D374A954CF61

Function 080C48B9 Relevance: 1.6, APIs: 1, Instructions: 51
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 080C491D

Memory Dump Source

Source File: 00000002.00000002.1838891345.00000000080C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_80c0000_39382629.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 397ab9643d359b0bf997901777d8e61fadfcebe324792f4442aec720e143c3a9
Instruction ID: 7e1306b46290f760848626906f5825e6121c2933daf6901a15b470d496332363
Opcode Fuzzy Hash: 397ab9643d359b0bf997901777d8e61fadfcebe324792f4442aec720e143c3a9
Instruction Fuzzy Hash: 3E11F5B98006499FDB20CF9AD845BDEFFF8EB48320F10841AE515A7610C375A584CFA5

Function 0149B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B086

Memory Dump Source

Source File: 00000002.00000002.1822923714.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1490000_39382629.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6a533067b0d458ac17157e48e2dbcd8b67399b2ca19c29e26d5b9bb34d04ca27
Instruction ID: 7ff7a8145e2c1fc72197c89c0f2cc21467365e3522ecb126b5f0a62b0aaa30bc
Opcode Fuzzy Hash: 6a533067b0d458ac17157e48e2dbcd8b67399b2ca19c29e26d5b9bb34d04ca27
Instruction Fuzzy Hash: B811CDB5C006498ADB20CF9AD444A9EFBF8EB88224F14851AD969A7610C379A545CFA1

Function 080C3830 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 080C491D

Memory Dump Source

Source File: 00000002.00000002.1838891345.00000000080C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 080C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_80c0000_39382629.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a3cf94cde4368bb4f4af34b6c67c457a77f65af9cbaf58a6a75dcc108d2a00a5
Instruction ID: a54122ebae4fd22bc1bf17dc87510fad11b20aa362a6b66855a727ca37dbc0f8
Opcode Fuzzy Hash: a3cf94cde4368bb4f4af34b6c67c457a77f65af9cbaf58a6a75dcc108d2a00a5
Instruction Fuzzy Hash: 2C11F2B5800649DFCB20DF9AD884BDEFBF8FB48320F10841AE919A7201C375A944CFA5

Function 0142D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822553171.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327ebb5184639656151f1f1a1a15865a58ea3fe188f8813d3cadfd1ae0e2b1d4
Instruction ID: 9eee6e3f409c7b35264b281df9c8ca97b972afd8e5216f8e0fe9d6f1b7a03a02
Opcode Fuzzy Hash: 327ebb5184639656151f1f1a1a15865a58ea3fe188f8813d3cadfd1ae0e2b1d4
Instruction Fuzzy Hash: 62212771900240DFCB158F94D8C0F17BFA5FB88314F64C66AE90D0B266C33AD456CBA1

Function 0142D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822553171.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3cdcd7d4f05dd18dba1afbc2f69f09eded61ebfaea34613ef7361d2140525d9
Instruction ID: 29fa71e61a071765c2d3edd4fc0888db1a2add829e9ecec754181cff291bd973
Opcode Fuzzy Hash: f3cdcd7d4f05dd18dba1afbc2f69f09eded61ebfaea34613ef7361d2140525d9
Instruction Fuzzy Hash: 8E2145B1904240DFDB05DF58C8C0B27BFA5FB88318F64C56AE9090B266C376D4C6CAA1

Function 0143D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822610422.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_143d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f85a88093f803dd08d6ec5f63aad7ad09f7776ad8c17cd5addfa4031f3f042c
Instruction ID: 01706d5396d8545ae0faab5a2ab828fc3e27508cc5151ad205480304343570af
Opcode Fuzzy Hash: 5f85a88093f803dd08d6ec5f63aad7ad09f7776ad8c17cd5addfa4031f3f042c
Instruction Fuzzy Hash: F62103B1904200DFDB15DF58D880B16FBB5FB88B18F64C56EE94A4B366C336D407CA61

Function 0143D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822610422.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_143d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a177557953203da0ef50946d451360fd7cc501970689c4f0b36961eaf748406
Instruction ID: 91eb0f449e6b46c5ee080aa31470c9a19698ef635ef310e214f0d5b8c106d60d
Opcode Fuzzy Hash: 9a177557953203da0ef50946d451360fd7cc501970689c4f0b36961eaf748406
Instruction Fuzzy Hash: 4B2180755093808FDB13CF64D590716BF71EB86214F28C5DBD8498F2A7C33A980ACB62

Function 0142D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822553171.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f30bf31a0b928eb9e8b34aa75df187a12aef3d2722db20fa6917a23a38658ef
Instruction ID: 49fa77a00c5525f10d2c052deb64aeb416b759bc4693428ca840fe2b87402b22
Opcode Fuzzy Hash: 1f30bf31a0b928eb9e8b34aa75df187a12aef3d2722db20fa6917a23a38658ef
Instruction Fuzzy Hash: 6C21DF76804280DFDB16CF44D9C4B16BF72FB88314F2482AAD9480B267C33AD466CB91

Function 0142D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822553171.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: c66f524a04b7e0c2dacaee04b1f7a8484e1774e752dee128d8147c5072575c21
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 3A11E172804280CFDB12CF54D9C0B16BF71FB84314F24C6AAD9094B266C33AD49ACBA1

Function 0142DA01 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822553171.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c43d187a0b45f45eff760031566633ba5c398802bac27140d869d9a5773ce5
Instruction ID: a577798832e8b3e9f5a447331bb6826356ec78838406cd5300b99928fa1c31e0
Opcode Fuzzy Hash: e3c43d187a0b45f45eff760031566633ba5c398802bac27140d869d9a5773ce5
Instruction Fuzzy Hash: C801F2719083509AE7218A5ECC84F77FFA8EF41760F58C45BED090F2A3D2789880CAB1

Function 0142DA00 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1822553171.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142d000_39382629.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da81104dcba4d9434bcbbfa96568dbbfe94e370c5736d7c481ee2882446120f
Instruction ID: 72a229000be462084007e956001ab57500d572d304a075f08051a339c2ca7d95
Opcode Fuzzy Hash: 3da81104dcba4d9434bcbbfa96568dbbfe94e370c5736d7c481ee2882446120f
Instruction Fuzzy Hash: E7F0C272408344AEE7118A0ACC84B67FF98EB40734F18C45AED084F297C2789884CAB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 39382629.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39382629.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
39382629.exe

Function 070963F8 Relevance: 1.8, Strings: 1, Instructions: 520
COMMON

Function 07092350 Relevance: 38.3, Strings: 28, Instructions: 3259
COMMON

Function 0711AB93 Relevance: 5.1, Strings: 4, Instructions: 121
COMMON

Function 0709EE68 Relevance: 4.0, Strings: 3, Instructions: 249
COMMON

Function 0711ACBB Relevance: 3.9, Strings: 3, Instructions: 107
COMMON

Function 07131228 Relevance: 3.8, Strings: 3, Instructions: 76
COMMON

Function 07111170 Relevance: 3.3, Instructions: 3315
COMMON

Function 07095C00 Relevance: 3.0, Strings: 2, Instructions: 459
COMMON

Function 0709EE57 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Function 0711B74A Relevance: 2.6, Strings: 2, Instructions: 91
COMMON

Function 07119958 Relevance: 2.5, Strings: 2, Instructions: 19
COMMON

Function 0713EE80 Relevance: 1.9, Strings: 1, Instructions: 601
COMMON

Function 0709B588 Relevance: 1.6, Strings: 1, Instructions: 381
COMMON