Edit tour

Windows Analysis Report
nv8401986_110422.exe

Overview

General Information

Sample name:	nv8401986_110422.exe
Analysis ID:	1583791
MD5:	31549917cdc6e3f9d40a48ea5998493f
SHA1:	c0f7e826645b1ba2ba1fed866992beb9de7a31df
SHA256:	73f03b369e9df60c2dc97baefcdc4ba920da3a2126c873a4654e1a83510d3b87
Tags:	Adwareexemalwareuser-Joker
Infos:

Detection

Qjwmonkey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected Qjwmonkey

AI detected suspicious sample

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to infect the boot sector

Contains functionality to inject threads in other processes

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SGDT)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read device registry values (via SetupAPI)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential key logger detected (key state polling based)

Queries device information via Setup API

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

nv8401986_110422.exe (PID: 768 cmdline: "C:\Users\user\Desktop\nv8401986_110422.exe" MD5: 31549917CDC6E3F9D40A48EA5998493F)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Qjwmonkey	Yara detected Qjwmonkey	Joe Security
Process Memory Space: nv8401986_110422.exe PID: 768	JoeSecurity_Qjwmonkey	Yara detected Qjwmonkey	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.nv8401986_110422.exe.400000.0.unpack	JoeSecurity_Qjwmonkey	Yara detected Qjwmonkey	Joe Security

HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn

Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.sq
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://238358d141a1b2850f10e9a50017a441.clo.footprintdns.com/
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://238358d141a1b2850f10e9a50017a441.clo.footprintdns.com/apc/trans.gif
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://238358d141a1b2850f10e9a50017a441.clo.footprintdns.com/apc/trans.gif?238358d141a1b2850f10e9a50
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://238358d141a1b2850f10e9a50017a441.clo.footprintdns.com/apc/trans.gifE
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gif
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3285360334.000000000B130000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gif?2f928570784a0da6dbd199b01
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gifQ
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gifyL
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif(
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif/M
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif=
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif?45295f866ecde2b90fe5d09c7
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gifU
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gifg
Source: nv8401986_110422.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nv8401986_110422.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: nv8401986_110422.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: nv8401986_110422.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nv8401986_110422.exe	String found in binary or memory: http://cdn.fengdf.cn/youxi/index_%d_%d.htm
Source: nv8401986_110422.exe, 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cdn.fengdf.cn/youxi/index_%d_%d.htmThumWndClass/qy/o/qy/rq/qy/rq2procgcp=/qy/gcpcpr=/qy/cprda
Source: nv8401986_110422.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: nv8401986_110422.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: nv8401986_110422.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: nv8401986_110422.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: nv8401986_110422.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nv8401986_110422.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: nv8401986_110422.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fp.msedge.net/
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fp.msedge.net/r.gif?&MonitorID=AZR&rid=5F4B6DC1B0B44A0E8B9396C4B221B2F1&w3c=true&prot=http:&v
Source: nv8401986_110422.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: nv8401986_110422.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: nv8401986_110422.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: nv8401986_110422.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: nv8401986_110422.exe, 00000000.00000002.3291318128.000000000BF11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pravo.gov.ru/proxy/ips/?docbody=&link_id=2&nd=102144583&intelsearch=&lastDoc=1n
Source: nv8401986_110422.exe, 00000000.00000003.2035873967.0000000004088000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.live.com/Web/s
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.000000000083C000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/&&e&&h&&h.first
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/X
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/bqd
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/o
Source: nv8401986_110422.exe, 00000000.00000003.2035873967.000000000407F000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/gl
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040A8000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2035873967.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/gl1
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/glf
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/lq:
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/lqorA
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/lqti
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.000000000082E000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/png
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/png(
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/pngF
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/pngs
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/pngtps:/
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/rq
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/qy/rqh
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn/sb_2
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn:80/qy/gl
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn:80/qy/lqnrps0sid360softtm1689880905type20uid102e1490f0604c078f675cf9899bc6e6ver6
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn:80/qy/png
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn:80/qy/pngsersd
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.nanweng.cn:80/qy/rq
Source: nv8401986_110422.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/#
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/M
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/Q
Source: nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/x/
Source: nv8401986_110422.exe, 00000000.00000002.3299397640.000000000D1F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3302728536.000000000E2C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.cn
Source: nv8401986_110422.exe, 00000000.00000003.2049616047.000000000AEA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js4r
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js7
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsjs
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jss
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsyy
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js$
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js=202501
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.jsj
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.jsq
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074343474.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js9
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsF
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.jsv
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074343474.000000000B898000.00000004.00000800.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js(
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jsZ
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.jsm
Source: nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAA5000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000413A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074343474.000000000B898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/config/v1/
Source: nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/config/v1/$
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/config/v1/&ocid=iehp&os=windows&locale=
Source: nv8401986_110422.exe, 00000000.00000002.3288793430.000000000B921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/config/v1/F
Source: nv8401986_110422.exe, 00000000.00000002.3290752153.000000000BDD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype
Source: nv8401986_110422.exe, 00000000.00000002.3288186724.000000000B8A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/service/MSN/Feed/me?$top=32&DisableTypeSerialization=true&activityId=7FF05383
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008DF8000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png)
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png4b0d5b40196862f17.js
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.pngansy
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.pnghidu
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.pngm
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/Icon.png
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/Icon.png(
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3296440880.000000000CC20000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.png
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.png7C
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngMC
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngpC
Source: nv8401986_110422.exe, 00000000.00000002.3278061822.0000000004740000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3296440880.000000000CC20000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.png
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.png...
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.png...(
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngm
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3296440880.000000000CC20000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png7)yx
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.pngC.%y
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.pngg)
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.pngw
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.comhttps://assets.msn.cn
Source: nv8401986_110422.exe, 00000000.00000002.3288793430.000000000B939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/
Source: nv8401986_110422.exe, 00000000.00000002.3295020523.000000000CA20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/https://assets.msn.com
Source: nv8401986_110422.exe, 00000000.00000002.3288186724.000000000B8A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/https://assets.msn.cominternetExpl
Source: nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.cominternetExplorer
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.microsoftstart.cn/OneCollector/1.0
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.cn/OneCollector/1.0
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004114000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2134989538.000000000D6D0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2134917852.000000000D6CD000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2134726476.000000000D6C8000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2134166907.000000000D6C0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2134523903.000000000D6C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-strea
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/U
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c.microsoftstart.cn/c.gif
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c.microsoftstart.com/c.gif
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.msn.com/
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.msn.com/K
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3286553261.000000000B6C3000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3278061822.00000000046AE000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.msn.com/c.gif?rnd=1735914359600&udc=true&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&rf=&tp=ht
Source: nv8401986_110422.exe, 00000000.00000002.3297552533.000000000CD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c.msn.com/c.gifhttps://c.msn.cn/c.gif
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cc.bingj.com/cache.aspx?q=
Source: nv8401986_110422.exe, 00000000.00000002.3283626284.0000000008F00000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2052305080.000000000BCAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cc.bingj.com/cache.aspx?q=--disable-features%3dOptimizationGuideModelDownloading%2cOptimizat
Source: nv8401986_110422.exe, 00000000.00000003.2016577008.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.googl
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/web
Source: nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: nv8401986_110422.exe, 00000000.00000003.2017194964.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoref
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreo0
Source: nv8401986_110422.exe, 00000000.00000003.2017194964.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: nv8401986_110422.exe, 00000000.00000003.2016577008.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx~
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/
Source: nv8401986_110422.exe, 00000000.00000002.3297552533.000000000CD40000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.js
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsD
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsL
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsP
Source: nv8401986_110422.exe, 00000000.00000002.3297885994.000000000CD8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsa
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsctor/1.0?cors=true&content-type=application/x-json-stream
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jsownl
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.6.3.min.jstandard
Source: nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla(
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: nv8401986_110422.exe, nv8401986_110422.exe, 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: nv8401986_110422.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016577008.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.googl%
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: nv8401986_110422.exe, 00000000.00000002.3295020523.000000000CA3E000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288186724.000000000B8A0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3286827192.000000000B6D0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000413A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3292301623.000000000C0B6000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004114000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288793430.000000000B939000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2049616047.000000000AEA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ent-api.msn.com/
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://events-sandbox.data.microsoftstart.com/OneCollector/1.0https://browser.events.data.microsoft
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://events-sandbox.data.msn.cn/OneCollector/1.0
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://events-sandbox.data.msn.com/OneCollector/1.0
Source: search[1].htm.0.dr	String found in binary or memory: https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.md
Source: nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.md)y
Source: nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.mdix
Source: nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.mdq
Source: nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B3B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.mdy
Source: nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RaicuE
Source: nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raicup
Source: search[1].htm.0.dr	String found in binary or memory: https://github.com/Raicuparta/rai-pal/discussions/185
Source: nv8401986_110422.exe, 00000000.00000003.2041511987.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raicuparta/rai-pal/discussions/185T
Source: search[1].htm.0.dr	String found in binary or memory: https://github.com/Raicuparta/rai-pal/issues/145
Source: nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raicuparta/rai-pal/issues/145(
Source: nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raicuparta/rai-pal/issues/145W
Source: nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raicuparta/rai-pal/issues/145y=
Source: nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0
Source: nv8401986_110422.exe, 00000000.00000003.2052497302.000000000BC74000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2065743355.0000000008EB8000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2065764959.0000000008EB9000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2065716314.0000000008EB7000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3282842388.0000000008EB8000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2065803582.0000000008EBC000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2065784346.0000000008EBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1735914355&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2035873967.000000000407F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comx
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/
Source: nv8401986_110422.exe, 00000000.00000002.3285360334.000000000B130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/error?code=50058#/wx
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/error?code=50058J
Source: nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/en-us/news/us/about-us/ar-BBN0NAKInternet
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016646782.000000000083A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2200217510.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074406692.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3283793163.0000000008F13000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074767391.0000000008F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rcf.fRmsDeferundefinedhttps://raka.aRmsDeferevent.customhttps://rafd.https://r.(
Source: nv8401986_110422.exe, 00000000.00000003.2016577008.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.c(
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sb.scorecardresearch.com/
Source: nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sb.scorecardresearch.com/b
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sb.scorecardresearch.com/b?rn=1735914359603&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.m
Source: nv8401986_110422.exe, 00000000.00000003.2072800327.0000000008EF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://storage.live.com/users/0x
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: nv8401986_110422.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016646782.000000000083A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/E
Source: nv8401986_110422.exe, 00000000.00000003.2016577008.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: nv8401986_110422.exe, 00000000.00000003.2016577008.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstorev
Source: nv8401986_110422.exe, 00000000.00000003.2016646782.000000000083A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.000000000083C000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3290088545.000000000BBB0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2049616047.000000000AEA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp
Source: nv8401986_110422.exe, 00000000.00000002.3286827192.000000000B6D0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3292301623.000000000C0B6000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2049616047.000000000AEA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp#lang=en-us&adsReferer=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp&devi
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp(n
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp-1-0
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp/?
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp/?ocid=iehp...1.png
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp00
Source: nv8401986_110422.exe, 00000000.00000003.2035873967.0000000004088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp1
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp3.6.3.min.jsmillis:
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp3.6.3.min.jstandard
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp3.6.3.min.jstps://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/l
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp48
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp6
Source: nv8401986_110422.exe, 00000000.00000003.2049616047.000000000AEA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehp=i.Arra
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpC:
Source: nv8401986_110422.exe, 00000000.00000002.3278061822.00000000046F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpL
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpP
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpT
Source: nv8401986_110422.exe, 00000000.00000002.3289369777.000000000BA40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpTelemetryInitOptions.get
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpZ
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpe
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpell
Source: nv8401986_110422.exe, 00000000.00000002.3285524155.000000000B3C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehphttps://www.msn.com/?ocid=iehp
Source: nv8401986_110422.exe, 00000000.00000002.3297885994.000000000CD80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehphttps://www.msn.com/?ocid=iehphttps://www.msn.com/?ocid=iehp/0https://
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpionmethod
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpn
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpn-
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpng
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141/?ocid=iehp
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpp0
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehptPrototypeOf?O
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/?ocid=iehpv1/homePage/latest/midlevel/experience.b374b0d5b40196862f17.js
Source: nv8401986_110422.exe, 00000000.00000002.3295450038.000000000CB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/PV.xmlGQ=MS.News.Web.AdImpressionX
Source: nv8401986_110422.exe, 00000000.00000002.3295450038.000000000CB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/topgeschichten/impressum/ar-BB5wWbz
Source: nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3285360334.000000000B130000.00000004.00000020.00020000.00000000.sdmp, experience.b374b0d5b40196862f17[1].js.0.dr	String found in binary or memory: https://www.msn.com/fr-ch/actualite/other/Mentions-l
Source: nv8401986_110422.exe, 00000000.00000002.3295450038.000000000CB00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/fr-fr/actualite/microsoftnews/qui-sommes-nous/ar-AA135Z7yhttps://www.msn.com/de-
Source: nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/id-id/berita/nasional/tentang-kami/ar-BBca8ZEhttps://www.msn.com/it-it/notizie/m
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comP
Source: nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comc
Source: nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comnewsAndInterests
Source: nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comsn.com)

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.18.122:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_004AA100 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004AA100

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_004AA100 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004AA100

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_004AA940 GetKeyState,GetKeyState,GetKeyState,GetKeyState,lstrlenW,lstrlenW,lstrlenW,

0_2_004AA940

Spam, unwanted Advertisements and Ransom Demands

Yara detected Qjwmonkey

Source: Yara match	File source: 0.2.nv8401986_110422.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nv8401986_110422.exe PID: 768, type: MEMORYSTR

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0048BDF0 GetProcAddress,RtlInitializeCriticalSection,__Init_thread_footer,RtlEnterCriticalSection,LoadLibraryA,GetProcAddress,RtlLeaveCriticalSection,NtProtectVirtualMemory,_strstr,_strstr,

0_2_0048BDF0

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0048F380: DeviceIoControl,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,

0_2_0048F380

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0048C060	0_2_0048C060
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00492070	0_2_00492070
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004E60D0	0_2_004E60D0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00462370	0_2_00462370
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00494420	0_2_00494420
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_005404C0	0_2_005404C0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00436530	0_2_00436530
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004406E0	0_2_004406E0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004686F0	0_2_004686F0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00530840	0_2_00530840
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00524900	0_2_00524900
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00494980	0_2_00494980
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004A2B20	0_2_004A2B20
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00492BA0	0_2_00492BA0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0045CDE0	0_2_0045CDE0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00490EA0	0_2_00490EA0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004D8F00	0_2_004D8F00
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00517240	0_2_00517240
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00517301	0_2_00517301
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0051D3D0	0_2_0051D3D0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004134D0	0_2_004134D0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004F1480	0_2_004F1480
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0051D85C	0_2_0051D85C
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004238C0	0_2_004238C0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0041D9D0	0_2_0041D9D0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004439D0	0_2_004439D0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00491A40	0_2_00491A40
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00447AD0	0_2_00447AD0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004A3B40	0_2_004A3B40
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0053DE3F	0_2_0053DE3F
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00417F40	0_2_00417F40
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00441F90	0_2_00441F90

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: String function: 0049C5E0 appears 124 times
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: String function: 0049D360 appears 36 times
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: String function: 00483970 appears 43 times
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: String function: 00471D90 appears 37 times
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: String function: 0043F340 appears 63 times
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: String function: 00514EE0 appears 36 times

Source: nv8401986_110422.exe, 00000000.00000000.2014677397.00000000005A5000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSEMzf vs nv8401986_110422.exe
Source: nv8401986_110422.exe, 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSEMzf vs nv8401986_110422.exe
Source: nv8401986_110422.exe	Binary or memory string: OriginalFilenameSEMzf vs nv8401986_110422.exe

Source: nv8401986_110422.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: nv8401986_110422.exe

Static PE information: Section: UPX1 ZLIB complexity 0.9907210500616777

Source: classification engine

Classification label: mal100.adwa.spyw.evad.winEXE@1/81@12/3

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_00483970 GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,CloseHandle,

0_2_00483970

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_00410800 GetProcAddress,GetProcAddress,GetProcAddress,SHGetPathFromIDListW,FindFirstFileW,CoInitialize,CoCreateInstance,_wcsrchr,_wcschr,CoUninitialize,FindNextFileW,FindClose,

0_2_00410800

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0046A5B0 GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,LoadCursorW,RegisterClassExW,GetModuleHandleW,CreateWindowExW,GetModuleHandleW,FindResourceW,GetModuleHandleW,SizeofResource,GetModuleHandleW,LoadResource,FreeResource,

0_2_0046A5B0

Source: C:\Users\user\Desktop\nv8401986_110422.exe

File created: C:\Users\user\AppData\Roaming\GlobalMgr.db

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Mutant created: \Sessions\1\BaseNamedObjects\ATL:MemData03EAnv8401986_110422.exe

Source: C:\Users\user\Desktop\nv8401986_110422.exe

File created: C:\Users\user\AppData\Local\Temp\~DF258EEC8E43A49788.TMP

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nv8401986_110422.exe	Virustotal: Detection: 87%
Source: nv8401986_110422.exe	ReversingLabs: Detection: 86%

Source: nv8401986_110422.exe	String found in binary or memory: aow-install-apk-100.xml
Source: nv8401986_110422.exe	String found in binary or memory: aow-install-apk.xml
Source: nv8401986_110422.exe	String found in binary or memory: vdi-install-apk-100.xml

Source: C:\Users\user\Desktop\nv8401986_110422.exe

File read: C:\Users\user\Desktop\nv8401986_110422.exe

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: windowscodecsext.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: icm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Section loaded: winrnr.dll	Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

File written: C:\ProgramData\roundinfo.ini

Jump to behavior

Source: nv8401986_110422.exe

Static PE information: certificate valid

Source:	Binary string: #E:\654.pdb source: nv8401986_110422.exe, 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: E:\654.pdb source: nv8401986_110422.exe, nv8401986_110422.exe, 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0046D180 LoadLibraryA,GetProcAddress,

0_2_0046D180

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_005149D5 push ecx; ret	0_2_005149E8
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00514F26 push ecx; ret	0_2_00514F39
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0BEF699B push esi; ret	0_2_0BEF69A3
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0BEF7027 push esi; ret	0_2_0BEF702F
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0BEF4B3A push cs; iretd	0_2_0BEF4B4F
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0BF05A03 pushad ; retf	0_2_0BF05A09
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0C91F167 push esp; retf	0_2_0C91F175
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0CF068CD push ecx; retf	0_2_0CF068CE
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0D7E242C pushad ; retf	0_2_0D7E2430
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0D7E32D4 push eax; retf	0_2_0D7E32D5
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0EC826E6 push esi; ret	0_2_0EC826E8
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0EC82985 push esi; ret	0_2_0EC82987

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: DeviceIoControl,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_0048F380
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: CreateFileW,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%d	0_2_0048F7E0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_0048F5E0

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00406230 GetProcAddress,GetProcAddress,PathFileExistsA,GetProcAddress,PathFileExistsA,GetPrivateProfileSectionNamesA,GetPrivateProfileStringA,GetProcAddress,PathFileExistsA,GetPrivateProfileIntA,GetPrivateProfileStringA,GetProcAddress,std::ios_base::_Ios_base_dtor,		0_2_00406230
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004886E0 GetProcAddress,GetProcAddress,GetLocalTime,GetProcAddress,PathFileExistsA,SetFileAttributesA,GetPrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,CreateFileA,CloseHandle,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,		0_2_004886E0

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: DeviceIoControl,CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_0048F380
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: CreateFileW,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%d	0_2_0048F7E0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_0048F5E0

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_004546A0 MessageBoxA,ShowWindow,ShowWindow,IsIconic,ShowWindow,	0_2_004546A0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00445A50 KillTimer,KillTimer,KillTimer,MessageBoxA,KillTimer,KillTimer,KillTimer,PostMessageW,ShowWindow,ShowWindow,ShowWindow,IsIconic,ShowWindow,	0_2_00445A50
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00449F60 GetWindowRect,GetWindowRect,IsIconic,SystemParametersInfoW,GetWindowRect,SystemParametersInfoW,SetWindowPos,	0_2_00449F60

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_00484290 GetModuleHandleW,GetProcAddress,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,_wcsstr,_wcsstr,_wcsstr,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00484290

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect virtual machines (IN, VMware)

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0048BBD0 in eax, dx

0_2_0048BBD0

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 4670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 5120000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 6670000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 6690000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 69A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 8DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 8F20000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: 8F60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: A960000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: AB70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: AC90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B470000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B5F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B610000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B650000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B780000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B830000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B800000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B940000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B960000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B9A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: B9E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BA00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BA60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BAB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BA80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BAD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BAF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BB10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BB30000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BB50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BB70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BB90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BBB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BDD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BDF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BE10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BE30000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BE50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BE70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BE90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BEB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BED0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C0E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C100000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C120000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C140000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C3E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C400000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C560000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C5A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C720000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C740000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C760000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C780000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C800000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C860000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C010000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C050000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BF70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BF90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: BFD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C070000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C090000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C7A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C880000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C8A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C8C0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C8E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C920000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C940000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C980000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C9A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: C9E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: CA00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: CA40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: CA60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: CA80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: CAC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Memory allocated: CAE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0048BD40 sgdt fword ptr [ebp-20h]

0_2_0048BD40

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0048BB50 sldt word ptr [ebp-1Ch]

0_2_0048BB50

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: GetProcAddress,GetAdaptersInfo,		0_2_00467280
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: GetSystemDirectoryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetAdaptersInfo,FreeLibrary,		0_2_0048FD60

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_00468E20 GetProcAddress,GetProcAddress,GetProcAddress,SetupDiGetClassDevsW,GetProcAddress,GetProcAddress,SetupDiGetDeviceRegistryPropertyA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetupDiDestroyDeviceInfoList,

0_2_00468E20

Source: C:\Users\user\Desktop\nv8401986_110422.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00410800 GetProcAddress,GetProcAddress,GetProcAddress,SHGetPathFromIDListW,FindFirstFileW,CoInitialize,CoCreateInstance,_wcsrchr,_wcschr,CoUninitialize,FindNextFileW,FindClose,	0_2_00410800
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0048E0D0 CreateFileW,FindFirstFileW,FindFirstFileW,FindClose,FindFirstFileW,FindClose,CopyFileW,DeleteFileW,CreateFileW,GetFileSize,ReadFile,CloseHandle,	0_2_0048E0D0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00457360 GetProcAddress,FindFirstFileW,CoInitialize,CoCreateInstance,GetProcAddress,GetProcAddress,GetProcAddress,CoUninitialize,FindNextFileW,FindClose,	0_2_00457360

Source: C:\Users\user\Desktop\nv8401986_110422.exe

0_2_00484290

Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior

Source: nv8401986_110422.exe, 00000000.00000003.2035873967.0000000004088000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn*
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAA8CAMAAAANIilAAAADAFBMVEVHcEz9nl76bFQcWtMZltvUtzjppEwRkOjIX8uPacrxW4r8nF7qxQ33eXX2ZG/ZVKcPk+W3fO3+i1jaQDzfVZ/OV7bSQkzPU7UgZ78otPe8wCwdWNL1bH3FwiVZtWzRTJFIr4DyXYbsWVy1T9BatW0OPserVuPDdObuxgt0t1pIr38VmvDVVKq7wSz6xwP+n1cQQMcZSszrxw/2xwb6xwXDffOmVuX/cUH/Yj4GNsP/sFaBulLiRj8Ud+AVcN64fvL/jkq8UMYcmcY2pZ3zVTzoV5X5iWsnn7NzuFwvoqhxuF2YvUKOvEkjnLw4xfz/eUULO8cXk9PlVpk3xP01v/m0bO7Pwh9zd+P/oyPFcNv/vQ4HN8TXPj35h20PQMcRQ8kfVM62UM/uWI/1bn08qZTOU7MOk+fyWoq7UMnzXYcUe+P5Wz3+qFf+pFn/sVL1a39wuF35hG8MPMYdTs1atWwgqPMVRsoUmez/aED1aIEWb90Udd/ROD3/dEMPhuj6imv/ikr/sVMSSMntelTVRz/dVUjAY9OoVeP+xAslrvbhRj30ZYL7lmPuxgv4gXH2d3bBUcP/hUj4fnL8m2DaVaYZSsv/mE7zYIUqn7ILTs0Zatr6jGkgWdL3e3XQwx6uTtn7kmayT9T/rFUqs/j/ekUcYdbdVaLqWJQcXdH/a0DoxQ79oVr/cELwUj3gVp//r1P0YoT2cXv/kEz9xgwRlurpTD3lckf/lEwfgLv/wgrmV5i5YdkNkeHVVKu9WcxBq40WnO7KUrjXxBoOkt7/gEditmfDwifdxRbGUr2Ju0zjxRIbZtjxWYwmnrgzpKMiq/X3dHn/Yj0NkeQamMukVei1wC9MsXtSs3MZofAUldVqt2Gfvj7KwyN3uVmDulA1wfyQvEj5iGwRk9oXltBGroXAb+KXvUQ3xP04p5u+wSr7j2jjVpuxV9myYOK3be98ulXRVLAcpPItuPkinL8emcWuvzQuoqynvzmqYOymTeH2xwaygO0yvvsrlq3jXl/3k1hx3/ILAAAAW3RSTlMA/iAgIBAw3yAQmnXan0BQn7dnx2i3f5d4d2/Hz6coKrffaLffv99fv1BgYN/f349/UCBg799wkL/voL9Qr1/vv8+fz9/O30CQkJ+/z9/f30BAv48w31BAQO+vKT2ZNwAAA91JREFUeF7t01N0ZUkUxvEzN05nkmnPtDPT5jTHts3L2Lbttm3bxti2bdv6au+qU8manJPHfun/c377q3XWjXH8OtHtt934KXpX9Be3Krnaec6gmzu2p/0gW2XWtMDpdGZne87s0DZRz3J5VImwHm9+/lh7OyIv73vZa2ZestVzcnrbWv+g+9pUIMKwx5M/JyfH5/Ozw6cUFOwu2N2m+PgFzmwvrM+3ePGpdsPx7VRu2vVretsNv/D/Dhdne2AFXfPkwhDrYfxpmx4U+TxesqALiy+0HiZAfSB6ncLHkra4uOQCSxxkig9FL1L7+dHClpQkJ/tb2Fu0+In6UbSeh2FBk8uDLPSlWqCnqfnzq708LGw5ChrR7ke7AYAF9Qv1t2fQWD/qrs5/yi6aOLHzkLb2KgbcM6r96r9hyD0fi75R3RHcGl+jxWey2NhY9ZsKrq+vP3Toa/SbbHDr51+mBHeM85O4+1H0FWpoaHiJm6StPwvuI9UAaUPuf2z69MSoqBXLlv2uOkPj4Vq8YvbqcIkj4kgnRq3QfLDGA7RQ5ebm9pO453dKE+c0HqgF9bBooCEbeURo5vBUlGn7saDe4DIzM6+Vtv/s2VrDU4kmHqYAelv0rWiYxN22siYOT11i4qu1eId6XBQg8a1fbl0LTRye01/7PBbUe6JP0HXShqw7SJo4PNfTxNcT4N5U9ZI4Ipo18zjsiyJMrMWv3M8oUOLQp6LXKQ6P4lB/EzPgXpaNMmSRSQnRYhwcHvuikYaZKT7nHkF9pXVsn5eUQONYZ4+6azxKEvQWt3TpnRKf3gKNcebw4sLabhr3ZSB7gAqQuE9GkeAJWCePCyhY414A1KPUE2ioevWOmIyiopZ5xMmjg1cYuoAwALRRNGXjFDRO4h7P7YiJEePgwuMACmXHjQsDQH/IJoxX9p8l08AzwJUXF8KZqcYPDRs9ekLjrl2NjQcO3Hu3gzq/a+m0mdC8LjwdSIo02ivw3G2pm+burHxoddmG51O2NLtcWVNnLlGcPA5sDzXar1Ma482M69xZmrNH4YZFY+buq5zBeE+zq2bR++6sqcSFxz4u9DGsCti3s3LG6rLNhQKXLv9iUYXm8OLCyYZlF4vhsg2FKVv2uOomLydOj4fHBeSwxl1gaXgLXj1rcisOLy5g2LJAWPpcePW/J82SnDz2cQHD1t0Ey8N1aWmbFMd8RYXb7c7CsE1nwfJwTWoqNHH2eMCVDlscXsjWVbtt5Uri8ODwONDFsO/sFLKle6uqmPM8HehkdJDjcrK1VelV6emKs2drX4+urtq9qemU4pgfE2gct070H3UVaZJu2kWyAAAAAElFTkSuQmCC
Source: nv8401986_110422.exe, 00000000.00000002.3274337460.000000000080B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2035873967.0000000004088000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: nv8401986_110422.exe, 00000000.00000003.2017243202.000000000087A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\h
Source: nv8401986_110422.exe, 00000000.00000002.3302728536.000000000E2C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: heraxResKeytainertxmlns='http://www.w3.org/2000/svg' viewBox='0 0 2048 2048'%3E%3Cpath stroke='%23767676' stroke-width='2.5' stroke-linecap='round' stroke-miterlimit='10' fill='%23767676' d='M2048 341v683h-171V633l-768 768-341-342-665 665-121-120 786-786 341 341 648-647h-392V341h683z'%3E%3C/path%3E%3C/svg%3E='9' cy='9' r='7.75' fill='none'%3E%3C/circle%3E%3Cpath fill='none' d='M25 25h-25v-25h25z'%3E%3C/path%3E%3C/svg%3E0134452 4.7319 0.0118565 4.60901 0.0621374C4.48611 0.112418 4.37446 0.186671 4.28056 0.280564C4.18667 0.374457 4.11242 0.486109 4.06214 0.609005C4.01186 0.731901 3.98655 0.863581 3.98771 0.99636C3.98886 1.12914 4.01645 1.26036 4.06886 1.38236C4.12127 1.50437 4.19745 1.61471 4.29296 1.70696L10.586 7.99996L4.29296 14.293C4.19745 14.3852 4.12127 14.4956 4.06886 14.6176C4.01645 14.7396 3.98886 14.8708 3.98771 15.0036C3.98655 15.1363 4.01186 15.268 4.06214 15.3909C4.11242 15.5138 4.18667 15.6255 4.28056 15.7194C4.37446 15.8132 4.48611 15.8875 4.60901 15.9378C4.7319 15.9881 4.86358 16.0134 4.99636 16.0122C5.12914 16.0111 5.26036 15.9835 5.38236 15.9311C5.50437 15.8787 5.61471 15.8025 5.70696 15.707Z' fill='white'/%3E%3C/g%3E%3Cdefs%3E%3CclipPath id='clip0_1248_247'%3E%3Crect width='16' height='16' fill='white'/%3E%3C/clipPath%3E%3C/defs%3E%3C/svg%3EL2Lbttm3bxti2bdv6au+qU8manJPHfun/c377q3XWjXH8OtHtt934KXpX9Be3Krnaec6gmzu2p/0gW2XWtMDpdGZne87s0DZRz3J5VImwHm9+/lh7OyIv73vZa2ZestVzcnrbWv+g+9pUIMKwx5M/JyfH5/Ozw6cUFOwu2N2m+PgFzmwvrM+3ePGpdsPx7VRu2vVretsNv/D/Dhdne2AFXfPkwhDrYfxpmx4U+TxesqALiy+0HiZAfSB6ncLHkra4uOQCSxxkig9FL1L7+dHClpQkJ/tb2Fu0+In6UbSeh2FBk8uDLPSlWqCnqfnzq708LGw5ChrR7ke7AYAF9Qv1t2fQWD/qrs5/yi6aOLHzkLb2KgbcM6r96r9hyD0fi75R3RHcGl+jxWey2NhY9ZsKrq+vP3Toa/SbbHDr51+mBHeM85O4+1H0FWpoaHiJm6StPwvuI9UAaUPuf2z69MSoqBXLlv2uOkPj4Vq8YvbqcIkj4kgnRq3QfLDGA7RQ5ebm9pO453dKE+c0HqgF9bBooCEbeURo5vBUlGn7saDe4DIzM6+Vtv/s2VrDU4kmHqYAelv0rWiYxN22siYOT11i4qu1eId6XBQg8a1fbl0LTRye01/7PBbUe6JP0HXShqw7SJo4PNfTxNcT4N5U9ZI4Ipo18zjsiyJMrMWv3M8oUOLQp6LXKQ6P4lB/EzPgXpaNMmSRSQnRYhwcHvuikYaZKT7nHkF9pXVsn5eUQONYZ4+6azxKEvQWt3TpnRKf3gKNcebw4sLabhr3ZSB7gAqQuE9GkeAJWCePCyhY414A1KPUE2ioevWOmIyiopZ5xMmjg1cYuoAwALRRNGXjFDRO4h7P7YiJEePgwuMACmXHjQsDQH/IJoxX9p8l08AzwJUXF8KZqcYPDRs9ekLjrl2NjQcO3Hu3gzq/a+m0mdC8LjwdSIo02ivw3G2pm+burHxoddmG51O2NLtcWVNnLlGcPA5sDzXar1Ma482M69xZmrNH4YZFY+buq5zBeE+zq2bR++6sqcSFxz4u9DGsCti3s3LG6rLNhQKXLv9iUYXm8OLCyYZlF4vhsg2FKVv2uOomLydOj4fHBeSwxl1gaXgLXj1rcisOLy5g2LJAWPpcePW/J82SnDz2cQHD1t0Ey8N1aWmbFMd8RYXb7c7CsE1nwfJwTWoqNHH2eMCVDlscXsjWVbtt5Uri8ODwONDFsO/sFLKle6uqmPM8HehkdJDjcrK1VelV6emKs2drX4+urtq9qemU4pgfE2gct070H3UVaZJu2kWyAAAAAElFTkSuQmCC1,e="",o,s,f,r,u,st=!1,w=[],l=SbiUtil.pd,a=SbiUtil.oncop;n.showLoadingIcon=ct;n.init=wi})(SBICom\|\|(SBICom={}));var Lib;(function(n){var t;(function(n){function u(n,t){var r,i;if(t==null\|\|n==null)throw new TypeError("Null element passed to Lib.CssClass");if(n.indexOf)return n.indexOf(t);for(r=n.length,i=0;i<r;i++)if(n[i]===t)return i;return-1}function f(n,u){if(n==null)throw new TypeError("Null element passed to Li
Source: nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAA8CAMAAAANIilAAAADAFBMVEVHcEz9nl76bFQcWtMZltvUtzjppEwRkOjIX8uPacrxW4r8nF7qxQ33eXX2ZG/ZVKcPk+W3fO3+i1jaQDzfVZ/OV7bSQkzPU7UgZ78otPe8wCwdWNL1bH3FwiVZtWzRTJFIr4DyXYbsWVy1T9BatW0OPserVuPDdObuxgt0t1pIr38VmvDVVKq7wSz6xwP+n1cQQMcZSszrxw/2xwb6xwXDffOmVuX/cUH/Yj4GNsP/sFaBulLiRj8Ud+AVcN64fvL/jkq8UMYcmcY2pZ3zVTzoV5X5iWsnn7NzuFwvoqhxuF2YvUKOvEkjnLw4xfz/eUULO8cXk9PlVpk3xP01v/m0bO7Pwh9zd+P/oyPFcNv/vQ4HN8TXPj35h20PQMcRQ8kfVM62UM/uWI/1bn08qZTOU7MOk+fyWoq7UMnzXYcUe+P5Wz3+qFf+pFn/sVL1a39wuF35hG8MPMYdTs1atWwgqPMVRsoUmez/aED1aIEWb90Udd/ROD3/dEMPhuj6imv/ikr/sVMSSMntelTVRz/dVUjAY9OoVeP+xAslrvbhRj30ZYL7lmPuxgv4gXH2d3bBUcP/hUj4fnL8m2DaVaYZSsv/mE7zYIUqn7ILTs0Zatr6jGkgWdL3e3XQwx6uTtn7kmayT9T/rFUqs/j/ekUcYdbdVaLqWJQcXdH/a0DoxQ79oVr/cELwUj3gVp//r1P0YoT2cXv/kEz9xgwRlurpTD3lckf/lEwfgLv/wgrmV5i5YdkNkeHVVKu9WcxBq40WnO7KUrjXxBoOkt7/gEditmfDwifdxRbGUr2Ju0zjxRIbZtjxWYwmnrgzpKMiq/X3dHn/Yj0NkeQamMukVei1wC9MsXtSs3MZofAUldVqt2Gfvj7KwyN3uVmDulA1wfyQvEj5iGwRk9oXltBGroXAb+KXvUQ3xP04p5u+wSr7j2jjVpuxV9myYOK3be98ulXRVLAcpPItuPkinL8emcWuvzQuoqynvzmqYOymTeH2xwaygO0yvvsrlq3jXl/3k1hx3/ILAAAAW3RSTlMA/iAgIBAw3yAQmnXan0BQn7dnx2i3f5d4d2/Hz6coKrffaLffv99fv1BgYN/f349/UCBg799wkL/voL9Qr1/vv8+fz9/O30CQkJ+/z9/f30BAv48w31BAQO+vKT2ZNwAAA91JREFUeF7t01N0ZUkUxvEzN05nkmnPtDPT5jTHts3L2Lbttm3bxti2bdv6au+qU8manJPHfun/c377q3XWjXH8OtHtt934KXpX9Be3Krnaec6gmzu2p/0gW2XWtMDpdGZne87s0DZRz3J5VImwHm9+/lh7OyIv73vZa2ZestVzcnrbWv+g+9pUIMKwx5M/JyfH5/Ozw6cUFOwu2N2m+PgFzmwvrM+3ePGpdsPx7VRu2vVretsNv/D/Dhdne2AFXfPkwhDrYfxpmx4U+TxesqALiy+0HiZAfSB6ncLHkra4uOQCSxxkig9FL1L7+dHClpQkJ/tb2Fu0+In6UbSeh2FBk8uDLPSlWqCnqfnzq708LGw5ChrR7ke7AYAF9Qv1t2fQWD/qrs5/yi6aOLHzkLb2KgbcM6r96r9hyD0fi75R3RHcGl+jxWey2NhY9ZsKrq+vP3Toa/SbbHDr51+mBHeM85O4+1H0FWpoaHiJm6StPwvuI9UAaUPuf2z69MSoqBXLlv2uOkPj4Vq8YvbqcIkj4kgnRq3QfLDGA7RQ5ebm9pO453dKE+c0HqgF9bBooCEbeURo5vBUlGn7saDe4DIzM6+Vtv/s2VrDU4kmHqYAelv0rWiYxN22siYOT11i4qu1eId6XBQg8a1fbl0LTRye01/7PBbUe6JP0HXShqw7SJo4PNfTxNcT4N5U9ZI4Ipo18zjsiyJMrMWv3M8oUOLQp6LXKQ6P4lB/EzPgXpaNMmSRSQnRYhwcHvuikYaZKT7nHkF9pXVsn5eUQONYZ4+6azxKEvQWt3TpnRKf3gKNcebw4sLabhr3ZSB7gAqQuE9GkeAJWCePCyhY414A1KPUE2ioevWOmIyiopZ5xMmjg1cYuoAwALRRNGXjFDRO4h7P7YiJEePgwuMACmXHjQsDQH/IJoxX9p8l08AzwJUXF8KZqcYPDRs9ekLjrl2NjQcO3Hu3gzq/a+m0mdC8LjwdSIo02ivw3G2pm+burHxoddmG51O2NLtcWVNnLlGcPA5sDzXar1Ma482M69xZmrNH4YZFY+buq5zBeE+zq2bR++6sqcSFxz4u9DGsCti3s3LG6rLNhQKXLv9iUYXm8OLCyYZlF4vhsg2FKVv2uOomLydOj4fHBeSwxl1gaXgLXj1rcisOLy5g2LJAWPpcePW/J82SnDz2cQHD1t0Ey8N1aWmbFMd8RYXb7c7CsE1nwfJwTWoqNHH2eMCVDlscXsjWVbtt5Uri8ODwONDFsO/sFLKle6uqmPM8HehkdJDjcrK1VelV6emKs2drX4+urtq9qemU4pgfE2gct070H3UVaZJu2kWyAAAAAElFTkSuQmCC")l
Source: nv8401986_110422.exe, 00000000.00000002.3302728536.000000000E253000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9qemU4p

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_00466CF0 GetProcAddress,GetProcAddress,GetModuleHandleW,GetProcAddress,GetCurrentProcess,GetCurrentProcess,GetProcAddress,CheckRemoteDebuggerPresent,GetProcAddress,RtlInitializeCriticalSection,__Init_thread_footer,RtlEnterCriticalSection,RtlLeaveCriticalSection,KiUserExceptionDispatcher,GetSystemTime,GetProcAddress,GetTimeZoneInformation,RasEnumConnectionsW,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,GetModuleHandleW,GetProcAddress,GetVersionExA,

0_2_00466CF0

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0051B34E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0051B34E

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0046D180 LoadLibraryA,GetProcAddress,

0_2_0046D180

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0052E24E mov eax, dword ptr fs:[00000030h]

0_2_0052E24E

Source: C:\Users\user\Desktop\nv8401986_110422.exe

0_2_00466CF0

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_0051B34E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0051B34E
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: 0_2_00513E11 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00513E11

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_00469FF0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,

0_2_00469FF0

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_0048CD60 cpuid

0_2_0048CD60

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_0053C938
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: EnumSystemLocalesW,	0_2_0053CBFB
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: EnumSystemLocalesW,	0_2_0053CBB0
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: EnumSystemLocalesW,	0_2_00532C21
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: EnumSystemLocalesW,	0_2_0053CC96
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: GetLocaleInfoW,	0_2_005330EB
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0053D09C
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0053D270

Source: C:\Users\user\Desktop\nv8401986_110422.exe

0_2_00468E20

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\nv8401986_110422.exe

Code function: 0_2_004886E0 GetProcAddress,GetProcAddress,GetLocalTime,GetProcAddress,PathFileExistsA,SetFileAttributesA,GetPrivateProfileStringA,GetPrivateProfileIntA,GetPrivateProfileIntA,GetPrivateProfileIntA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,CreateFileA,CloseHandle,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,WritePrivateProfileStringA,

0_2_004886E0

Source: C:\Users\user\Desktop\nv8401986_110422.exe

0_2_00466CF0

Source: C:\Users\user\Desktop\nv8401986_110422.exe

0_2_00466CF0

Source: nv8401986_110422.exe	Binary or memory string: msmpeng.exe
Source: nv8401986_110422.exe	Binary or memory string: 360tray.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\default\Secure Preferences	Jump to behavior
Source: C:\Users\user\Desktop\nv8401986_110422.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Bootkit	1 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	4 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	64 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	2 Query Registry	Distributed Component Object Model	2 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	15 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	15 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nv8401986_110422.exe	87%	Virustotal		Browse
nv8401986_110422.exe	87%	ReversingLabs	Win32.Adware.Qjwmonkey
nv8401986_110422.exe	100%	Avira	ADWARE/Qjwmonkey.Gen
nv8401986_110422.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif/M	0%	Avira URL Cloud	safe
https://events-sandbox.data.microsoftstart.com/OneCollector/1.0https://browser.events.data.microsoft	0%	Avira URL Cloud	safe
http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gif	0%	Avira URL Cloud	safe
http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif?45295f866ecde2b90fe5d09c7	0%	Avira URL Cloud	safe
https://assets.msn.comhttps://assets.msn.cn	0%	Avira URL Cloud	safe
http://w.nanweng.cn:80/qy/rq	100%	Avira URL Cloud	malware
http://w.nanweng.cn:80/qy/png	100%	Avira URL Cloud	malware
https://www.msn.comc	0%	Avira URL Cloud	safe
https://browser.events.data.microsoftstart.cn/OneCollector/1.0	0%	Avira URL Cloud	safe
http://cdn.fengdf.cn/youxi/index_%d_%d.htm	0%	Avira URL Cloud	safe
http://w.nanweng.cn/bqd	100%	Avira URL Cloud	malware
http://cdn.fengdf.cn/youxi/index_%d_%d.htmThumWndClass/qy/o/qy/rq/qy/rq2procgcp=/qy/gcpcpr=/qy/cprda	0%	Avira URL Cloud	safe
https://www.msn.comP	0%	Avira URL Cloud	safe
http://w.nanweng.cn/qy/gl1	100%	Avira URL Cloud	malware
http://.sq	0%	Avira URL Cloud	safe
http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gifQ	0%	Avira URL Cloud	safe
http://w.nanweng.cn/qy/glf	100%	Avira URL Cloud	malware
http://w.nanweng.cn:80/qy/pngsersd	100%	Avira URL Cloud	malware
http://w.nanweng.cn/qy/gl	100%	Avira URL Cloud	malware
http://w.nanweng.cn/qy/rqh	100%	Avira URL Cloud	malware
http://w.nanweng.cn/qy/png	100%	Avira URL Cloud	malware
https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/	0%	Avira URL Cloud	safe
https://www.msn.	0%	Avira URL Cloud	safe
https://c.microsoftstart.com/c.gif	0%	Avira URL Cloud	safe
http://w.nanweng.cn:80/qy/lqnrps0sid360softtm1689880905type20uid102e1490f0604c078f675cf9899bc6e6ver6	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
code.jquery.com	151.101.194.137	true	false	high
w.nanweng.cn	47.103.45.17	true	false	unknown
sb.scorecardresearch.com	18.244.18.122	true	false	high
assets.msn.com	unknown	unknown	false	high
www.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com	unknown	unknown	false	unknown
45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com	unknown	unknown	false	unknown
login.microsoftonline.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
238358d141a1b2850f10e9a50017a441.clo.footprintdns.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sb.scorecardresearch.com/b?rn=1735914359603&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=30919B60838E69BC08808E09822668DF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://code.jquery.com/jquery-3.6.3.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gif	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.microsoftstart.cn/OneCollector/1.0	nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.comc	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/id-id/berita/nasional/tentang-kami/ar-BBca8ZEhttps://www.msn.com/it-it/notizie/m	nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://w.nanweng.cn:80/qy/rq	nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://assets.msn.comhttps://assets.msn.cn	nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/vendors.290823e0e7160e8e5303.js	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074343474.000000000B898000.00000004.00000800.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	false		high
https://code.jquery.com/jquery-3.6.3.min.jsctor/1.0?cors=true&content-type=application/x-json-stream	nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/error?code=50058#/wx	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008DF8000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif?45295f866ecde2b90fe5d09c7	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaotak	nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3302728536.000000000E2C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cdn.fengdf.cn/youxi/index_%d_%d.htm	nv8401986_110422.exe	false	Avira URL Cloud: safe	unknown
https://c.msn.com/c.gif?rnd=1735914359600&udc=true&pg.n=startpage&pg.t=hp&pg.c=&pg.p=prime&rf=&tp=ht	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3286553261.000000000B6C3000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3278061822.00000000046AE000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.jsjs	nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp	false		high
http://45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com/apc/trans.gif/M	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Raicuparta/rai-pal/issues/145y=	nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/PV.xmlGQ=MS.News.Web.AdImpressionX	nv8401986_110422.exe, 00000000.00000002.3295450038.000000000CB00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://events-sandbox.data.microsoftstart.com/OneCollector/1.0https://browser.events.data.microsoft	nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.pngm	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/OneCollector/1.0	nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD15000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.pngg)	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.png	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3296440880.000000000CC20000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008DF8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://w.nanweng.cn:80/qy/png	nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://w.nanweng.cn/bqd	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.000000000083C000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000874000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Raicuparta/rai-pal/issues/145(	nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.comP	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/RaicuE	nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehpC:	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Raicuparta/rai-pal/issues/145W	nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	false		high
http://2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com/apc/trans.gifQ	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://w.nanweng.cn:80/qy/pngsersd	nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000823000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstoref	nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	nv8401986_110422.exe, 00000000.00000003.2016666986.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics//pr-3693935/IE11NTP/ie-image.png)	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	false		high
http://w.nanweng.cn/qy/gl1	nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040A8000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2035873967.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://w.nanweng.cn/qy/gl	nv8401986_110422.exe, 00000000.00000003.2035873967.000000000407F000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://code.jquery.com/jquery-3.6.3.min.jsownl	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Raicup	nv8401986_110422.exe, 00000000.00000003.2034852726.0000000006B06000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2033997079.0000000006B06000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.md	search[1].htm.0.dr	false		high
https://www.msn.com/?ocid=iehp3.6.3.min.jstandard	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/E	nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2016646782.000000000083A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.msn.com/	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008E98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehp3.6.3.min.jstps://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/l	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehp	nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3290088545.000000000BBB0000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2049616047.000000000AEA3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cdn.fengdf.cn/youxi/index_%d_%d.htmThumWndClass/qy/o/qy/rq/qy/rq2procgcp=/qy/gcpcpr=/qy/cprda	nv8401986_110422.exe, 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	nv8401986_110422.exe, 00000000.00000003.2017194964.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingrms	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	nv8401986_110422.exe, 00000000.00000003.2017117414.000000000084A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehp48	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	nv8401986_110422.exe, 00000000.00000003.2017194964.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false		high
http://w.nanweng.cn/qy/rqh	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/microsoft.b109cceab5e009228460.js	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000003.2074343474.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004088000.00000004.00000020.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	false		high
https://assets.msn.com/config/v1/$	nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/web	nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000847000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.sq	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msn.com/en-us/news/us/about-us/ar-BBN0NAKInternet	nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/logo.png...	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	nv8401986_110422.exe, 00000000.00000003.2017046700.000000000084D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://w.nanweng.cn/qy/glf	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AF05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://w.nanweng.cn/qy/png	nv8401986_110422.exe, 00000000.00000002.3274337460.000000000082E000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3274337460.0000000000823000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Raicuparta/rai-pal/discussions/185T	nv8401986_110422.exe, 00000000.00000003.2041511987.0000000004127000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.0000000004127000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/config/v1/F	nv8401986_110422.exe, 00000000.00000002.3288793430.000000000B921000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/b	nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/U	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AE82000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehpp/?LinkId=255141/?ocid=iehp	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehpng	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000414A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3296440880.000000000CC20000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3281796416.0000000008DF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/mobile-image.png7)yx	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehpp0	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/homePage/latest/midlevel/common.802715d7a736bd82fc74.js	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A56000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3288070935.000000000B898000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3284974365.000000000AEFB000.00000004.00000020.00020000.00000000.sdmp, J0K33CCW.htm.0.dr	false		high
https://assets.msn.comhttps://assets.msn.com/resolver/api/resolve/	nv8401986_110422.exe, 00000000.00000002.3288793430.000000000B939000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/Icon.png	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B060000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.o	nv8401986_110422.exe, 00000000.00000002.3299397640.000000000D1F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://c.microsoftstart.com/c.gif	nv8401986_110422.exe, 00000000.00000002.3297208007.000000000CD08000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstoreo0	nv8401986_110422.exe, 00000000.00000003.2017309772.0000000000866000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehp/?ocid=iehp...1.png	nv8401986_110422.exe, 00000000.00000002.3276474159.000000000406B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/?ocid=iehp3.6.3.min.jsmillis:	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/pr-3693935/IE11NTP/desktop-shape.pngMC	nv8401986_110422.exe, 00000000.00000002.3284974365.000000000B0B5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://c.msn.com/K	nv8401986_110422.exe, 00000000.00000002.3280405240.0000000006B6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.	nv8401986_110422.exe, 00000000.00000002.3295256133.000000000CAB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/?ocid=iehphttps://www.msn.com/?ocid=iehp	nv8401986_110422.exe, 00000000.00000002.3285524155.000000000B3C3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://w.nanweng.cn:80/qy/lqnrps0sid360softtm1689880905type20uid102e1490f0604c078f675cf9899bc6e6ver6	nv8401986_110422.exe, 00000000.00000002.3276474159.00000000040EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-autopush.corp.google.com/	nv8401986_110422.exe, 00000000.00000003.2016283703.000000000082B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/fr-ch/actualite/other/Mentions-l	nv8401986_110422.exe, 00000000.00000002.3296835768.000000000CCA6000.00000004.00000800.00020000.00000000.sdmp, nv8401986_110422.exe, 00000000.00000002.3285360334.000000000B130000.00000004.00000020.00020000.00000000.sdmp, experience.b374b0d5b40196862f17[1].js.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
47.103.45.17	w.nanweng.cn	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583791
Start date and time:	2025-01-03 15:25:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nv8401986_110422.exe
Detection:	MAL
Classification:	mal100.adwa.spyw.evad.winEXE@1/81@12/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 729 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.254.14, 2.23.227.208, 2.23.227.215, 2.23.227.221, 204.79.197.203, 2.23.209.23, 2.23.209.15, 2.23.209.12, 2.23.209.13, 2.23.209.20, 2.23.209.17, 2.23.209.21, 2.23.209.16, 2.23.209.19, 13.74.129.1, 20.50.80.213, 13.107.21.237, 204.79.197.237, 40.126.32.134, 20.190.160.17, 40.126.32.74, 20.190.160.22, 20.190.160.14, 40.126.32.136, 40.126.32.68, 40.126.32.133, 2.18.64.8, 2.18.64.22, 52.140.48.131, 204.79.197.222, 184.28.90.27, 52.149.20.212, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): fp.msedge.net, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, p-static.bing.trafficmanager.net, ak.privatelink.msidentity.com, e11290.dspg.akamaiedge.net, a-0019.a-msedge.net, go.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, ma1prdapp01-canary.southindia.cloudapp.azure.com, r.bing.com, a-0019.standard.a-msedge.net, a4.bing.com, 1.perf.msedge.net, login.mso.msidentity.com, e28578.d.akamaiedge.net, akam.bing.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, r.bing.com.edgekey.net, www.tm.ak.prd.aadg.akadns.net, a-0003.a-msedge.net, onedscolprdneu08.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, c.bing.com, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, akam.bing.com.edgekey.net, global.asimov.events.data.trafficm
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:25:53	API Interceptor	50x Sleep call for process: nv8401986_110422.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
47.103.45.17	Reflective.dll	Get hash	malicious	ReflectiveLoader	Browse	w.nanweng.cn/qy/fb
18.244.18.122	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
151.101.194.137	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://facebooksecurity.blogspot.pe/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	https://t.co/jNNzVU90SA	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://realpaperworks.com/wp-content/red/UhPIYa	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://share.hsforms.com/1ERkb7-8BRoi6cEFhMJVsvgt08ok	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://www.ecorfan.org/	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://bitl.to/3Y0B	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.66.137
	01012025.html	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	25F.tmp.exe	Get hash	malicious	Darkbot	Browse	151.101.2.137
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	151.101.2.137
	EFT Payment_Transcript__Survitecgroup.html	Get hash	malicious	Unknown	Browse	151.101.2.137
w.nanweng.cn	Reflective.dll	Get hash	malicious	ReflectiveLoader	Browse	47.103.45.17
	SEMqjw.exe	Get hash	malicious	Unknown	Browse	47.102.38.15
	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Get hash	malicious	Unknown	Browse	47.102.38.15
sb.scorecardresearch.com	over.ps1	Get hash	malicious	Vidar	Browse	18.244.18.27
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	18.244.18.38
	25F.tmp.exe	Get hash	malicious	Darkbot	Browse	18.244.18.38
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	18.244.18.122
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	18.161.69.30
	Hwacaj.exe	Get hash	malicious	Darkbot	Browse	18.161.69.8
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	18.161.69.117
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	18.165.220.110
	installer.bat	Get hash	malicious	Vidar	Browse	18.165.220.106
	skript.bat	Get hash	malicious	Vidar	Browse	18.165.220.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	1.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	8.130.94.218
	http://47.100.36.233:58765/template/	Get hash	malicious	Unknown	Browse	47.100.36.233
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	139.252.21.15
	45631.exe	Get hash	malicious	Nitol	Browse	39.103.20.59
	45631.exe	Get hash	malicious	Unknown	Browse	39.103.20.59
	Hilix.m68k.elf	Get hash	malicious	Mirai	Browse	8.155.218.222
	1735021454574.exe	Get hash	malicious	Unknown	Browse	120.78.149.238
	1734098836319.exe	Get hash	malicious	BlackMoon	Browse	39.103.20.61
	armv4l.elf	Get hash	malicious	Unknown	Browse	59.82.127.195
AMAZON-02US	154.216.18.23-boatnet.arm7-2025-01-03T11_41_00.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	http://www.klim.com	Get hash	malicious	Unknown	Browse	3.64.24.94
	l3v0.exe	Get hash	malicious	Unknown	Browse	3.107.255.174
	1111.hta	Get hash	malicious	Unknown	Browse	185.166.143.50
	https://d25mwe2145ri5.cloudfront.net/installer/33365003/2056290341532614624	Get hash	malicious	Unknown	Browse	18.239.15.218
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	powerpc.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
FASTLYUS	https://t.co/jNNzVU90SA	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://www.klim.com	Get hash	malicious	Unknown	Browse	151.101.2.133
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.199.108.133
	http://4.nscqn.dashboradcortx.xyz/4hbVgI3060FFjU163rczgakrldw288HJUBSXEIQRWLNTA425583MYLP8076x12	Get hash	malicious	Unknown	Browse	151.101.2.132
	mierda.txt.py	Get hash	malicious	Unknown	Browse	151.101.67.6
	http://hotelyetipokhara.com	Get hash	malicious	Unknown	Browse	151.101.67.1
	https://realpaperworks.com/wp-content/red/UhPIYa	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://boir.org	Get hash	malicious	Unknown	Browse	151.101.2.133
	https://share.hsforms.com/1ERkb7-8BRoi6cEFhMJVsvgt08ok	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://ntta.org-pay-u5ch.sbs/us/	Get hash	malicious	Unknown	Browse	151.101.66.49

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	adguardInstaller.exe	Get hash	malicious	Unknown	Browse	18.244.18.122 151.101.194.137
	adguardInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	18.244.18.122 151.101.194.137
	RisingStrip.exe	Get hash	malicious	Vidar	Browse	18.244.18.122 151.101.194.137
	adguardVPNInstaller.exe	Get hash	malicious	Unknown	Browse	18.244.18.122 151.101.194.137
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122 151.101.194.137
	Setup.msi	Get hash	malicious	Unknown	Browse	18.244.18.122 151.101.194.137
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	18.244.18.122 151.101.194.137
	file.exe	Get hash	malicious	XRed	Browse	18.244.18.122 151.101.194.137
	file.exe	Get hash	malicious	XRed	Browse	18.244.18.122 151.101.194.137
	file.exe	Get hash	malicious	XRed	Browse	18.244.18.122 151.101.194.137

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.396853998737204
Encrypted:	false
SSDEEP:	3:OvyQnoSD4Vy:OKQnoSD4Vy
MD5:	38826EAD1C12921FFA502F4F0C540746
SHA1:	68B0C1B5FA6035E17459022565CAB4A3C1B2D72B
SHA-256:	577627FE50C90D9AFA863C2405B741AE79462F59E72F9928744EB031051C8B72
SHA-512:	321E1E69F647545A26B7268D463A17CBA3F1EFA8405B1C0DC1E1AF5C5A34A3A49CB0860CFC0F538E8BBEB6A197049BCCA1714FEC29B0B7E36DA364F489F9881F
Malicious:	false
Reputation:	low
Preview:	[info]..time=2025-1-3..round=1..install=0..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\UXDTP1YG\www.msn[1].xml

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	4.975928782040279
Encrypted:	false
SSDEEP:	3:D9yRtFwsSxzqC+eAsOFETYHFk6rZFFCqTUDTyWLKb:JUF+FqCqdFFrFMDTXub
MD5:	8A5FFA326AADE4413DB37A2C29CF8496
SHA1:	D54CCDDC42468F8DBD628434294A68C319C69805
SHA-256:	233BAA509A6C309459494F8A77868E1CC3F1E5F96724D6809495EFADAD0E54F2
SHA-512:	D386E85CACAB6C2F75E0553051377EBBFEB296592C25B6ED99A84A56A61A6A857F95A2CF5D4D1E9FE6ECDF618DFD5433950AF7FC5F4B1A0ABDBCF8EB106422AB
Malicious:	false
Reputation:	low
Preview:	<root><item name="pageVersions" value="{"hp":"20241220.296"}" ltime="1759250672" htime="31153643" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\5WG_kDsbFabhsuv_6NwDoh2LdnI.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (684), with no line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.166363591063823
Encrypted:	false
SSDEEP:	12:2Q12lkSF3mVwl/BJWhuSpOYkM3+Pu1w2E1fNPrQ5uj5lD+QgAjTYCXPrQuN:2Q1QkSFr5BJupODpfPrQ8Dn/XPrQuN
MD5:	C1D04951E98B892931D4C2BC34555057
SHA1:	55E6297F3499B4961C8E956F7F088868CD59C769
SHA-256:	7C317940549467B3210D2F72DA000BAC3481ABFDE3AC5358D398EB64DCBC8532
SHA-512:	D427487C00AF5E8D9DB222F8A01521A5C8646AE8E459D517443DAC8EF2DBEC2DDEA91877B095B82CF3E52031E1650C7360811ED8A06E02F85E3517974D36AD96
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	(function(){var n,i=(new Date).getTime(),t=_G!==undefined&&_G.RTO!==undefined?_G.RTO:null,r=((n=_G===null\|\|_G===void 0?void 0:_G.EF)===null\|\|n===void 0?void 0:n.infrefcflog)===1;t!=null&&(window.history.scrollRestoration="auto",document.addEventListener("visibilitychange",function(){if(document.visibilityState==="visible"&&window.location.href.indexOf("/search")>=0&&(new Date).getTime()-i>t&&(Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Active"),!r)){var n=window.location.href+(window.location.href.indexOf("dayref=1")<0?"&dayref=1":"");window.location.href=n}}),typeof setTimeout!="undefined"&&setTimeout(function(){Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Inactive")},t))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66dJc2rUgPuuUEbsa_gjcd_o3GE.gz[1].css

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (44213), with no line terminators
Category:	dropped
Size (bytes):	44213
Entropy (8bit):	5.4731108865747
Encrypted:	false
SSDEEP:	768:j3K3FC6AwneAIzFn94868I8GuK6HoxT7TbIuw9bNL6rb:bn4t3DOoxL//
MD5:	E917BC77D3F53468F4A6C9D7AF562B04
SHA1:	197D47F29FF3DBB36A888941750195742E6B6FDB
SHA-256:	AB1A27D51C348A05766BF4ADCF53206A5CC77992246BF28ED15E2F9F6930928D
SHA-512:	200F358305578EE7F0B23F985AADD58EF507CD9AC07BCFC8DB7DDD7D48D2CCD1528B5C8B3A20A11DCAF951CAF84781E5A838BA0F5DF9C3C3D843F084FF2F7E94
Malicious:	false
Preview:	#sw_as .sa_drw{margin:0}#sw_as .sa_zis_parent li.sa_sg,#sw_as .sa_as .sa_sg,#sw_as .sa_as .as_msbsugcontainer.as_msb_page_home{cursor:pointer;display:flex;height:30px;align-items:center;gap:12px;padding:0}#sw_as .sa_as .sa_drw.sa_drw_zis li.sa_sg.sa_ent,#sw_as .sa_as .sa_sg.sa_ent{padding-top:5px;padding-bottom:5px;height:30px}#sw_as #sa_ul:not(:has(div.sa_ent_nrml)) .sa_tm_mainText.sa_tm_rich{font-weight:bold}#sw_as .sa_as #sa_ul li.pp_tile:not(.pp_sTile){padding-left:50px}#sw_as .sa_as .sa_drw .sa_sg_icon_area{width:30px;height:30px;flex-shrink:0;margin-left:8px;margin-right:0}#sw_as .sa_as .sa_sg_icon_area .sa_sg_icon{margin-top:6px}#sw_as .sa_as .sa_sg_icon_area .sa_sg_icon_rrq_fnf{margin-top:9px}.sbox .sb_form #sw_as div.sa_as:not(.sa_nw) #sa_ul.sa_drw .sa_sg .sa_tm,.sbox_cn .sb_form #sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,.sbox .sb_form #sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,#sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,#sw_as .sa_as #sa_ul .sa_tm_mainText{margin:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\GJDmKr3_TS3Qpm6KEL9UKUQKUO4[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\J0K33CCW.htm

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	HTML document, ASCII text, with very long lines (58445), with CRLF line terminators
Category:	dropped
Size (bytes):	193268
Entropy (8bit):	5.451031497742737
Encrypted:	false
SSDEEP:	3072:crfyd5FO93Qiq6I8khsNyh/P9OZ8TixYE:crfyA93Qx6I8hNyhX91OxYE
MD5:	B13B18DAD52C999261F2110E7C6CD891
SHA1:	A5603362DDE7C02274D03D7515890B2586E79208
SHA-256:	AF0B0E268CE339A24A1855E5139D18BE86D7C98185DB8E0D8EFE7F9C5F53AA78
SHA-512:	A7851AB09FCC339EC8877F53654532635C3C7FCCBD1C4766939677D47472A3221116E066D0A1A487AAC069B7E1B9CDD07A24DB459E24F794B77035F6E73DDD31
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-eshbtntrtfac-c,prg-msn-blsbidm,1s-pnpsnicert,pnpwxexpire60,prg-1sw-rpdlaunch-3,1s-wpo-pr1-cttu,prg-cg-crosaloc1,routegraphexp,prg-adspeek,prg-pr2-widget-tab,1s-p2-ignorecm,f-rel-allc,1s-fcrypt,prg-1s-wtch-mg3c,1s-ntf1-hldprrank,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_c,prg-pr2-pred-dyf,chatn_v2_t1,1s-notifmapping,1s-shp-rc-t-addu3,1s-shp-rc-ta-addu3,1s-shp-rc-ta-after1,prg-sh-frnr,prg-wx-dhgrd-c,prg-sh-dealsdaypdp,prg-sh-rmitmlnk,nopinglancecardit,prg-cg-ingames-ct,prg-1s-workid,1s-temp-wid-t,prg-1s-twid,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\P2A3uGO2O64dixlm8-ndJ5_iyo4[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (2169), with no line terminators
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	5.302641155413102
Encrypted:	false
SSDEEP:	48:1cLdSF8cWOr7dDv8NQtaPVcbnAhaNaswAUbDdDLpmhMi7WViUCS7SDDRb:1cZSDBdDv8saMPgHfLEM8Xb3Rb
MD5:	61533293909D97252C70E82BD574BA68
SHA1:	7408DD25C19AE7BAF954074576A2F73FBB174310
SHA-256:	99EC639C3DDC51E7882FAB9C08EC5A905B49F4B04D1C47B6DF40F3924E81CD8E
SHA-512:	BF8F8879D1CABD6B8B9C6CAF9FC0A6F68362FC62328112636D78A15A4C08B35EA52E1DD8048715F2BD0E945BB0D2D8D7655E68A065942E89316E303BB536BB41
Malicious:	false
Preview:	(function(){function l(n){return parseFloat((_w.getComputedStyle?_w.getComputedStyle(n):n.currentStyle).width)}var a="results_container",t="sb_shr sw_conv",v="sb_shr sw_conva",y={"ans2 ans_n2 ans_msnO":1},i={"sb_h3 cttl":1},r="sb_ltw",p="sb_ans",n=[],u=!!_G.SPSA,f=u?{ansC:1,results:1,sa_bop:1}:{results:1},e=!1,o=20,w=-28,b=function(){if(typeof _d.querySelector!="undefined"){var n=".sb_shr{left:"+w+o+"px;width:0;float:right;margin-left:5px}.sb_ltw{margin:0 0 0 -55px;clear:both;float:left;display:block;width:50px}.pi_tc{float:right;}";sj_ic(n);sj_evt.bind("sp.enter_conv",g,1);sj_evt.bind("sp.leave_conv",h,1);sj_evt.bind("sp.submit_conv",h)}},k=function(){var u,o,i,n,s,r,t,h;if(!e){for(u=_ge(a),o=u?u.childNodes:[],i=0;i<o.length;i++)if(n=o[i],n.id&&f[n.id]\|\|n.className&&f[n.className])for(s=n?n.childNodes:[],r=0;r<s.length;r++)for(t=s[r].firstChild;t;)h=t.nodeType,h!==3&&h!==8&&d(t),t=t.nextSibling;e=!0}},d=function(n){var i=n.className,t;if(i&&i.indexOf(p)>-1){if(u)for(t=n.firstChild.fir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\SO02eTikN8ZV7bCSXFKur4CKSoQ.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\e1HSyVFyJooWdBqZJqsmOfZmunU.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1333), with no line terminators
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	5.118534997873121
Encrypted:	false
SSDEEP:	24:PlQiztVfI2TdzmkUamV2an3pQ8TIOKEKzbkzER8zXOvD6AYlNyUEr040x0e0v0tn:NQ6rGNIyAbAEuzYDCN2rnWJQSya
MD5:	EEE13BD45C83C7611E9E36689E385FBD
SHA1:	5EA35979E3AC518291E4D7179F417971FD0DC874
SHA-256:	E1DCAF1B7BB92C803802ABAB8D544D277ABF34C06693BD2B83BB598C0DBC7496
SHA-512:	1361145E4C71FC176F76AE84D96F057F8DFA7461FB4926B779F3C059B7C6C8E4BCEFA9B883309D3C3AE6895570F293BF6EEC5374C242C48019CBD6202D4D0373
Malicious:	false
Preview:	var CaptionClickable;(function(){function t(){for(var i,r=document.querySelectorAll(".b_caption"),u=document.querySelectorAll(".b_imgcap_altitle"),t=0;t<r.length;t++)i=r[t],i&&n(i);for(t=0;t<u.length;t++)i=u[t],i&&n(i)}function n(n){var t=n.previousElementSibling,f,e,o,u,r,s;if(t&&(f=null,t.tagName==="H2"\|\|t.querySelector("h2")?(e=t.tagName==="H2"?t:t.querySelector("h2"),e&&e.querySelector("a")&&(f=e)):t.tagName==="H3"\|\|t.querySelector("h3")?(o=t.tagName==="H3"?t:t.querySelector("h3"),o&&o.querySelector("a")&&(f=o)):f=n.querySelector("h2, h3"),u=n.querySelector("p"),f&&u&&i(u.classList)&&(r=f.querySelector("a"),r))){if(u.addEventListener("mouseover",function(){r&&(r.style.textDecoration="underline",n.style.cursor="pointer")}),u.addEventListener("mouseout",function(){r&&(r.style.textDecoration="",n.style.cursor="")}),s=u.parentElement,s&&s.tagName==="A")return;u.addEventListener("click",function(){if(r){_w.si_T&&_w.si_T(r.getAttribute("h"));var n=window.getSelection();(n===null\|\|n===voi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\f5M90q9eKVXkGU-DAv9Aa4jef2k.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (674), with no line terminators
Category:	dropped
Size (bytes):	674
Entropy (8bit):	5.239693493116514
Encrypted:	false
SSDEEP:	12:GyX+fnReu8VliHMtm5vXuMp4CWhneMNqOgqpsRWc9mMCDBMw0n:GS4Reu+kSkNCnvVgqSRWzAn
MD5:	8D078E26C28E9C85885F8A362CB80DB9
SHA1:	F486B2745E4637D881422D38C7780C041618168A
SHA-256:	0BF9F3AD9CDBBC4D37C8B9E22DD06CC26EEA12A27EF6C0F95DB6CBE930177461
SHA-512:	B808A972CD44E6BDA01AC1F8D904D5A281F33B9238B8CAAB03DECB6ADB6B494B19DD9BB35E3D1EA3CA914FF4957155F6D2CB5A9B3A00C2195F80F52804FFB244
Malicious:	false
Preview:	var LinksColorOnMD;(function(n){function i(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function o(n){if(n.button===0&&!n.ctrlKey&&!n.shiftKey){var f=i(sj_et(n));f&&(Lib.CssClass.add(f,t),r[f.href]=sb_st(function(){u(f)},5e3))}}function u(n){Lib.CssClass.remove(n,t)}function s(n){h(n);var r=i(sj_et(n));r&&Lib.CssClass.remove(r,t)}function h(n){var t=i(sj_et(n)),f;t&&(f=r[t.href],f&&sb_ct(f),e&&u(t))}function f(){for(var n,i=_d.getElementsByTagName("A"),t=0;t<i.length;t++)(n=i[t],n)&&(sj_be(n,"mousedown",o),sj_be(n,"click",s))}var t="b_LinksColorMD",r={},e=sj_cook&&sj_cook.get("SRCHHPGUSR","NEWWND")==="1";n.bind=f;f()})(LinksColorOnMD\|\|(LinksColorOnMD={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\jk2F-rpLS_Gysk7hn3CVhA9oQhY.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.3314854117420465
Encrypted:	false
SSDEEP:	24:2QQ3xVJjKVJ5o7VEioPVKofuVJ0PoRGP2QbAX53CO2Wd6o0YmmBM:AjWUJEhNZsvc8XgO2Wdh0Jm6
MD5:	3FF8EECB7A6996C1056BBE9D4DDE50B4
SHA1:	FDC4D52301D187042D0A2F136CEEF2C005DCBB8B
SHA-256:	01B479F35B53D8078BACA650BDD8B926638D8DAAA6EB4A9059E232DBD984F163
SHA-512:	49E68AA570729CC96ED0FD2F5F406D84869772DF67958272625CBA9D521CA508955567E12573D7C73D7E7727260D746B535C2CE6A3ACE4952EDF8FD85F3DB0DD
Malicious:	false
Preview:	(function(){function i(){var f="data-load",u,i;if(n&&!n.hasAttribute(f))try{if(_d.body.appendChild(n),typeof sj_gx=="function"){if(u=r.replace("%IG%",_G.IG).replace("%IID%",n.getAttribute("data-iid")).replace("%PARTNER%",n.getAttribute("data-ptn")).replace("%ENABLEP%",n.getAttribute("data-ep")).replace("%ICONPRELOADED%",n.getAttribute("data-iconpl")),n.setAttribute(f,"1"),i=sj_gx(),!i)return null;i.onreadystatechange=function(){typeof sj_appHTML=="function"&&4==i.readyState&&200==i.status&&sj_appHTML(n,i.responseText)};i.open("GET",t?SbiTst.at(u):u,!0);i.send(null)}}catch(e){}}function u(){if(n){var r=n.getAttribute("data-evt");r&&!t?sj_evt.bind(r,i,!0):i()}}var r="/images/sbi?mmasync=1&ig=%IG%&iid=%IID%&ptn=%PARTNER%&ep=%ENABLEP%&iconpl=%ICONPRELOADED%",n=_ge("sbicom_loader"),t=typeof SbiTst!="undefined";u()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\jquery-3.6.3.min[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89947
Entropy (8bit):	5.290839266829335
Encrypted:	false
SSDEEP:	1536:ENjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkm4M5gPtcNRQK:EcqmCU3zhINzfmR4lb3e34UQ47GKL
MD5:	CF2FBBF84281D9ECBFFB4993203D543B
SHA1:	832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC
SHA-256:	A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
SHA-512:	493A1FE319B5C2091F9BB85E5AA149567E7C1E6DC4B52DF55C569A81A6BC54C45E097024427259FA3132F0F082FE24F5F1D172F7959C131347153A8BCA9EF679
Malicious:	false
Preview:	/! jQuery v3.6.3 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\kzHfYwAwahpHm-ZU7kDOHkFbADU.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\lvCKZ07bEYtoYmY62ifMzVa0RIE[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mobile-image[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23972
Entropy (8bit):	7.983082688064765
Encrypted:	false
SSDEEP:	384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
MD5:	64C4757048F068394817EE126FDBA8A6
SHA1:	3610DC2EB5E3C09809E94BD0694A06C7A51580FF
SHA-256:	A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
SHA-512:	373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
Malicious:	false
Preview:	.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........\|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;\|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ni3MyKKVu9pK0SgY6gb6Z2NOGpg[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pXVzgohStRjQefcwyp3z6bhIArA.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sgLr8Y4mVJegkevNnGDcMsbaTiI.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (902), with no line terminators
Category:	dropped
Size (bytes):	902
Entropy (8bit):	5.200751776659475
Encrypted:	false
SSDEEP:	24:Hl7/nJ4aZUv+MW/sRdrwq50n+pM12vk1Q4W3Idc4Wn:d/Caq+M93H5kOaC3Idmn
MD5:	76ED74A9FD9A74443976389C069CC74A
SHA1:	03AE45E49077B7D87D7FCC434574BA49F95664E3
SHA-256:	B443A3D58AEC4919E37DF4629F8C759A43091B1F63B5A815F8052DF0D8D46804
SHA-512:	D2D13DA2F47C2E94DB3A3B9B6F5185C8352268B1D336BAAA856177BE4B098535BD71BC53819FC73C0F4970DABCB7ECC7F375B4DEB1C25B25474551204B6921F4
Malicious:	false
Preview:	var HeaderPlusAlgo_Selector;(function(n){function e(n){for(var u,l,h,e=[],c=t(sj_b.querySelectorAll(f+(n?", :focus":""))),s=0;s<c.length;s++)u=c[s],u.className.indexOf("b_ans")!=-1\|\|u.id=="b_pole"?(l=t(u.querySelectorAll(r)),l.length==0&&(h=o(u),h&&e.push(h))):i(u)\|\|e.push(u);return e}function t(n){for(var i=[],t=0;t<n.length;t++)i.push(n[t]);return i}function i(n){if(n){var t=window.getComputedStyle(n);return t&&t.display=="none"?!0:i(n.parentElement)}return!1}function o(n){for(var r,e=t(n.querySelectorAll(u)),f=0;f<e.length;f++)if(r=e[f],!i(r)&&r.tabIndex!=-1)return r;return null}var r="#b_results h2 a,#b_results h3 a,#b_results h4 a",u="input, select, textarea,a[href],*[tabindex = '0']",f=r+",#b_results .b_ans,#b_content #b_pole,#b_content #b_topw";n.getSelectableElements=e})(HeaderPlusAlgo_Selector\|\|(HeaderPlusAlgo_Selector={}));NavSelector=HeaderPlusAlgo_Selector.getSelectableElements

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\w1gdrM6p5Kmzh4Gi9fKcTaefJ1s.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1039), with no line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.394520629964255
Encrypted:	false
SSDEEP:	24:AaV1T141S2BjoljiHXdX4daXOcRWOkDqBlg:AK41PjEjiHKKwOjXg
MD5:	16050BAAF39976A33AC9F854D5EFDB32
SHA1:	94725020EFA7D3EE8FAED2B7DFFC5A4106363B5E
SHA-256:	039E6B3DF1D67341FB8E4A3815F0D1BB3292A2040334CEB9CFC4A8D6ABF2FB55
SHA-512:	CF0D54F0368FFBC6908216FD2573DF8F5FE4C34AC08E17301B8734B3FABC674672A7F456707F632F82F44B36812DAD8A0CF81A51D5CEA21EA7F0E18500298375
Malicious:	false
Preview:	var UetTag;(function(n){function t(n,t,i,r,u){var e,o,h,s,v,f,c;i===void 0&&(i="script");r===void 0&&(r="//bat.bing.com/bat.js");u===void 0&&(u="uetq");var y=n.location.search.substring(1),l=y.split("&"),a="";for(e=0;e<l.length;e++)if(o=l[e].split("="),o.length>=2&&o[0]==="form"){a=o[1];break}for(h=["MSC001","MSC002","MSC003","MSC005","MSC006","MSC007","MSC008","MSC009","MSC010","MSC011","MSC012","MSC013","MSC014","MSC015","MSC016","MSC017","MSC018","MSC019","MSC020","SP0001","SP0002","MOG001","MOG002","MOG003","MOG004","MOG005","MOG006","MOG007","MOG008","MOG009","MOG010"],s=0;s<h.length;s++)if(h[s]===a){n[u]=n[u]\|\|[];v=function(){var t={ti:"355015334",q:null};t.q=n[u];n.UET&&(n[u]=new n.UET(t)\|\|[]);n[u].push("pageLoad")};f=t.createElement(i);f.src=r;f.async=1;f.onload=f.onreadystatechange=function(){var n=this.readyState;n&&n!=="loaded"&&n!=="complete"\|\|(v(),f.onload=f.onreadystatechange=null)};c=t.getElementsByTagName(i)[0];c.parentNode.insertBefore(f,c);break}}n.uetTaggingInit=t;t(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\95z5wMy4UcfbSSSlSw780vQ5jKA[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\DEjxwvkpxv2TrYEFLbNhRWrxeFg.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1833), with no line terminators
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	5.03858600819449
Encrypted:	false
SSDEEP:	48:Jk08PkQix8QboQO7cxfFb87c9nH40VtN3HCBuNDbHNxpA:sPb6oZY80tVbHDtTA
MD5:	D7365C424E30CB142A85B84C0618D671
SHA1:	7212FE88CD0686A381ACB1B0583A544AE3ADA1B0
SHA-256:	8FD0225B5F75EE2326ADC68A10F5B9FC50C30A45BF4B61C7EE9364103E6102C8
SHA-512:	26D9A5DA2CC591954C6014B4DE1826653C9F058E9C8287342D8F0F2C9960BDAF30E1D4F8ADDF529830327D94C8BCA21848A3ADAF2846036A5E9C618992B18D5F
Malicious:	false
Preview:	var ExtendIconClickTargetV2;(function(){function n(){var u=document.querySelectorAll(".b_tpcn"),e,r,f,n,i,t;if(u)for(e=function(n){var r=u[n],i,t,f;if(r&&(r.onclick=function(n){if(!n\|\|n.target===r){var t=r.querySelector(".tilk");t&&(_w.si_T&&_w.si_T(t.getAttribute("h")),t.click())}},i=r.nextElementSibling,i&&(r.addEventListener("mouseover",function(){r.style.cursor="pointer";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="underline")}),r.addEventListener("mouseout",function(){r.style.cursor="";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="")}),t=i,!t\|\|t.classList&&t.classList.contains("b_title")\|\|t.tagName==="H2"\|\|t.tagName==="H3"\|\|(t=t.querySelector("h2, h3")),t))){if(f=t.querySelector("a"),!f)return{value:void 0};t.addEventListener("mouseover",function(n){n&&n.target===t&&(t.style.cursor="pointer",f.style.textDecoration="underline")});t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\LI6CzlNYU7PeZ9WzomWpS4lm-BI.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1580), with no line terminators
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.0552055236738624
Encrypted:	false
SSDEEP:	24:CFIaycqwxXvP6D0oagJXOd9TFlk2g8y7t/agPeC2RWgRWK5RWtYFGNKlZxvNGb30:5apDEDM8P2wgwK5wtnwlnNGbBpfGbVjN
MD5:	56AFA9B2C4EAD188D1DD95650816419B
SHA1:	C1E4D984C4F85B9C7FB60B66B039C541BF3D94F6
SHA-256:	E830AEB6BC4602A3D61E678B1C22A8C5E01B9FB9A66406051D56493CC3087B4B
SHA-512:	D97432E68AFDAA2CFAEFF497C2FF70208BD328713F169380D5AFB5D5EECD29E183A79BEC99664DBEE13FD19FE21EBAE7396315AC77A196BFB0AB855507F3DACF
Malicious:	false
Preview:	var Lib;(function(n){var t;(function(n){function u(n,t){var r,i;if(t==null\|\|n==null)throw new TypeError("Null element passed to Lib.CssClass");if(n.indexOf)return n.indexOf(t);for(r=n.length,i=0;i<r;i++)if(n[i]===t)return i;return-1}function f(n,u){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. add className:"+u);if(!r(n,u))if(i&&n.classList)n.classList.add(u);else{var f=t(n)+" "+u;o(n,f)}}function e(n,f){var e,s,h;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. remove className:"+f);r(n,f)&&(i&&n.classList?n.classList.remove(f):(e=t(n).split(" "),s=u(e,f),s>=0&&e.splice(s,1),h=e.join(" "),o(n,h)))}function s(n,t){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. toggle className:"+t);i&&n.classList?n.classList.toggle(t):r(n,t)?e(n,t):f(n,t)}function r(n,r){var f,e;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. contains className:"+r);return i&&n.classList?n.classList.contains(r):(f=t(n),f)?(e=f.split("

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\PgVOrYqTvqK49IEnVEVlZVYfA1U.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\T3t6V3azgG4BlSRcguR2ssuUOxQ[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 60 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.812007487462295
Encrypted:	false
SSDEEP:	24:2YvL3J/eQWCXbwIoGryAFXt3jwRDa9W3TH:Rv1NHUIbrzU3TH
MD5:	2AA8CAB3D7B05D1540A69E6DA11C916B
SHA1:	4F7B7A5776B3806E0195245C82E476B2CB943B14
SHA-256:	BE40B55ED2C02CA68A1527E8B50CB949FFF17EC444504F9ABCE98C97EBAD1738
SHA-512:	FEC6CD89DA1CC4630A229567101F83D979860F6CDF34FEA00174052FDEE93F00F8F0AA489C565F6CD1BCEE3124DFCB1DCE9418FBA7B3983EF6F6946C8689B241
Malicious:	false
Preview:	.PNG........IHDR...<.........=P.D....IDATx..?LSA.......J(......YcY\.......%&n.XD....X...N..Q...US.IL...z.?.?.}..I.......~w....Jv..Q..........8M...6..%..X.u....\.f.X..>u.d..E.+b6.P4.].........W.}t..jc......^.....p.).".U.H...y...i...Fz......a`.,Gr.8XP.K3@./.U...+........d`.;...,...{.U.s.:...<O......~..'.8#{...5....9...../."S.....9...Nr<=.u57.?G.a.x......}.....6n=W.3}...(.QV....y..R..G`.J...5....h.R.Z).:8.../5.%&..9..M...jQ.V?..[-E...........-....1.[!....)Ml].i.I. 8.).A.aiE./0.C'.P...v.....e(.....;...E...i..D....ea.#.3)..h..&,...Y..$-G......G...IY..T...mP.5?l...5w..t....m.O6........o(...f.k..Q5.....A.....S.......s.D..R.....^..{o..~..a...X....Z.I..Z./m...$....\..2O.$%.3;....)..m...}h.l....&.OPq.k......T.:q.E.p"".....{V.$/4a9.G.4.E..1..{... Y.....:3.9.&m..Z...k.'........v.\.e...y+.L..%..{..8..E..R&....[I.P......0.u/#.......f......e....H'.v..qp..J.w..}e..,..@....7Sjd.$aW......o.'R...L.#...0....K..rT`>>......Y2..,...!.......T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UiCBzdqhH8tMlfayZdAijZAB5sE.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (918), with no line terminators
Category:	dropped
Size (bytes):	918
Entropy (8bit):	5.212381384143468
Encrypted:	false
SSDEEP:	24:i2387E/Xv3qtMbKRgibYe9BqoGbKR7oGbY7oGbnewCY0ZWFU0fZy5c6MwQOR:dqtMbK7bLrGbKuGbjGbnXTWWSr5c6MwV
MD5:	341FC0ACD15DF6D8A064E4C3A896F65D
SHA1:	1258FD48A874D80CB635BE454F9E4023A0DF7C49
SHA-256:	4BC6635D4D95F9C05A91904B19370A40CC6E4C2AB43661C00615EDDADEFCF9EB
SHA-512:	6B552D786E782C36F17BEE1A6AE204F1E8C9F85BE5EB9ADAC1793D60B537CAD13228CB2D4299949F051E6BC364C2E5A4105DE9BBF2885F492EDB425CB14CE982
Malicious:	false
Preview:	var KeyPressScroll;(function(){function i(i){var u=i.key,f=document.activeElement,r,e,o;document.querySelector("cib-serp[mode='conversation']")\|\|document.querySelector(".b_selected")\|\|typeof i.composedPath=="function"&&(r=i.composedPath(),r&&r[0]&&(r[0]instanceof HTMLInputElement\|\|r[0]instanceof HTMLTextAreaElement))\|\|i.ctrlKey\|\|i.shiftKey\|\|i.metaKey\|\|i.altKey\|\|!u\|\|u.length!==1\|\|u===" "\|\|f instanceof HTMLInputElement\|\|f instanceof HTMLTextAreaElement\|\|f instanceof HTMLElement&&f.isContentEditable\|\|(typeof sj_log=="function"&&sj_log("CI.KeyPressScroll","KeyBoard_Triggered",u),n.value="",t.scrollIntoView({behavior:"smooth"}),t.style.display="block",e=_ge("sb_form"),e&&Lib.CssClass.remove(e,"form_sb_hidden"),n.focus(),n.click(),o=n.value,n.setSelectionRange(o.length,o.length))}function r(){n&&t&&sj_be(document,"keydown",i,!0)}var n=_ge("sb_form_q"),t=_ge("b_header");r()})(KeyPressScroll\|\|(KeyPressScroll={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\bgNvw2gj4n0x2fVy9WAk0RbfPQQ.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (34732), with no line terminators
Category:	dropped
Size (bytes):	34732
Entropy (8bit):	5.452487645923916
Encrypted:	false
SSDEEP:	768:+J0AmB7aPmB7aU1THyBVyD3NSrGyDQS+mZvUhM/4S8SrmB:+aaUaJCDA3DjHZv37n6
MD5:	E4FB9B839186660B1F729B8DF8C994B4
SHA1:	931792CD70CED4AD586F6329C30C294EBEA1548E
SHA-256:	6838611C8AB6539005E11C84CA308158F89A51DB57A62CAF21FAAB48BF576177
SHA-512:	625436BB52CBD7DF7ED03BE05FEA52C5D54B6CC15037D70C268D9598E648A22246DB902B9C6F097BA8B18BD924F6AB17120736285D54DCE13773237F1669853A
Malicious:	false
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",w="_RwBf",b="rwmrst",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redDotImage.png",k=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible,hasUsedCcpTrial:n&&n.RewardsSessionData&&n.RewardsSessionData.HasUsedCcpTrial}}re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\byLmVJQA1UzOFcrs9Jrvys4jXhM.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1725), with no line terminators
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.274895734185393
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8A47n0dvZ1fj5O7Rv75gZcODcv/Kum65X9gFiO5yV94GVvwCQO:7Lps4YJOVuK2KG65tggZV5
MD5:	2EF3074238B080B648E9A10429D67405
SHA1:	15D57873FF98195C57E34FC778ACCC41C21172E7
SHA-256:	E90558EB19208AD73F0DE1CD9839D0317594BF23DA0514F51272BF27183F01DA
SHA-512:	C1D7074A0EBF5968B468F98FC4C0C7829999E402DD91C617E679EEB46C873DC04096CBF9277E115FC42C97516A6C11A9F16AFA571E00F0D826BEB463E2D1F7B0
Malicious:	false
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var c;u=u\|\|r;var o=_ge("id_rh"),e=_ge("rh_animcrcl"),l=_ge("id_rc");if(o&&l&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var a=800,v=r-n,s=Math.min(100,100(r/u)),h=e&&s>=100&&n<u,y=v>0,p=Date.now();s>=100&&Lib.CssClass.add(o,"rh_reedm");e&&Lib.CssClass.add(e,"anim");c=function(u){if(u){var k=Date.now(),w=k-p,b=Math.min(w/a,1),d=h?tb:ts/100,g=y?Math.min(Math.floor((n+bv)/f)*f,r):r,l=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",d.toString()+","+t.toString());u.innerText=g.toString();(h\|\|y)&&(w<a?i(function(){return c(u)}):(u.i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cTjovfJ8fuNtDtyC0VQH35vgAUI.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2014), with no line terminators
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	5.3161096027675105
Encrypted:	false
SSDEEP:	48:bnXL8sjfZ/Fslrgj3rzIRlK0KqoLi7XSOLFTt+jCz1T9XNZTs3Gan/An0:bnoshqlMQRlZTolKOEXNZsWan/An0
MD5:	D807DBBB6EE3A78027DC7075E0B593FF
SHA1:	27109CD41F6B1F2084C81B5D375EA811E51AC567
SHA-256:	0ACDCE370092C141B0C6617ED6E2163F04BB9B93D3213B62C2BC7A46FE0243C7
SHA-512:	E037DFC31D595B459660FE7D938EEDB4F43D208D247174EE8D6FD0D125F211142CD73497E4601893CECB6F565B7E2E7815CE416D72BB95504D3F277E4E806D11
Malicious:	false
Preview:	var SerpKeyboardNavigation;(function(){function c(){h=_d.activeElement;n=null;u=null;e=!1;t=-1;nt();u=_w.NavSelector&&NavSelector(!1)}function p(){v();n=null}function w(i){var e,h,o;i&&(e=_d.activeElement,h=s&&e&&e.className&&e.className.indexOf("feedback-binded")!==-1,i.keyCode==r.Tab&&s&&(f("TOP"),s=!1),u&&e&&e.className!=="b_searchbox"&&!h&&(i.keyCode==r.Enter?(n=null,f(t==-1?"EN":"EE",t)):b(i)&&(o=k(i.keyCode),o!==-1&&o!==t&&(tt(o),sj_pd(i)))))}function f(n,t){sj_log("CI.SerpKeyboardNav",n,t?t.toString():"")}function b(t){var i,r=(i=_d.querySelector("#b_sydConvCont cib-serp"))===null\|\|i===void 0?void 0:i.getAttribute("mode");return n\|\|h==_d.activeElement?t.altKey\|\|t.ctrlKey?!1:r&&["conversation","notebook"].includes(r)?!1:!0:!1}function k(n){if(n===r.Tab)return d();if(n===r.Down\|\|n===r.Up){var t=document.activeElement;return t&&(t.tagName.toLowerCase()==="select"\|\|t.tagName.toLowerCase()==="input")?-1:g(n===r.Down)}return-1}function d(){var i=-1;return n?(v(),e=!0,t=-1,f("TO")):(i=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cfeVf2-uV0hUo3ToTbLjztuomWk[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\fDgf7Oh5R8mPygWLQcaNRoJGj5Q.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (622), with no line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	5.265947581512117
Encrypted:	false
SSDEEP:	12:2QxhNgpOWEaaRHkj6iLUEkFKgsmqRRV6alt0Tk6iLUEkFkno:2QTepraRHk+i1kFKgsmqRRVZr8k6i1kh
MD5:	3104955279E1BBBDB4AE5A0E077C5A74
SHA1:	BA10A722FFF1877C3379DEE7B5F028D467FFD6CF
SHA-256:	A0A1CEE602080757FBADB2D23EAD2BBB8B0726B82FDB2ED654DA4403F1E78EF1
SHA-512:	6937ED6194E4842FF5B4878B0D680E02CAF3185BAF65EDC131260B56A87968B5D6C80F236C1DE1A059D8158BC93B80B831FE679F38FC06DFB7C3413D1D5355AA
Malicious:	false
Preview:	(function(){function n(){var n=_ge("id_p"),t,r,i;n&&(t="",r="",n.dataset?(t=n.dataset.src,r=n.dataset.alt):(t=n.getAttribute("data-src"),r=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=r},n.src=t,i=_d.getElementById("bp_shortcut_img"),i&&(i.setAttribute("src",t),i.onerror=function(){i.setAttribute("src","data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=")})))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\fHuyi8cU3N_FKljgNDAU8JiBqx0.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (888), with no line terminators
Category:	dropped
Size (bytes):	888
Entropy (8bit):	5.1970220185324045
Encrypted:	false
SSDEEP:	24:2QiCUrgtI/QHnUrtrRIRJ7ea/TwH4Mnbx+yGow0N:SK44AIb/7QUH0N
MD5:	F1CF1909716CE3DA53172898BB780024
SHA1:	D8D34904E511B1C9AAE1565BA10CCD045C940333
SHA-256:	9ABAC0CBFA6F89106B66CD4F698EAD5CCBF615ECF8CD7E9E88567A7C33CFEC01
SHA-512:	8B641E93405565B4A57C051EDEFC8E02D6C929DDD4C52F9BFBD19C57896AA40426BF5ED6760DBD479719561C4F0A25BFC4102F0F49D3D308035C9CA90B1D0FCE
Malicious:	false
Preview:	(function(){function f(){var u=o(),i,t,f;if(u)for(i=s(u),t=0;t<i.length;t++)f=i[t].id.replace(n,""),Log&&Log.Log&&Log.Log("Info",r,f,!1,"Text",t.toString()),sj_be(i[t],"mousedown",e)}function e(t){var r=i(t.target),f;r!=null&&(f=r.id.replace(n,""),Log&&Log.Log&&Log.Log("Info",u,f))}function i(t){if(t!=null){var r=t.id;return r!=null&&r.indexOf(n)===0?t:i(t.parentElement)}return null}function o(){var n=_d.querySelectorAll(".b_scopebar > ul");return n&&n.length>0?n[0]:null}function s(i){for(var r,o,u=[],e=i.children,f=0;f<e.length;f++)r=e[f].id,r!=null&&r!==t&&r.indexOf(n)===0?u.push(e[f]):r!=null&&r===t&&(o=h(),u.push.apply(u,o));return u}function h(){var n=_d.querySelectorAll(".b_scopebar #b-scopeListItem-menu .b_sp_over_menu .b_scopebar_item");return Array.prototype.slice.call(n)}var n="b-scopeListItem-",t=n+"menu",r="DynScopeRank",u="DynScopeClick";sj_evt.bind("onP1",f)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\kAwiv9gc4HPfHSU3xUQp2Xqm5wA[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 1030 x 92, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	7.907965931624856
Encrypted:	false
SSDEEP:	192:qnmErbd5SU2ipCfR6VY9Fcygr2XecqN4zvEd4xSNzvkmglkz80bl7xcnobmP:S5bdAU3EJiHpSucq+z64xSlp40Bx8oKP
MD5:	1947B15739221EB0DB271C1DD8F95E46
SHA1:	900C22BFD81CE073DF1D2537C54429D97AA6E700
SHA-256:	FBF7FE8197902B32CE2C83F05DB73255553C716AC7B084FF1878E617963D0F51
SHA-512:	E73B17A0CCAEA85C539B5DA3BA978EBDA519D68F5686894EBEBBB529DCA54D07CA3508DBCED9D8F56D71D49469FA5916A7255B6CA455E00251D81B5E03410E5C
Malicious:	false
Preview:	.PNG........IHDR.......\.......Gi...sPLTEGpL.e"..?..?..=........................uut.............O..K..J..J..K..K..J..J..M..O..S..O.uux.V..K.....ffffff.I.2..1..%q..>. Y.$d.BFBDDDDDDBGB.K...........K.$i.#a.DDDDDDDDDuww......!\.DDDDDDuwx.J.....\.$g. Z.CCCvvzvxywx{"^.CCCvwywx{vvwvvzwx{vwxxx\|wx{wxzfff%.....$h.DDDCCC.h..[..x.._..S.vvx...9..._.%h.!`.DDD...AHAuwx.R..O.m.cK.}....U.g.c..N.Qs.X..]d..8..&.c...2.....$........#..e....'..h.vw.......XS..i........[..b.rC.H=www...zzz........T..................................J...................qqqqqqqqq.k..m.......413..................vvv....l.......uuu....m..................................................."........".."...\......tRNS..@..@.....` ...p.@.......p .``P.P_.........Z...0........p0_....P0....@@....... .p........"..R..@...0..0..... ...w...0..@.....X.......b.......... `......P@....p1`P.......=............p....D@..M.'.....0....Y.... .IDATx...Ub.@...S.ic.A.....E.....=%0s...^k"..S)..cff.U.en..".FS.Bm.j.m.....&.,.Y.0..........k.E.*U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\kiGH9ukZK6Q4hvtDtwwVc1yvueg[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nt6a1ZR520utsLoZmSYgwxdOPgI[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	5.268639530160161
Encrypted:	false
SSDEEP:	12:hc2AcBdEcv2Csu+IUhIlaq1YkOcAwI98NyeTgy8XTQHY2:hc2AcBSBZacr98XSDuY2
MD5:	0C2672DC05A52FBFB8E3BC70271619C2
SHA1:	9EDE9AD59479DB4BADB0BA19992620C3174E3E02
SHA-256:	54722CF65AB74A85441A039480691610DF079E6DD3316C452667EFE4A94FFD39
SHA-512:	DD2B3E4438A9DEAA6B306CBC0A50A035D9FE19C6180BC49D2A9D8CDBB2E25D9C6C8C5265C640AC362DC353169727F8C26503E11A8A061A2517A303F61D0CCD3C
Malicious:	false
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",f=_w.location.search.substring(1),u=window.data_iid,r,t,e;i+=u&&u.length>0?"?IG="+_G.IG+"&IID="+u+"&"+f:"?"+f;r=window.rw_mqs_cg;r&&r.length>0&&(i+="&cg="+r,window.rw_mqs_cg=undefined);_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();e="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(document.body,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(e)}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tu4B7zHYu6pOPvbqssygkItBFMg.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (15678), with no line terminators
Category:	dropped
Size (bytes):	15678
Entropy (8bit):	5.324358729025482
Encrypted:	false
SSDEEP:	384:90RU0qFPpFQ2cLJoyPKWrEysjXryLnmVyYNnL3/9BD1DdNCgTlPlMHEyM2hluZX7:90RtqppFyoyCcEys7UnpYdv9j2gRPlm8
MD5:	F420F6495D96A09B18AE9C2D2D53663C
SHA1:	89E4AEF1AE72AF0F7730B212577176003EB44BA2
SHA-256:	CB2E879CEE77E2116DA4608857CA8D66A053FADF41C72BA60C1CEE0100DE1EC4
SHA-512:	9FB9C37C154B855314D185AADC055134975E0F7A2703EA362DFC2F8DED589ABA77DC25F006CF004DD193EA68B026BC2B089EC27ADA26C81CA950A83DF0FE154C
Malicious:	false
Preview:	define("ajax.shared",["require","exports"],function(n,t){function r(n){var r=keyMap[n]?keyMap[n]:keyMap.Prefix+n,i=document.getElementById(r),t;return!i&&document.getElementsByClassName&&(t=document.getElementsByClassName(r),i=t&&t.length?t[0]:null),i}function u(n){var f=sj_ce("a"),t,r,u;return f.href=n,t=f.pathname,t[0]!=="/"&&(t="/"+t),t=t.replace(i,"/"),r="",t==="/"?r=t:(u=n.indexOf(t),r=u>-1?n.substr(u):""),r}function f(n,t,i){for(;n&&n!==document;n=n.parentNode){if(n[t]===i)return n;if(n===undefined)break}}var i=/^(\/)(\1+)/;t.useSetBag=!1;t.ajaxUrlBag="";t.getPlaceholder=r;t.getRelativeUrl=u;t.getParentContainer=f});define("ajax.cache",["require","exports"],function(n,t){function w(n,t,i,r){if(n>=0){var u=g(n);switch(t){case"Script":u.ScriptHolder.push(r);break;case"Style":u.Style+=r;break;case"EOS":u.Script=u.ScriptHolder;delete u.ScriptHolder;u[t]=r;c(i,u);break;default:u[t]=r}}}function b(n){var t=sessionStorage.getItem(i+n);return t?JSON.parse(t):null}function c(n,t){_G.JCach

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\uk_UtgpS3Vx82_2KByeueWFHn_Q.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (6526), with no line terminators
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	5.372135202911853
Encrypted:	false
SSDEEP:	192:/CaRENlgVMJhPbrtwyGBdnxEd7NUCuf1bx6gqkJD:aaREXPbOLdxEd7NUnf1twI
MD5:	6904ABA1CE02BB3A01B6550C4BF98A7E
SHA1:	858127221DAF72534247D665BE661A175FAD6DD6
SHA-256:	4492B7EF7F9E30168D8F6410FF6928FCC3019618019116F82B25459B9267B038
SHA-512:	EBD259047BCDED6F925C3184A27D0D197D48B0EE3EBC2C12A27A2C9843B08C551D6DC34C299CD6E4931446F33C1D6BFF3F8CDEB018FB6C614671CF43B6497585
Malicious:	false
Preview:	var WebResultToolboxBlueV2;(function(){function tt(){var n=_ge("b_results"),t=_ge("b_context");(n\|\|t)&&typeof sa_CTBConfig!="undefined"&&sa_CTBConfig&&(r[b]=ot,r[k]=l,r[d]=l,r[g]=c,r[nt]=c,sj_be(sj_b,"click",function(n){u(n)}),sj_evt.bind("onPopTR",function(n){u(n,!0)}),sj_be(sj_b,"mousedown",function(n){h(n)}),sj_be(sj_b,"mouseup",function(n){h(n)}),n&&s(n.firstChild),t&&s(t.firstChild))}function it(n){return _G.abdef_sarc!=undefined&&n.classList.contains(_G.abdef_sarc)}function s(n){n&&n.nodeType==1&&!it(n)&&(ut(n),s(n.nextSibling))}function rt(n,t,i){for(var r=-1;i--&&r++<n.length;)if(r=n.indexOf(t,r),r<0)break;return r}function ut(n){var y,u,t,c,f,s,l,a;if(n){var r=ct(sa_CTBConfig.toolboxTriggerClassName,n,"span"),h=n.getElementsByTagName("cite"),e=v(n,"u");e&&i(e,"u")[0]==="e"&&(e=null);y=sa_CTBConfig&&sa_CTBConfig.disableMetaData=="1";r&&(h.length\|\|y)&&(u=h.length>0?h[0]:null,n.tt=r,ft(n,e)&&bt(n)&&(t=sj_ce("a"),t.href="#",t.className="trgr_icon",t.setAttribute("aria-label",sa_CT

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\we5MTeTkjiic9oaBxzZpmSWxZ5k.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (838), with no line terminators
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.10179630103155
Encrypted:	false
SSDEEP:	24:01rReu5mXKBj/BsKkRW5LuRWCfRM7ssdvcR:09wwDEw56w2+s6cR
MD5:	8C8B189422C448709EA6BD43EE898AFB
SHA1:	A4D6A99231D951F37D951BD8356D9D17664BF447
SHA-256:	567506D6F20F55859E137FCBD98F9E1A678C0D51192FF186E16FD99D6D301CFF
SHA-512:	6FAA73D59082065426769A27081CBEDCD22146EF948AFDD9A86801F205B2DDDC63E03AC5D555EF0AF23EF05901EBFFE7E8AADD82260EF505CB89D99E572FDF4A
Malicious:	false
Preview:	var CursorProgress;(function(n){function f(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function e(n){var u,e,o,s;n.button!==0\|\|n.ctrlKey\|\|n.shiftKey\|\|(u=f(sj_et(n)),u!=null)&&u.getAttribute("role")!=="button"&&(r(),e=(u.getAttribute("href")\|\|"").trim().toLowerCase(),e!==""&&e.indexOf("javascript:")!==0&&e.indexOf("#")!==0)&&(o=u.getAttribute("target"),o===null\|\|o.trim()==="")&&(Lib.CssClass.add(u,t),s=_ge("b_content"),s!==null&&Lib.CssClass.add(s,t),i!==null&&(sb_ct(i),i=null),i=sb_st(r,5e3))}function r(){for(var i=_d.getElementsByClassName(t),n=i.length-1;n>=0;n--)Lib.CssClass.remove(i[n],t)}function u(){var r=_ge("b_content"),n,t,i;if(r!==null&&(n=r.getElementsByTagName("A"),n))for(t=0;t<n.length;t++)(i=n[t],i)&&sj_be(i,"click",e)}var t="b_CursorProgress",i=null;n.bind=u;u()})(CursorProgress\|\|(CursorProgress={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\43BJuM7qM_8Wd1WfIZM2_oK9zrw.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (371), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.964799787793963
Encrypted:	false
SSDEEP:	6:qGD7/TMvKyYLwRMF4owANCqwvpkTzT6n0evROARDCMwzkk6Km0Msv/Gvz:JPwKVDJHCqspkZeZJDC/wKE
MD5:	B743465BB18A1BE636F4CBBBBD2C8080
SHA1:	7327BB36105925BD51B62F0297AFD0F579A0203D
SHA-256:	FEE47F1645BC40FBC0F98E05E8A53C4211F8081629FFDA2F785107C1F3F05235
SHA-512:	5592DEF225E34995F2F4E781F02CC2B489C66A7698D2FEFF9AC9A71F09E5284B6BBDB065E1DF9C06ADFB1F467D5627FBD06E647ABF4E6AB70CF34501232126AD
Malicious:	false
Preview:	var SbiPrivacy;(function(){function t(){var i,r,t,u;if(typeof SbiUtil!="undefined"&&SbiUtil.rt&&_d.querySelectorAll)for(i=SbiUtil.rt.querySelectorAll(".sbiinflnk[data-link]"),r=function(t){var i=t.target;i.hasAttribute(n)&&(i.href=i.getAttribute(n),i.removeAttribute(n))},t=0;t<i.length;t++){u=i[t];SbiUtil.oncop(u,r)}}var n="data-link";t()})(SbiPrivacy\|\|(SbiPrivacy={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\8rqwN7Xb28A6E1cuZBn327GVXX0.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.119404786158862
Encrypted:	false
SSDEEP:	6:2LGXh6BodmYWyXPBsw+SFsjRntLsMIxwCDrlT:2QBdoySw+YEOM8nlT
MD5:	33C123623267DDCCC3506DE4E71C105B
SHA1:	61C759ACDD259A7520988C3D0D58BB4C5A25D87E
SHA-256:	DDA145AF1F9D026E6C080B2D21FE7CA1CD46F4FB58DC1CAE1474C119B1E1FF2C
SHA-512:	0D0B40C625997D91D216DF9489D8D048047FC5179C264EEB77B8B1D28E5E11DFD633BE4B3AF07AFD96F9E0F526E5DD1BA97232AA6DE1B05A94FC60682321D151
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(t){n&&Lib.CssClass.contains(n,"b_active")&&(sj_pd(t),sj_sp(t))},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Nksr5XkRIuoUdxQ2qS3yL9r8V8E.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (8674), with no line terminators
Category:	dropped
Size (bytes):	8674
Entropy (8bit):	5.212727429542033
Encrypted:	false
SSDEEP:	192:a4/1MfRZ4V9bmVKnhHKBEs9F3kBlVD+mxHpfuq:ac1MfRkHpiEs9dkBfDLJfuq
MD5:	1C0981AC86E2EA5B7F08F34548AF3280
SHA1:	57324208DDB3A9E80ABD3346607D712C999C2E50
SHA-256:	00FF3483D93259AEDB929A9FEE4454A623830B18A08F08781AC1961C1E98774A
SHA-512:	0F7185A8579D9BF1B89623BF126C58789010C76F7E279A3F44064C78B2E3E04BB0A89394E6BE185618071153BC872E43A69211255F3470E1120E51AB0D5F2329
Malicious:	false
Preview:	(function(n,t,i,r,u,f,e,o,s){function w(n,t,i){var r=[],u;return n&&(i=i\|\|"*",u=n.getElementsByTagName(i),h(u,function(n){nt(n,t)&&r.push(n)})),r}function b(n,t,i){var r=[];return h(n,function(n){var u=w(n,t,i);u&&u.length>0&&(r=r.concat(u))}),r}function bt(n,t){var i=[];return h(n,function(n){var r=null;try{r=n.querySelector(t)}finally{r&&(i=i.concat(r))}}),i}function ut(n){return g[n]\|\|(g[n]=new RegExp("\\b"+n+"\\b")),g[n]}function nt(n,t){var i=n.className\|\|"";return ut(t).test(i)}function y(n,t){n.className=n.className\|\|"";nt(n,t)\|\|(n.className+=" "+t)}function p(n,t){var i=n.className\|\|"",r=ut(t);n&&i&&t&&(n.className=n.className.replace(r,"").replace(/\s+/," "))}function a(n){return f(n),u(n),!1}function kt(n){return(n=n\|\|i.event,n.pageX\|\|n.pageY)?{x:n.pageX,y:n.pageY}:{x:n.clientX+s.scrollLeft-s.clientLeft,y:n.clientY+s.scrollTop-s.clientTop}}function c(n,t){var i=n.currentStyle,r=0,u;return _w.getComputedStyle&&(i=_w.getComputedStyle(n),sb_ie&&(r=parseFloat(i.paddingTop)+parseF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Y806JrL6RagU8tqNI_iN1M1S1mA.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (891), with no line terminators
Category:	dropped
Size (bytes):	891
Entropy (8bit):	5.1332488883366585
Encrypted:	false
SSDEEP:	24:2QG5MCVFmMCBTotKMCWqEZWMCUHK09nzEIzGln:GbGb+Eb5EgbCr9nz+ln
MD5:	02B0B245D09DC56BBE4F1A9F1425AC35
SHA1:	868259C7DC5175A9CC1E2EC835F3D9B4BD3F5673
SHA-256:	62991181637343332D7B105A605AB69D70D1256092355CFC4359BEE7BDBFB9C6
SHA-512:	CBB43000A142807FF1BB3BFAC715CEF1240233117C728F357C824CE65B06BE493DF2306C7B03598817F09B02E9E36EC52314F88467679C5BEF3EE1504A10C7E6
Malicious:	false
Preview:	(function(){function e(){var t,r;n&&(n.value.length>0?(t=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|t===void 0?void 0:t.add(sj_b,i):(r=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|r===void 0?void 0:r.remove(sj_b,i))}function o(t){var e,o;n.value="";n.innerText="";u&&f&&(u.innerText="",f.classList.remove("nudgeVisible"));(e=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|e===void 0?void 0:e.remove(sj_b,i);sj_log("CI.XButton","Clicked","1");r&&((o=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|o===void 0?void 0:o.add(r,"b_focus"));n.focus();n.click();t&&(t.preventDefault(),t.stopPropagation())}var r=_ge("b_header"),n=_ge("sb_form_q"),t=_ge("sb_clt"),u=_qs(".qfc.b_searchbox .ghost"),f=_qs(".qfc.b_searchbox .nudge"),i="b_sbText";n&&t&&(sj_be(t,"click",o),sj_be(t,"keydown",function(n){var t=n.code\|\|n.key;t==="Enter"&&o(n)}),sj_be(n,"keyup",e),e())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\authorize[1].htm

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	HTML document, ASCII text, with very long lines (1194), with no line terminators
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	5.269399823456483
Encrypted:	false
SSDEEP:	24:k+NmKUV5uE2bovcLABeU572HQ3EA+spFMC+s0+NaSrZcWZI1RuhHXI:n0VhmLABeS71F+spFL+s0+gSrZcWGuhY
MD5:	01441FB4665A4C9BA051235D2BB7DD15
SHA1:	7A543C1D7CEB0A1E42E6A5A45B13B33ABE0A580F
SHA-256:	3B27F779C252D4C874A0AF3E0A787C74DD436B45F436D38F4B2EDDF28A4F905C
SHA-512:	EEFC68BEE6521ADFC168E9FA1A3D5D89E8DBD06B336CF1983C1404201497EB72F39A80E3DB0062C29E756073780BDF5D91B339F2C750187F03C4941C0CF6E6F3
Malicious:	false
Preview:	<html><head><title>Working...</title></head><body><form method="POST" name="hiddenform" action="https://www.bing.com/orgid/idtoken/nosignin"><input type="hidden" name="error" value="login_required" /><input type="hidden" name="error_description" value="AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com). Trace ID: 8c3a58a4-70b8-415f-9225-88b8495e3500 Correlation ID: 90990ce5-d3d0-496a-9b06-d6029702537f Timestamp: 2025-01-03 14:26:05Z" /><input type="hidden" name="error_uri" value="https://login.microsoftonline.com/error?code=50058" /><input type="hidden" name="state" value="{"ig":"5F4B6DC1B0B44A0E8B9396C4B221B2F1"}" /><noscript><p>Script is disabled. Cl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\common.802715d7a736bd82fc74[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	265561
Entropy (8bit):	5.432386621514022
Encrypted:	false
SSDEEP:	3072:Hw+voYPbYRFKstM4weHKyhqGF0/UnwQXXiR4U2JH5:HLvoMKkstM4wBVUnjJZ
MD5:	1C984AC84FC70C69942DF2AD7CD7933E
SHA1:	61A5C268E80AF49D161ADD6B6EE0DB6FC02EB6EA
SHA-256:	8D7E6CE8CC3594239246D481140C43546A2058B5B75DCA2048389C3713B9FE15
SHA-512:	1B19BC2DC7CDFD89A5657D0BDB9D9E63F6396994426780241E2F5F7669ECCFE4102814593A0E15170349F7340062D29AD8750B4B5DA43E63D624E3BA64F2FE98
Malicious:	false
Preview:	"use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks\|\|[]).push([["common"],{54085:function(e,t,n){var r;n.d(t,{p:function(){return r}}),function(e){e.Desktop="desktop",e.Phone="phone",e.Tablet="tablet"}(r\|\|(r={}))},21290:function(e,t,n){n.d(t,{GB:function(){return s},Km:function(){return c},Oq:function(){return f},Sp:function(){return d},Wc:function(){return u},cm:function(){return p},e_:function(){return g},oH:function(){return h},r7:function(){return a},yL:function(){return l}});var r=n(45331),i=r.z.Alert,o={build:""};function a(e){Object.assign(o,e)}var s={id:22012,severity:i,pb:o},c={id:22014,severity:r.z.Critical,pb:o},u=(r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,r.z.Deprecated,{id:22027,severity:r.z.Critical,pb:o}),l=(r.z.Critical,r.z.Critical,{id:22031,severity:i,pb:o}),p={id:22032,severity:i,pb:o},d={id:22033,severity:i,pb:o},f={id:22034,severity:i,pb:o},h={id:22050,severity:i,pb:o},g={id:22051,severity:r.z.Deprecated,pb:o};r.z.De

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\desktop-shape[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	197
Entropy (8bit):	5.986656121330302
Encrypted:	false
SSDEEP:	3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
MD5:	34760615AB0C180EB4B48739297FD0F2
SHA1:	789438D09CC27A08879B1A9686C82527270E7C24
SHA-256:	360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
SHA-512:	1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
Malicious:	false
Preview:	.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\experience.b374b0d5b40196862f17[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	Unicode text, UTF-8 text, with very long lines (62058), with no line terminators
Category:	dropped
Size (bytes):	231602
Entropy (8bit):	5.762554862752807
Encrypted:	false
SSDEEP:	1536:Bl4m9Uoyafb1Hjhw3dsrWnQHdiJg7hJ5BjNnaAyGJNyWVzskeUjlWSGu9bCxKYb1:Mm9r0g9KAvyWs7Gb9+Fb1Zzae
MD5:	3ACCB914F415F2E2C36775D5783CF112
SHA1:	7CB1F2677020EAFEAF7BFCCF2E15BC7DC45DC758
SHA-256:	D3722105B5C0D92A3E85ECA10174193CD0AF84DE74586B2EEE991182CFF5AFFE
SHA-512:	3024450B40BBF7F3482F465BC831E4826543DE5D6A634584AAE7C5EA4B72D8F6E75A675D9371BF92303E051BFF94ACE431A082D8BD5E89CB664FC0DEF41DB19B
Malicious:	false
Preview:	!function(){"use strict";var t,e,n,r={12451:function(t,e,n){var r=n(8460),i=n(2132),a=n(82589),o=n(9925),s=n(96838),c=n(56595),l=n(54616),d=n(82512),u=n(3290),f=n(8488),p=n(4577),m=n(4108),g=n(23159),h=n(65212),v=n(27310),b=n(54085),x=n(29714),y=n(3460),w=n(91898),k=n(42390),C=function(){function t(){}return Object.defineProperty(t,"viewType",{get:function(){return x.Gq.get(this.viewTypeKey)},set:function(t){x.Gq.set(this.viewTypeKey,t)},enumerable:!1,configurable:!0}),t.trackCallbacks=function(){switch((0,y.Bn)().currentColumnArrangement){case w.K$.c1:case w.K$.c2:t.viewType="size2column";break;case w.K$.c3:t.viewType="size3column";break;case w.K$.c4:t.viewType="size4column"}return t.viewType},t.getTelemetryProperties=function(t,e){var n=!("false"===k.c.getQueryParameterByName("enableTrack",e)),r=k.c.getQueryParameterByName("ocid",e)\|\|"hpmsn",i=u.jG.ActivityIdLowerCaseNoHypens,a="0",o=!1;if(d.Al&&d.Al.ClientSettings){var s=d.Al.ClientSettings;"true"===s.static_page&&(o=!0),a=s.browser

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\hjhfd1k8QFxRGOj4kh67VzVClLA.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (7155), with no line terminators
Category:	dropped
Size (bytes):	7155
Entropy (8bit):	5.435598317550486
Encrypted:	false
SSDEEP:	192:paWT3REjhNn5y1Myoy+y25syZWNKo5xp5VUILj/rVEkVu4akUr:paWzEhNn5y1Myoy+y25syq/VUIX/1aka
MD5:	DC221228E109F89B8B10C48F2678FB46
SHA1:	1BFC85CBA5C424136941AC1DFD779A563B5BEED4
SHA-256:	F4FB7234959F48C2B2CA73FD6C35D36EAF65D8C431D982A1BA208F5CDC766419
SHA-512:	46F49E5AC18436251778D1F50C027729A2442ED6541C3162D878720703E37797B6028D96EB1568C23EC5006FB022C8E05855E250D6A1A590F41E890866529CD2
Malicious:	false
Preview:	var QuickSearch;(function(n){function et(n){var t=_w.location.protocol+"//"+_w.location.hostname+"/chat?q="+encodeURIComponent(n)+"&showconv=1&sendquery=1&form=IPRV10";a?window.open(t):_w.location.href=t}function w(n){sb_st(function(){var it,rt,ut,ft,f,a,w,st,d,at,s,v,g,vt,ht,y,p,ct,nt;if(l=null,NodeList.prototype.forEach\|\|(NodeList.prototype.forEach=function(n,t){t=t\|\|window;for(var i=0;i<this.length;i++)n.call(t,this[i],i,this)}),f=window.getSelection(),t=(it=f===null\|\|f===void 0?void 0:f.toString())!==null&&it!==void 0?it:"",a=_ge("qs_searchBox"),w=o?_ge("mfa_root"):null,!o\|\|w!=null){var lt,et=!0;f!=null&&f.anchorNode!=null&&(lt=f.anchorNode.nodeValue\|\|f.anchorNode.textContent,et=!tt.some(function(n){return n!=null&&n!=undefined?n.contains(f.anchorNode):!1}),f.anchorNode.childNodes!=null&&f.anchorNode.childNodes.forEach(function(n){(n.nodeName==="INPUT"\|\|n.nodeName==="TEXTAREA")&&(et=!1)}));st=!0;dt()\|\|f.type=="Range"\|\|(st=!1);t.trim()!=""&&et&&st&&u&&t.trim().length<2048?(sj_log("C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ie-image[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39155
Entropy (8bit):	7.8985187905985486
Encrypted:	false
SSDEEP:	768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
MD5:	E161E2045A32E4513E81954B1D83B953
SHA1:	0A06306203C286B8C342CFD856C1EE3F16728C7E
SHA-256:	7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
SHA-512:	7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
Malicious:	false
Preview:	.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..\|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ihC7RhTVhw2ULO_1rMUWydIu_rA.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ln5TQq6AIWfcBlduDk-5bnaJMpY[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\logo[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27928
Entropy (8bit):	7.701164569435742
Encrypted:	false
SSDEEP:	768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
MD5:	862D29153222B9B15C3C73B61B930335
SHA1:	391BEBF4BA8910B718C5516491EB1C7D32D4C187
SHA-256:	3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
SHA-512:	6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
Malicious:	false
Preview:	.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.\|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....\|%..I...x.]........I..m..a.?.vml76.O.:.lW........0\|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ....&..R4.F2........0-.r..n.\|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\sbi[1].htm

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	HTML document, ASCII text, with very long lines (33353)
Category:	dropped
Size (bytes):	50932
Entropy (8bit):	5.481937509795144
Encrypted:	false
SSDEEP:	768:okuL2ym/YIZE2u16tNz14nO2sya0yO7JUDWvjygz+YI2QFSOc+YIXFWCPP6bzATo:9wPySjyK4FWCqbwONiqP7CAz
MD5:	3B23C7FDE0782E5C750D3FC47BF49BC3
SHA1:	7678C8847E764F85BE04A73BD29E777799195487
SHA-256:	DF22AD42AC234CAF5014C42783FCC21214E77F1750B571964BB6A3FDC3984733
SHA-512:	D0038834B7BC904D67E49DF29E5B4AE0C5BCE354EE053B2740613A909CBBA7AED338E9BB06B8BAC70281E4413EAAF96A3504565636DB225F58C0CA4CF353EA3C
Malicious:	false
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:18px;width:18px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\yjXVFOxf6UdoTA2BOwEH6n4ClfI.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\3tdN5-aUjXHlyFDCP-W57B-Gjkg.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1578), with no line terminators
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.329734499973321
Encrypted:	false
SSDEEP:	24:2QDoc8McY0tjLr4H5uRlcHeO0M2AieYIriev+OmbTkC6+xbDntex3CcldxQp3j7O:NfZuRy0N1eYZ0waSbO3CBp/GiCHAhG
MD5:	0C0AD3FD8C0F48386B239455D60F772E
SHA1:	F76EC2CF6388DD2F61ADB5DAB8301F20451846FA
SHA-256:	DB6DDE4AEF63304DF67B89F427019D29632345D8B3B5FE1B55980F5D78D6E1E7
SHA-512:	E45A51EF2F0021F168A70AC49BDCC7F4FB7B91FF0DDD931F8ECBD70F6494C56285B2D9BC1170804801CE178244CCF361745B677B04C388B608D1471E0695EBEB
Malicious:	false
Preview:	(function(){function d(n,t){for(var r=[],i=0;i<t.length;i++)r.push({MonitorID:t[i].name,RequestID:t[i].guid,Result:Math.round(n[i])});return JSON.stringify(r)}function u(){function n(){return Math.floor((1+Math.random())65536).toString(16).substring(1)}return n()+n()+n()+n()+n()+n()+n()+n()}function h(){return window.performance&&window.performance.getEntriesByName?!0:!1}function c(n,t,i,r,u,f){function l(i){var w,b,p,k,y,g,nt;if(e!=null&&sb_ct(e),s[i]=c!=null?(new Date).getTime()-c:-1,i=(a+v)%n.length,o=new Image,a++<n.length)c=(new Date).getTime(),o.onload=function(){l(i)},w=function(){o.onload=null;o.onerror=null;c=null;l(i)},e=sb_st(function(){w()},t),o.onerror=function(){e!=null&&sb_ct(e);e=null;w()},o.src=n[i];else{if(r!=null&&r.length!==0){if(h())for(y=0;y<n.length;y++)b=n[y],p=window.performance.getEntriesByName(b),s[y]!=-1&&p&&p[0]&&(s[y]=p[0].duration);for(k=d(s,u),y=0;y<r.length;y++)g=r[y],nt=new Image,nt.src=g+k}f!=null&&f()}}var c,e,s=[],v=Math.floor(Math.random()n.lengt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\5g-N9K-X1ykUl3QHEadPjpOM0Tc.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (1060), with no line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.351152776949957
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1nAA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGD0zRPo
MD5:	F4DA106E481B3E221792289864C2D02A
SHA1:	D8BA5C1615A4A8ED8EE93C5C8E2EA0FB490A0994
SHA-256:	47CB84D180C1D6BA7578C379BDC396102043B31233544E25A5A6F738BB425AC9
SHA-512:	66518EE1B6C0DF613074E500A393E973844529CA81437C4BAFE6BF111CBA4D697AF4FE36B8D1B2AA9B25F3EB93CD76DF63ABFC3269AC7E9F87C5F28A3764008E
Malicious:	false
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(document.body,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\GK9SuRKiu0QbKYnVgoAlgmuWrNU.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	dropped
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Hn5jlJXmmG-j_-qM12eoTYPXFrI.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (19674), with no line terminators
Category:	dropped
Size (bytes):	19674
Entropy (8bit):	5.33240026231163
Encrypted:	false
SSDEEP:	384:3Wsj/9Npzk8fbw3QMXmwOAahGvyBJeXiOOF240eApyfYRxW+:3z/PpzkLXmw0onXi9F24Ypw43
MD5:	5704A84AC0573BDBF11A8DA6582410C6
SHA1:	7FE63892DFBB4AE078F5B784A31B29E981E22523
SHA-256:	525FA9E3B57ABEE5ED411C5EBA2F74DFF25D2591BBC142A976DE1604E2502D9E
SHA-512:	4DF7C5152CC7A9BE28A650A3C275B9F9880139D640268E3266968EB585F813E6178FEE193D8348B5DA386A3893E54FD40A3B6149275DB404D3511F27532D8170
Malicious:	false
Preview:	var customEvents,__spreadArray,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Icon[1].png

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	533
Entropy (8bit):	7.415663553371965
Encrypted:	false
SSDEEP:	12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
MD5:	B6162D100379E7F4EF709BA5C26D1BA8
SHA1:	AEA4244C56F00AA26064134863157A6EE9D7ABB9
SHA-256:	DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
SHA-512:	CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
Malicious:	false
Preview:	.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..\|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..\|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\NRudXMsXYtnM1BQyD6xvAZoudZM.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (667), with no line terminators
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.251512275863699
Encrypted:	false
SSDEEP:	12:fr5esz7hNGwXI2QA3QglxfLQOtKfWM1kI2JGC+t5821xw9i/UJpN0I:fr5NhNGOgAggDDQOtjMbhH582Ugk0I
MD5:	2AB12BF4A9E00A1F96849EBB31E03D48
SHA1:	7214619173C4EC069BE1FF00DD61092FD2981AF0
SHA-256:	F8B5ACF4DA28E0617F1C81093192D044BD5A6CC2A2E0C77677F859ADCF3430AC
SHA-512:	7D5AAE775BE1E482EADA1F453BEA2C52A62C552FA94949E6A6081F322E679E916B1276BB59FF28CF7C86D21727BCC329ECB03E5D77CA93204E0CD2694FAA72BD
Malicious:	false
Preview:	sb_ie&&function(){function h(){if(t){var u=n.replace(/www\./i,"");return f&&i(t,r,n+"?PC="+f)\|\|i(t,r,n)\|\|i(t,r,u)\|\|i(t,r,n+"?Form=HPPDH1")\|\|i(t,r,n+"?PC=BNHP")\|\|i(t,r,n+"?PC=BNSR")}return 0}function c(){return i(_w.external,s,n)!=0}function l(){if(u){var n=2e+o;if(u==n)return!0}return!1}function a(){var n=_ge("hps");return n\|\|(n=sj_ce("span","hps"),n.style.behavior="url(#default#homepage)",sj_b.appendChild(n)),n}function i(n,t,i){try{return n[t](i)}catch(r){return 0}}var s="IsSearchProviderInstalled",r="isHomepage",n="http://"+_d.domain+"/",u=sj_cook.get("_UR","D"),f=sj_cook.get("SRCHS","PC"),t=a(),e=h(),o=c();l()\|\|(u=2e+o,sj_cook.set("_UR","D",u,1,"/"))}()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\VLm4tyiMlywwyg4FgWjZITn5W48.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (357), with no line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.100320804030099
Encrypted:	false
SSDEEP:	6:2LGXTMkCDpk6CSVKvxpKv8Ed7fxu7hJRJeGMYS+ePekKfT32PV9m+8mq1mqJFO:2QVlY8EbgRUGhS+eTKb2PVESq8qrO
MD5:	2DF9793CF020A37C88178BE84311427A
SHA1:	29CFE86239722D4F4AF07C494D676092896A8600
SHA-256:	A69D257EEE41E843881D548D2E4EE5A0727B889AB22BFFDAA8ED1074E802BCC6
SHA-512:	E9A35EC1E466FEB3E273FB991A3282BA1C45FD0EACEA956E9821914CC4261377684B062BDE888EBF5767BBC055DB191DC14E00AF8037B5607449C06E5D2DD082
Malicious:	false
Preview:	(function(){function r(n){if(n&&(i=0),!(i>60)){i++;var u=_w.CursorProgress\|\|_w.CursorProgressFull;u&&u.bind();t&&sb_ct(t);t=sb_st(r,1e3)}}function n(){r(!0)}var t=null,i=0;n();typeof sj_be!="undefined"&&sj_be(_w,"load",n);typeof sj_evt!="undefined"&&(sj_evt.bind("onP1",n),sj_evt.bind("onP1Lazy",n),sj_evt.bind("ajaxReady",n),sj_evt.bind("ajax.load",n))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\W8bLYGpay8IFp3H_SrUDKaBAn30.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (2683), with no line terminators
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	5.285209446790883
Encrypted:	false
SSDEEP:	48:5sksi0wg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahff/Z/92zBDZDNJC0x0M:yk1g1zbed3SBkdZ9ZGVFNJCRM
MD5:	FB797698EF041DD693AEE90FB9C13C7E
SHA1:	394194F8DD058927314D41E065961B476084F724
SHA-256:	795E9290718EB62A1FB00646DC738F6A6B715B1171DD54A3D2DEFA013A74F3DA
SHA-512:	E03C4AB727567BE95B349B971E29CFFB3890CFB1A1DDF997B34B9D69154294A00A5112F4FFCA4DF4E26BBF96AFA75E5943E965EDC8F8E21035ED2EF30B7688D8
Malicious:	false
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),!window.isNaN(o)&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\YE0zdCVEXmngId3Qg4LQkqvjyLE.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (21920)
Category:	dropped
Size (bytes):	21951
Entropy (8bit):	5.3573914200107335
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0wzueAi:Y5Tifh3bBpBnqIH+Z6sepXv0uQaV
MD5:	51775361FD842E7E41AF84A01C8AB92C
SHA1:	21D108490F70991727A3B044983342517336B53F
SHA-256:	8B549EEF372338FC3F5632B9BD47AD2C2876229E573095CCBC6B7867A47153F9
SHA-512:	96FD8D92BA98B65B4BD34FF57F351123EA907C3DC91A4814F8DE3E6985B6BC9CA0972F8E6CBEE072F50742CA5F19D03F623C32EB5061C9CA1D6A3CFB47344DCE
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a7s5nizZY8lKJ6VMCdSRJA2buHw.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (412), with no line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.17305928357574
Encrypted:	false
SSDEEP:	12:2QBdoySw+YEXj3Gs07fZVD7H82MgNukm7UqgU:2Qb7+YEXz4fZxHjmoRU
MD5:	581C2C396720F651CC2F3D40E9E727F8
SHA1:	6515C6C20730DCF81A861EA8D16682AAC4DDA273
SHA-256:	D6787BD009EA758F8ABDD437032799F7004247FC10F631B93AF0FA84607597EC
SHA-512:	E7198C04B0E8CEE80B8278E77FA0C301915B32F62C0DB36C1D7D2D9E20A7ACD578308070EB833ED8450A2360358E118E55B47DB149FB4AB8053E8FAA2C925568
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(){var i,t,r;if(n&&Lib.CssClass.contains(n,"b_active"))try{i=_ge("b_header");i.scrollIntoView({behavior:"smooth"});t=_ge("sb_form_q");t.focus();t.click();r=t.value;t.setSelectionRange(0,r.length)}catch(u){_w.sj_log&&sj_log("CI.WebScope","error",u.message)}},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cJksCHwhB_Z32I0ytWPMUDsybak.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\dbmNS45xQvD1diApY1T2HExvOo8[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\hjhfd1k8QFxRGOj4kh67VzVClLA.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (5961), with no line terminators
Category:	dropped
Size (bytes):	5961
Entropy (8bit):	5.432641972148736
Encrypted:	false
SSDEEP:	96:9jaZQZ13PJOQU88YQCNsdeEjhjSCnSA1y2A1Qnyoy+y25syeOWNKo5xpzlVUILjI:paWT3REjhNn5y1Myoy+y25syZWNKo5xA
MD5:	8BE63544771E19931F22DB03D5212B87
SHA1:	86A4518FBB87B707713234D6F41AED3642CC46FD
SHA-256:	4DD9F4B2714212665842874D337CD76474D1A9DE81BC7388AE0828E04624CF17
SHA-512:	EFF45BEE81D00E1D69BB6F937F557928438E284C8C0E4D7A67FC711FDE114CA460901D5F242C682BD0453A188F96B6AF68FDED48514023BF893568A6633743D9
Malicious:	false
Preview:	var QuickSearch;(function(n){function et(n){var t=_w.location.protocol+"//"+_w.location.hostname+"/chat?q="+encodeURIComponent(n)+"&showconv=1&sendquery=1&form=IPRV10";a?window.open(t):_w.location.href=t}function w(n){sb_st(function(){var it,rt,ut,ft,f,a,w,st,d,at,s,v,g,vt,ht,y,p,ct,nt;if(l=null,NodeList.prototype.forEach\|\|(NodeList.prototype.forEach=function(n,t){t=t\|\|window;for(var i=0;i<this.length;i++)n.call(t,this[i],i,this)}),f=window.getSelection(),t=(it=f===null\|\|f===void 0?void 0:f.toString())!==null&&it!==void 0?it:"",a=_ge("qs_searchBox"),w=o?_ge("mfa_root"):null,!o\|\|w!=null){var lt,et=!0;f!=null&&f.anchorNode!=null&&(lt=f.anchorNode.nodeValue\|\|f.anchorNode.textContent,et=!tt.some(function(n){return n!=null&&n!=undefined?n.contains(f.anchorNode):!1}),f.anchorNode.childNodes!=null&&f.anchorNode.childNodes.forEach(function(n){(n.nodeName==="INPUT"\|\|n.nodeName==="TEXTAREA")&&(et=!1)}));st=!0;dt()\|\|f.type=="Range"\|\|(st=!1);t.trim()!=""&&et&&st&&u&&t.trim().length<2048?(sj_log("C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\hx-eea1zqtCz4K0bW2uH_oN7Fs4[1].jpg

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\kFdRGnsF9oNJsnfvt_bKFj-yBxg.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (429), with no line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.098203134109495
Encrypted:	false
SSDEEP:	12:GtAJv9xWHXWpwYMEX3IR6lVDZWhHD6GkPsHKHOZzu2wBRHJhNURtAJ4ZQetAJD:GeyWeYMEnsUVoHoigkhwBRphNQR+e+
MD5:	0794C2FFC9AAF238496BF687A9C68799
SHA1:	7938BE485611F9D417E84B8C0A74BD3C589E052F
SHA-256:	805AAA9634639B2EAA912E117219727DFA6E92A63B8B92569C336A9CCDE52DEE
SHA-512:	FEFBFBD39B9B86D8975D8FAAB62B50515488E9BF1E21AD72FED9FA93614E10ADAFC99DA77349EAD2501B89D422D766ADC313B6024BCB9B331AB83A7B99BB135F
Malicious:	false
Preview:	var SBIImgsHelper;(function(){function i(){typeof SbiUtil!="undefined"&&(SbiUtil===null\|\|SbiUtil===void 0?void 0:SbiUtil.oncop(SbiUtil.rt,r))}function r(i){var r=i.target\|\|i.srcElement,u;r&&r.tagName==="IMG"&&r.classList.contains(n)&&r.src&&(u=r.getAttribute(t),u&&sj_evt&&sj_evt.fire&&sj_evt.fire("sbi_searchimgurl",SbiUtil.gimg(r),u,null,SbiUtil.gaps(r)))}var n="sbiable",t="data-sbiid";i()})(SBIImgsHelper\|\|(SBIImgsHelper={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\microsoft.b109cceab5e009228460[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (65448)
Category:	dropped
Size (bytes):	94707
Entropy (8bit):	5.407635683386335
Encrypted:	false
SSDEEP:	768:GSqLAEwLuZAFL1oL3SDk5v1VWkNWPEYydLLnnS+7ySGAEMbiYnRGwVKVt+RFVDh4:GJMCUCuW3WkNtnnDGgGwVKWklyGEQ
MD5:	AA2BEDDF57312EF1CD312880E2729EBA
SHA1:	8E53B59585F8C947924355AFDC72A62E27CD001C
SHA-256:	16933DCF75634F75F0A09A67FB0FF7D9D0556188A888CDD89E05F2D21997BB51
SHA-512:	64AC2CCE15619DA127C5F1B637BBB39C1EB3DB69DE30FB690863C7390EC0A6D0BA2BEE9B9BC20DFF2B4044D17CED483CE5294E624F792652E8E4E1AD6FFAD4DD
Malicious:	false
Preview:	/! For license information please see microsoft.b109cceab5e009228460.js.LICENSE.txt /."use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks\|\|[]).push([["microsoft"],{39115:function(n,e,t){t.d(e,{Z:function(){return M}});var r=t(68897),i=t(44611),o=t(89734),u=t(98693),a=t(38629),c=t(64648),f=t(73966),s=t(64973),l=t(26105),d=t(46540),v=500,p="Channel has invalid priority - ";function g(n,e,t){e&&(0,f.kJ)(e)&&e[c.R5]>0&&(e=e.sort((function(n,e){return n[s.yi]-e[s.yi]})),(0,f.tO)(e,(function(n){n[s.yi]<v&&(0,f._y)(p+n[c.pZ])})),n[c.MW]({queue:(0,f.FL)(e),chain:(0,l.jV)(e,t[c.TC],t)}))}var h=t(27218),m=t(24200),y=t(92687),b=t(28055),S=function(n){function e(){var t,r,a=n.call(this)\|\|this;function l(){t=0,r=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,l(),(0,i.Z)(e,a,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.MW](e),{remove:function(){(0,f.tO)(r,(function(n,t){if(n.id===e.id)return r[c.cb](t,1),-1}))}}},n[s.hL]=fu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\search[1].htm

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (48370), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	202940
Entropy (8bit):	5.621049198249498
Encrypted:	false
SSDEEP:	3072:kqQQ1tfmDR5zQ9oEYZ5YN/FIClBgM4ASRBpMGDcUly:LQQ1t+DRZzpzw/DBgOvGDc7
MD5:	F43BF2F6193E42D25ED382DE22C9E439
SHA1:	3A3A613836FBA7A502E4F42264A72FA4893F115C
SHA-256:	B1B3C8A72E6D28C4B53695FB6BE99FEAEB691C916869F060211DE424549B58A1
SHA-512:	DBA259F14D32987DA6A6A7977831E221AD201B3B4BC7E3EF1D831CF32FBDC1C1A4C39899E24FDE55EBED184585C92C7F9416C15F67E3269F69495F1FFC5BB846
Malicious:	false
Preview:	<!DOCTYPE html><html dir="ltr" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:Web="http://schemas.live.com/Web/"><script type="text/javascript" nonce="GEk4O+lodiYXkJfrZr+ztQWSMpLFg9N3i8ZCQdW6b+4=" >//<![CDATA[..si_ST=new Date..// </script><head> pc--><title>--disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints --load-extension=C:\Windows\crx - Search</title><meta content="text/html; charset=utf-8" http-equiv="content-type" /><meta name="msapplication-TileImage" content="/sa/simg/bing_p_hd.png" /><meta name="msapplication-TileColor" content="#0C8484" /><meta name="SystemEntropyOriginTrialToken" content="A1L3tx5CzccqjN3lK6st/fXMwhf9EeokCPf8XCt0DVI8JPbg37BWq0zKvlqgkdm8YEUbthoGkC/xdR1+iIz4txAAAABxeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiTXNVc2VyQWdlbnRMYXVuY2hOYXZUeXBlIiwiZXhwaXJ5IjoxNzM5NzI0MzExLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=" http-equiv="origin-trial" /><meta property="og:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\uk_UtgpS3Vx82_2KByeueWFHn_Q.gz[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with very long lines (4646), with no line terminators
Category:	dropped
Size (bytes):	4646
Entropy (8bit):	5.223823464776493
Encrypted:	false
SSDEEP:	96:/MVnaRENlgVWIjomiJesPbrtwyAZBd3nxEd7NBu:/CaRENlgVMJhPbrtwyGBdnxEd7NI
MD5:	9EED9C1E6E746CFE4DD9E899F06C3E11
SHA1:	F25299247D020578CA0C30DC738552036819663E
SHA-256:	39AD6BE13A6186BF011C53610C13EE0FD4E9AD51CC28BF49B8FA815CBDC47E8E
SHA-512:	3088F428B747D659EB4C0385830E4B3FA95C9269427A49B2695C9C082429605A8F3FB694CF3B0690280E9D1ACBF862597CEAEDB91945BAF70F60900AA919CCCE
Malicious:	false
Preview:	var WebResultToolboxBlueV2;(function(){function tt(){var n=_ge("b_results"),t=_ge("b_context");(n\|\|t)&&typeof sa_CTBConfig!="undefined"&&sa_CTBConfig&&(r[b]=ot,r[k]=l,r[d]=l,r[g]=c,r[nt]=c,sj_be(sj_b,"click",function(n){u(n)}),sj_evt.bind("onPopTR",function(n){u(n,!0)}),sj_be(sj_b,"mousedown",function(n){h(n)}),sj_be(sj_b,"mouseup",function(n){h(n)}),n&&s(n.firstChild),t&&s(t.firstChild))}function it(n){return _G.abdef_sarc!=undefined&&n.classList.contains(_G.abdef_sarc)}function s(n){n&&n.nodeType==1&&!it(n)&&(ut(n),s(n.nextSibling))}function rt(n,t,i){for(var r=-1;i--&&r++<n.length;)if(r=n.indexOf(t,r),r<0)break;return r}function ut(n){var y,u,t,c,f,s,l,a;if(n){var r=ct(sa_CTBConfig.toolboxTriggerClassName,n,"span"),h=n.getElementsByTagName("cite"),e=v(n,"u");e&&i(e,"u")[0]==="e"&&(e=null);y=sa_CTBConfig&&sa_CTBConfig.disableMetaData=="1";r&&(h.length\|\|y)&&(u=h.length>0?h[0]:null,n.tt=r,ft(n,e)&&bt(n)&&(t=sj_ce("a"),t.href="#",t.className="trgr_icon",t.setAttribute("aria-label",sa_CT

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vendors.290823e0e7160e8e5303[1].js

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	Unicode text, UTF-8 text, with very long lines (44387), with NEL line terminators
Category:	dropped
Size (bytes):	194844
Entropy (8bit):	5.419132326845799
Encrypted:	false
SSDEEP:	3072:oSYgu0Mj/PJ3floxEsQtzbwDZ777/3DwLps0p:oSYguVJvSa5+Z7uOE
MD5:	1C8B7CFD513B7ECA52BA64947CEE70E4
SHA1:	6BA3FBE2E7514E981EB68E9A92E9EA7A499CCC0C
SHA-256:	D1730E14E7E3D2362E6C5FF0C9C36E08660F87317EC44551FAED419263240F2C
SHA-512:	1F6567D3870CFBE002CD447135020C9F1319DFAB76E3CEAFE4C62BDD79F78F2AB3E5958DE9E068A3937E1C469978FC2E4A56015B82E06FE1377A78B47D1B06DC
Malicious:	false
Preview:	"use strict";(self.homePageWebpackChunks=self.homePageWebpackChunks\|\|[]).push([["vendors"],{29558:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},74322:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},25135:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t)&&null!==t)throw TypeError("Can't set "+String(t)+" as a prototype");return t}},6664:function(t,e,r){var n=r(23362),o=r(35093),i=r(79549),a=n("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},99027:function(t,e,r){var n=r(58306).charAt;t.exports=function(t,e,r){return e+(r?n(t,e).length:1)}},57699:function(t){t.exports=function(t,e,r){if(!(t instanceof e))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return t}},45150:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");return t}},60410:function(t){t.exports=

C:\Users\user\AppData\Local\Temp\~DF0C82635135466ACB.TMP

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF258EEC8E43A49788.TMP

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GlobalMgr.db

Download File

Process:	C:\Users\user\Desktop\nv8401986_110422.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.511104462581999
Encrypted:	false
SSDEEP:	3:LDIdyGK3Mp9AUEvCSdD+Z8BGMbAGTY2UpBHeVKLDMJQn4U9VTcYDUhQreKvRiQGU:3T8iUbSQGj82UvHegOxUgYDUQpG5gz
MD5:	8FC8760C489E4AA580E6A197325D7D40
SHA1:	6F19E7AAB7F94C6E1EB05432DE5CE4CEF90334E8
SHA-256:	AE04FD367F249A18E3764200D60C6A18A525C1D99BB5C0A9683B6C37B48B4CAD
SHA-512:	A74AF085196B238F99C7D578271A00537C58A9AA57145179585A3E3E259162C95C094D26C1650262F2E8387FCFBC246141B77BBE291B6B8EA754CBC8B5D5F81E
Malicious:	false
Preview:	[Profile]..config1=102e1490f0604c078f675cf9899bc6e6..config2=c75a6d6f209a4f9c616f095dc76f8b89..config3=29f59366511ef064441d7b0e5b68c197..config4=1b3d82ff206f2697db14bb5ee90b3a8d..config5=1..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.889040863631203
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nv8401986_110422.exe
File size:	668'064 bytes
MD5:	31549917cdc6e3f9d40a48ea5998493f
SHA1:	c0f7e826645b1ba2ba1fed866992beb9de7a31df
SHA256:	73f03b369e9df60c2dc97baefcdc4ba920da3a2126c873a4654e1a83510d3b87
SHA512:	709737c36ef4fe96e99dcac210854a760cbbcff7af428620a0a83f16a5db09af4dbe2b52ccd4cff08fe0d5d4e544ddd9474c7c45005938a32705960c3581dad1
SSDEEP:	12288:pC6wyk1nvfBP0FQoOd/566f81qjbravk7o3xLWAB8TMfo+aqwFtaif8dHOqPNspj:pC6wp1vfhboOb66Uyavk8hdo+g8BOONu
TLSH:	78E42231EAA94801F21BCD367951C6B22878FC44D3D1920B63DCBF67ABBA711513876E
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$......._.d..............3.......3.......3..;...........I...............I...K...I...8...............8...............G.......Q.......C..

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x5a4c40
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x618CFCC6 [Thu Nov 11 11:21:42 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	15067c0e1192397d25d55aa213865b7e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	03/11/2021 01:00:00 03/11/2023 00:59:59
Subject Chain	CN=\u5408\u80a5\u542c\u98ce\u96e8\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8, O=\u5408\u80a5\u542c\u98ce\u96e8\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8, L=\u5408\u80a5\u5e02, S=\u5b89\u5fbd\u7701, C=CN, SERIALNUMBER=91340100MA8NA4PN5X, OID.1.3.6.1.4.1.311.60.2.1.1=\u5408\u80a5\u9ad8\u65b0\u6280\u672f\u4ea7\u4e1a\u5f00\u53d1\u533a, OID.1.3.6.1.4.1.311.60.2.1.2=\u5b89\u5fbd\u7701, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	2883C1DCA1C6A339268847E20993A65A
Thumbprint SHA-1:	A4262E248912D755E4E4008E1444CCA4ABE26216
Thumbprint SHA-256:	CCEEB9A2702DC6CC8A1DA0E4C316FE4F8A4F066D9622DF8AFD3814F05D1AD65C
Serial:	0D7A7FD32102026A7C34FDEBA6F3851D

Entrypoint Preview

Instruction
pushad
mov esi, 0050D000h
lea edi, dword ptr [esi-0010C000h]
mov dword ptr [edi+001961A4h], 6FE57FF9h
push edi
or ebp, FFFFFFFFh
jmp 00007F3BA905DBD0h
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3BA905DBAFh
mov eax, 00000001h
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F3BA905DBCDh
jne 00007F3BA905DBEAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3BA905DBE1h
dec eax
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F3BA905DB96h
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F3BA905DC14h
xor ecx, ecx
sub eax, 03h
jc 00007F3BA905DBD3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F3BA905DC37h
sar eax, 1
mov ebp, eax
jmp 00007F3BA905DBCDh
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3BA905DB8Eh
inc ecx
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3BA905DB80h
add ebx, ebx
jne 00007F3BA905DBC9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F3BA905DBB1h
jne 00007F3BA905DBCBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F3BA905DBA6h
add ecx, 02h
cmp ebp, 00000000h

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1aaec0	0x254	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a5000	0x5ec0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa0bd0	0x25d0	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a4e04	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a4e24	0xa0	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x10c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x10d000	0x98000	0x98000	d455e43d2378437ade2a0574470fdf68	False	0.9907210500616777	data	7.930810462244519	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a5000	0x7000	0x6200	49f3b9cff56d5ea4ae00baa0359b3c86	False	0.18339445153061223	data	3.9768053975413475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ZIP	0x19ed40	0x2f87	data	Chinese	China	0.9866031067641983
RT_ICON	0x1a5304	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Chinese	China	0.21321961620469082
RT_ICON	0x1a61b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.3953068592057762
RT_ICON	0x1a6a5c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.4479768786127168
RT_ICON	0x1a6fc8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.09948132780082987
RT_ICON	0x1a9574	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.12593808630393996
RT_ICON	0x1aa620	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.19680851063829788
RT_MENU	0x19ead0	0x24	data	Chinese	China	1.25
RT_DIALOG	0x1a1cc8	0x18	data	Chinese	China	1.375
RT_GROUP_ICON	0x1aaa8c	0x5a	data	Chinese	China	0.7
RT_VERSION	0x1aaaec	0x248	data	Chinese	China	0.511986301369863
RT_MANIFEST	0x1aad38	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey
COMCTL32.dll
GDI32.dll	PatBlt
gdiplus.dll	GdipFree
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
MSIMG32.dll	AlphaBlend
ole32.dll	OleCreate
OLEAUT32.dll	VariantClear
USER32.dll	GetDC
WLDAP32.dll
WS2_32.dll	setsockopt

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 15:25:54.642652035 CET	49707	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.643153906 CET	49708	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.647502899 CET	80	49707	47.103.45.17	192.168.2.5
Jan 3, 2025 15:25:54.647578955 CET	49707	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.647933960 CET	80	49708	47.103.45.17	192.168.2.5
Jan 3, 2025 15:25:54.647990942 CET	49708	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.648322105 CET	49707	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.648333073 CET	49708	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.648375034 CET	49708	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.648488045 CET	49707	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:25:54.653232098 CET	80	49707	47.103.45.17	192.168.2.5
Jan 3, 2025 15:25:54.653247118 CET	80	49708	47.103.45.17	192.168.2.5
Jan 3, 2025 15:25:54.653254986 CET	80	49708	47.103.45.17	192.168.2.5
Jan 3, 2025 15:25:54.653265953 CET	80	49707	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:00.147567034 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.147593021 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:00.147658110 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.148442030 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.148452044 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:00.220385075 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.220421076 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.220479965 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.220736027 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.220748901 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.693912029 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.694003105 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.705744028 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.705770016 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.706017971 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.706069946 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.717067003 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.763328075 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.812264919 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.812339067 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.813082933 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.813132048 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.813133955 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.813143015 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.813165903 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.813195944 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.813209057 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.813247919 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.813252926 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.813462019 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.820219994 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.820277929 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.820306063 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.820316076 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.820338011 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.820354939 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.820355892 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.820367098 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.820393085 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.820411921 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.820624113 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.820672989 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.827954054 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.828244925 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.866230011 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:00.866313934 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.869931936 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.869950056 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:00.870209932 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:00.870407104 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.870784998 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:00.900634050 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.900710106 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.900743961 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.900775909 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.900811911 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.900868893 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.900887012 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.900916100 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.900923014 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.900970936 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.901011944 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.901019096 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.901315928 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.901463032 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.901530981 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.901602030 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.901644945 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.901652098 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.901695967 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.901701927 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.902091026 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.902268887 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.902370930 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.907668114 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907728910 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.907747984 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907793045 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.907800913 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907843113 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907881021 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.907886982 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907937050 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907947063 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.907953024 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.907974005 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.907987118 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.908709049 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.908761024 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.908766985 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.908780098 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.908818007 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.908839941 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.908904076 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.915332079 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:00.958895922 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.958961964 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.958962917 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.958995104 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.959038973 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.987807989 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.987899065 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.987941027 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.987947941 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.987972975 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.988010883 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.988019943 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.988060951 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.988544941 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.988601923 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.988606930 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.988643885 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.990544081 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.990573883 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.990622044 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.990622997 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.990655899 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.990655899 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.990677118 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.990685940 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.990715027 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.995105982 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.995166063 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.995197058 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.995202065 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.995253086 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.995253086 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.995357037 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:00.995402098 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.995434046 CET	49727	443	192.168.2.5	151.101.194.137
Jan 3, 2025 15:26:00.995445967 CET	443	49727	151.101.194.137	192.168.2.5
Jan 3, 2025 15:26:01.132700920 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:01.132777929 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:01.132777929 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:01.132816076 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:01.132905960 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:01.132917881 CET	443	49725	18.244.18.122	192.168.2.5
Jan 3, 2025 15:26:01.132940054 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:01.132958889 CET	49725	443	192.168.2.5	18.244.18.122
Jan 3, 2025 15:26:06.108386993 CET	49707	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.108499050 CET	49708	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.219198942 CET	49743	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.219410896 CET	49744	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.224144936 CET	80	49743	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:06.224214077 CET	49743	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.224229097 CET	80	49744	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:06.224286079 CET	49744	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.224415064 CET	49743	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.224431038 CET	49743	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.224539995 CET	49744	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.224558115 CET	49744	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:06.229202986 CET	80	49743	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:06.229312897 CET	80	49743	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:06.229325056 CET	80	49744	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:06.229336023 CET	80	49744	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:18.108695984 CET	49743	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.108742952 CET	49744	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.625189066 CET	49785	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.625245094 CET	49786	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.630196095 CET	80	49785	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:18.630211115 CET	80	49786	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:18.630315065 CET	49785	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.630502939 CET	49786	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.630502939 CET	49786	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.630520105 CET	49786	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.630525112 CET	49785	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.630568981 CET	49785	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:18.635293007 CET	80	49786	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:18.635315895 CET	80	49786	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:18.635392904 CET	80	49785	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:18.635401964 CET	80	49785	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:30.107601881 CET	49786	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:30.107644081 CET	49785	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.124519110 CET	49859	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.124522924 CET	49860	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.129436016 CET	80	49859	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:31.129447937 CET	80	49860	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:31.129502058 CET	49859	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.129525900 CET	49860	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.129635096 CET	49860	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.129647017 CET	49860	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.129673958 CET	49859	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.129703999 CET	49859	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:31.134470940 CET	80	49860	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:31.134490967 CET	80	49860	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:31.134505033 CET	80	49859	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:31.134614944 CET	80	49859	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:42.107786894 CET	49860	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:42.107872963 CET	49859	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.626362085 CET	49937	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.626559973 CET	49938	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.640237093 CET	80	49937	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:43.640259981 CET	80	49938	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:43.640352011 CET	49937	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.640783072 CET	49938	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.676642895 CET	49938	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.676662922 CET	49938	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.681459904 CET	80	49938	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:43.681476116 CET	80	49938	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:43.742341995 CET	49937	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.743345976 CET	49937	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:43.748398066 CET	80	49937	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:43.748949051 CET	80	49937	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:54.107676983 CET	49938	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:54.107707024 CET	49937	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:59.420900106 CET	50028	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:59.425728083 CET	80	50028	47.103.45.17	192.168.2.5
Jan 3, 2025 15:26:59.426803112 CET	50028	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:59.427057981 CET	50028	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:26:59.431802988 CET	80	50028	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:02.420213938 CET	50028	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:02.467288971 CET	80	50028	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:03.045876026 CET	50029	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:03.054502964 CET	80	50029	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:03.054604053 CET	50029	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:03.054822922 CET	50029	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:03.059870005 CET	80	50029	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:06.045233011 CET	50029	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:06.091332912 CET	80	50029	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:06.670979977 CET	50030	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:06.675928116 CET	80	50030	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:06.676018953 CET	50030	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:06.676209927 CET	50030	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:06.680954933 CET	80	50030	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:09.670139074 CET	50030	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:09.715260029 CET	80	50030	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:10.296603918 CET	50031	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.301666021 CET	80	50031	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:10.301776886 CET	50031	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.301943064 CET	50031	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.306745052 CET	80	50031	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:10.424968004 CET	50032	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.429975033 CET	80	50032	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:10.430074930 CET	50032	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.430201054 CET	50032	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.430227995 CET	50032	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:10.434942961 CET	80	50032	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:10.435033083 CET	80	50032	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:20.786673069 CET	80	50028	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:20.786740065 CET	50028	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:22.107603073 CET	50032	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:22.109529018 CET	50033	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:22.114413977 CET	80	50033	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:22.114512920 CET	50033	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:22.114681005 CET	50033	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:22.114716053 CET	50033	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:22.119434118 CET	80	50033	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:22.119596958 CET	80	50033	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:24.444937944 CET	80	50029	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:24.445110083 CET	50029	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:28.038558960 CET	80	50030	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:28.038645983 CET	50030	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:31.661268950 CET	80	50031	47.103.45.17	192.168.2.5
Jan 3, 2025 15:27:31.661350965 CET	50031	80	192.168.2.5	47.103.45.17
Jan 3, 2025 15:27:34.107848883 CET	50033	80	192.168.2.5	47.103.45.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 15:25:54.239998102 CET	62805	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:25:54.640136957 CET	53	62805	1.1.1.1	192.168.2.5
Jan 3, 2025 15:25:55.308867931 CET	49906	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:25:57.210992098 CET	64354	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:00.135993958 CET	55396	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:00.137765884 CET	50089	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:00.145703077 CET	53	50089	1.1.1.1	192.168.2.5
Jan 3, 2025 15:26:00.213023901 CET	60139	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:00.219693899 CET	53	60139	1.1.1.1	192.168.2.5
Jan 3, 2025 15:26:00.352000952 CET	64310	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:04.352897882 CET	50468	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:06.454942942 CET	58230	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:06.496112108 CET	53	58230	1.1.1.1	192.168.2.5
Jan 3, 2025 15:26:06.500089884 CET	63283	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:08.507715940 CET	61873	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:08.550780058 CET	53	61873	1.1.1.1	192.168.2.5
Jan 3, 2025 15:26:58.479439974 CET	53631	53	192.168.2.5	1.1.1.1
Jan 3, 2025 15:26:59.419344902 CET	53	53631	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 15:25:54.239998102 CET	192.168.2.5	1.1.1.1	0xec95	Standard query (0)	w.nanweng.cn	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:25:55.308867931 CET	192.168.2.5	1.1.1.1	0xfd05	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:25:57.210992098 CET	192.168.2.5	1.1.1.1	0x36d2	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.135993958 CET	192.168.2.5	1.1.1.1	0x9a78	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.137765884 CET	192.168.2.5	1.1.1.1	0xf1a1	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.213023901 CET	192.168.2.5	1.1.1.1	0x4679	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.352000952 CET	192.168.2.5	1.1.1.1	0xfba8	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:04.352897882 CET	192.168.2.5	1.1.1.1	0x9464	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:06.454942942 CET	192.168.2.5	1.1.1.1	0xf37a	Standard query (0)	2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:06.500089884 CET	192.168.2.5	1.1.1.1	0xff9d	Standard query (0)	45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:08.507715940 CET	192.168.2.5	1.1.1.1	0x2218	Standard query (0)	238358d141a1b2850f10e9a50017a441.clo.footprintdns.com	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:58.479439974 CET	192.168.2.5	1.1.1.1	0xc861	Standard query (0)	w.nanweng.cn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 15:25:54.640136957 CET	1.1.1.1	192.168.2.5	0xec95	No error (0)	w.nanweng.cn		47.103.45.17	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:25:55.315571070 CET	1.1.1.1	192.168.2.5	0xfd05	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:25:57.217885971 CET	1.1.1.1	192.168.2.5	0x36d2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:00.142545938 CET	1.1.1.1	192.168.2.5	0x9a78	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:00.145703077 CET	1.1.1.1	192.168.2.5	0xf1a1	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.145703077 CET	1.1.1.1	192.168.2.5	0xf1a1	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.145703077 CET	1.1.1.1	192.168.2.5	0xf1a1	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.145703077 CET	1.1.1.1	192.168.2.5	0xf1a1	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.219693899 CET	1.1.1.1	192.168.2.5	0x4679	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.219693899 CET	1.1.1.1	192.168.2.5	0x4679	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.219693899 CET	1.1.1.1	192.168.2.5	0x4679	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.219693899 CET	1.1.1.1	192.168.2.5	0x4679	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:00.359489918 CET	1.1.1.1	192.168.2.5	0xfba8	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:04.359673977 CET	1.1.1.1	192.168.2.5	0x9464	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:06.496112108 CET	1.1.1.1	192.168.2.5	0xf37a	Name error (3)	2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com	none	none	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:06.548281908 CET	1.1.1.1	192.168.2.5	0xff9d	No error (0)	45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com	ma1prdapp01-canary.netmon.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:06.548281908 CET	1.1.1.1	192.168.2.5	0xff9d	No error (0)	ma1prdapp01-canary.netmon.azure.com	ma1prdapp01-canary.southindia.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:08.550780058 CET	1.1.1.1	192.168.2.5	0x2218	Name error (3)	238358d141a1b2850f10e9a50017a441.clo.footprintdns.com	none	none	A (IP address)	IN (0x0001)	false
Jan 3, 2025 15:26:10.588109970 CET	1.1.1.1	192.168.2.5	0xc8f1	No error (0)	a-0019.a.dns.azurefd.net	a-0019.standard.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 3, 2025 15:26:59.419344902 CET	1.1.1.1	192.168.2.5	0xc861	No error (0)	w.nanweng.cn		47.103.45.17	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

code.jquery.com

sb.scorecardresearch.com

w.nanweng.cn

w.nanweng.cn

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:25:54.648322105 CET	223	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jan 3, 2025 15:25:54.648488045 CET	13	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:25:54.648333073 CET	223	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jan 3, 2025 15:25:54.648375034 CET	331	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 6a 67 63 41 6a 49 7a 4d 52 45 69 41 51 51 63 4a 79 67 68 41 6a 45 73 49 67 49 6b 41 53 6f 59 49 67 59 48 41 43 49 42 42 42 49 6d 4c 7a 35 59 4a 79 67 68 48 7a 45 76 50 67 49 6b 41 69 49 Data Ascii: js=DhIhAwgjKRsxKCJdJjgcAjIzMREiAQQcJyghAjEsIgIkASoYIgYHACIBBBImLz5YJyghHzEvPgIkAiIRJj8_WyQ-ABMlWSUAMhExByZZMl4xLzocMj86XzE8LlokPwBfJS8AETECIhgiBSUbMSgiXSYRMhwnKCERDygiXSYoHAIPPAcAIgEEAiY-KhIxPy5bJD8pBiYvMhwlLCYcJREDBiUBCFoyWTJeJC8AXjIGJlkxPzIC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49743	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:06.224415064 CET	223	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jan 3, 2025 15:26:06.224431038 CET	13	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49744	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:06.224539995 CET	223	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jan 3, 2025 15:26:06.224558115 CET	331	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 6a 67 63 41 6a 49 7a 4d 52 45 69 41 51 51 63 4a 79 67 68 41 6a 45 73 49 67 49 6b 41 53 6f 59 49 67 59 48 41 43 49 42 42 42 49 6d 4c 7a 35 59 4a 79 67 68 48 7a 45 76 50 67 49 6b 41 69 49 Data Ascii: js=DhIhAwgjKRsxKCJdJjgcAjIzMREiAQQcJyghAjEsIgIkASoYIgYHACIBBBImLz5YJyghHzEvPgIkAiIRJj8_WyQ-ABMlWSUAMhExByZZMl4xLzocMj86XzE8LlokPwBfJS8AETECIhgiBSUbMSgiXSYRMhwnKCERDygiXSYoHAIPPAcAIgEEAiY-KhIxPy5bJD8pBiYvMhwlLCYcJREDBiUBCFoyWTJeJC8AXjIGJlkxPzIC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49786	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:18.630502939 CET	223	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jan 3, 2025 15:26:18.630520105 CET	331	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 6a 67 63 41 6a 49 7a 4d 52 45 69 41 51 51 63 4a 79 67 68 41 6a 45 73 49 67 49 6b 41 53 6f 59 49 67 59 48 41 43 49 42 42 42 49 6d 4c 7a 35 59 4a 79 67 68 48 7a 45 76 50 67 49 6b 41 69 49 Data Ascii: js=DhIhAwgjKRsxKCJdJjgcAjIzMREiAQQcJyghAjEsIgIkASoYIgYHACIBBBImLz5YJyghHzEvPgIkAiIRJj8_WyQ-ABMlWSUAMhExByZZMl4xLzocMj86XzE8LlokPwBfJS8AETECIhgiBSUbMSgiXSYRMhwnKCERDygiXSYoHAIPPAcAIgEEAiY-KhIxPy5bJD8pBiYvMhwlLCYcJREDBiUBCFoyWTJeJC8AXjIGJlkxPzIC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49785	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:18.630525112 CET	223	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jan 3, 2025 15:26:18.630568981 CET	13	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49860	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:31.129635096 CET	223	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jan 3, 2025 15:26:31.129647017 CET	13	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49859	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:31.129673958 CET	223	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jan 3, 2025 15:26:31.129703999 CET	331	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 6a 67 63 41 6a 49 7a 4d 52 45 69 41 51 51 63 4a 79 67 68 41 6a 45 73 49 67 49 6b 41 53 6f 59 49 67 59 48 41 43 49 42 42 42 49 6d 4c 7a 35 59 4a 79 67 68 48 7a 45 76 50 67 49 6b 41 69 49 Data Ascii: js=DhIhAwgjKRsxKCJdJjgcAjIzMREiAQQcJyghAjEsIgIkASoYIgYHACIBBBImLz5YJyghHzEvPgIkAiIRJj8_WyQ-ABMlWSUAMhExByZZMl4xLzocMj86XzE8LlokPwBfJS8AETECIhgiBSUbMSgiXSYRMhwnKCERDygiXSYoHAIPPAcAIgEEAiY-KhIxPy5bJD8pBiYvMhwlLCYcJREDBiUBCFoyWTJeJC8AXjIGJlkxPzIC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49938	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:43.676642895 CET	223	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jan 3, 2025 15:26:43.676662922 CET	331	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 6a 67 63 41 6a 49 7a 4d 52 45 69 41 51 51 63 4a 79 67 68 41 6a 45 73 49 67 49 6b 41 53 6f 59 49 67 59 48 41 43 49 42 42 42 49 6d 4c 7a 35 59 4a 79 67 68 48 7a 45 76 50 67 49 6b 41 69 49 Data Ascii: js=DhIhAwgjKRsxKCJdJjgcAjIzMREiAQQcJyghAjEsIgIkASoYIgYHACIBBBImLz5YJyghHzEvPgIkAiIRJj8_WyQ-ABMlWSUAMhExByZZMl4xLzocMj86XzE8LlokPwBfJS8AETECIhgiBSUbMSgiXSYRMhwnKCERDygiXSYoHAIPPAcAIgEEAiY-KhIxPy5bJD8pBiYvMhwlLCYcJREDBiUBCFoyWTJeJC8AXjIGJlkxPzIC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49937	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:43.742341995 CET	223	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jan 3, 2025 15:26:43.743345976 CET	13	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50028	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:26:59.427057981 CET	370	OUT	POST /qy/ov HTTP/1.1 Host: w.nanweng.cn Content-Length: 186 Connection:close Accept-Language: zh-cn Cache-Conbtrol:no-cache Content-Type:application/x-www-form-urlencoded Data Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50029	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:27:03.054822922 CET	370	OUT	POST /qy/ov HTTP/1.1 Host: w.nanweng.cn Content-Length: 186 Connection:close Accept-Language: zh-cn Cache-Conbtrol:no-cache Content-Type:application/x-www-form-urlencoded Data Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50030	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:27:06.676209927 CET	370	OUT	POST /qy/ov HTTP/1.1 Host: w.nanweng.cn Content-Length: 186 Connection:close Accept-Language: zh-cn Cache-Conbtrol:no-cache Content-Type:application/x-www-form-urlencoded Data Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50031	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:27:10.301943064 CET	370	OUT	POST /qy/ov HTTP/1.1 Host: w.nanweng.cn Content-Length: 186 Connection:close Accept-Language: zh-cn Cache-Conbtrol:no-cache Content-Type:application/x-www-form-urlencoded Data Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50032	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:27:10.430201054 CET	223	OUT	POST /qy/rq HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 504 Host: w.nanweng.cn
Jan 3, 2025 15:27:10.430227995 CET	504	OUT	Data Raw: 26 69 6e 66 3d 7b 22 61 62 22 3a 30 2c 22 61 70 70 69 64 22 3a 31 2c 22 61 76 6c 74 22 3a 6e 75 6c 6c 2c 22 61 76 73 22 3a 30 2c 22 62 63 6c 6b 22 3a 30 2c 22 62 70 22 3a 30 2c 22 63 69 64 22 3a 30 2c 22 63 6b 77 22 3a 22 22 2c 22 63 6c 72 22 3a Data Ascii: &inf={"ab":0,"appid":1,"avlt":null,"avs":0,"bclk":0,"bp":0,"cid":0,"ckw":"","clr":0,"cont":0,"conw":0,"ddr":0,"dlr":0,"etrc":20,"etrc2":0,"fre":0,"frr":0,"fs":0,"gqp":0,"kspdf":0,"kspic":0,"kszip":0,"lbc":0,"lbcr":0,"mbp":0,"md":0,"md5":"31549

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50033	47.103.45.17	80	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 15:27:22.114681005 CET	223	OUT	POST /qy/lq HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 102 Host: w.nanweng.cn
Jan 3, 2025 15:27:22.114716053 CET	102	OUT	Data Raw: 6c 71 3d 7b 22 61 70 70 69 64 22 3a 31 2c 22 62 33 22 3a 30 2c 22 62 33 64 22 3a 30 2c 22 62 33 69 22 3a 30 2c 22 62 71 22 3a 30 2c 22 62 71 64 22 3a 30 2c 22 62 71 69 22 3a 30 2c 22 75 69 64 22 3a 22 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 Data Ascii: lq={"appid":1,"b3":0,"b3d":0,"b3i":0,"bq":0,"bqd":0,"bqi":0,"uid":"102e1490f0604c078f675cf9899bc6e6"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49727	151.101.194.137	443	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:26:00 UTC	358	OUT	GET /jquery-3.6.3.min.js HTTP/1.1 Accept: / Referer: https://www.msn.com/?ocid=iehp Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: code.jquery.com Connection: Keep-Alive
2025-01-03 14:26:00 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89947 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15f5b" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 881384 Date: Fri, 03 Jan 2025 14:26:00 GMT X-Served-By: cache-lga21985-LGA, cache-nyc-kteb1890074-NYC X-Cache: HIT, HIT X-Cache-Hits: 1329, 0 X-Timer: S1735914361.769254,VS0,VE1 Vary: Accept-Encoding
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 33 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.3 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 45 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 45 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 45 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=E.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return E.each(this,e)},map:function(n){return this.pushStack(E.map(this,f
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 79 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=y.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 76 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 45 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 69 66 28 64 2e 63 73 73 53 75 70 70 6f 72 74 73 53 65 6c 65 63 74 6f 72 26 26 21 43 53 53 2e 73 75 70 70 6f 72 74 73 28 22 73 65 6c 65 63 74 6f Data Ascii: )){(f=ee.test(t)&&ve(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=E)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{if(d.cssSupportsSelector&&!CSS.supports("selecto
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 22 69 6e 20 65 26 26 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 61 29 7b 72 65 74 75 72 6e 20 6c 65 28 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6f 3d 2b 6f 2c 6c 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 76 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e Data Ascii: "in e&&e.disabled===t}}function ye(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ve(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 3f 28 62 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 74 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 53 29 7b 76 61 72 20 6e 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 72 65 74 75 72 6e 20 6e 3f 5b 6e 5d 3a 5b 5d 7d 7d 29 3a 28 62 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 Data Ascii: ?(b.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return e.getAttribute("id")===t}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&S){var n=t.getElementById(e);return n?[n]:[]}}):(b.filter.ID=function(e){var n=e.replace
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 52 2b 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 45 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 7e 3d 22 29 2c 28 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 22 29 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 Data Ascii: [selected]").length\|\|y.push("\\["+M+"(?:value\|"+R+")"),e.querySelectorAll("[id~="+E+"-]").length\|\|y.push("~="),(t=C.createElement("input")).setAttribute("name",""),e.appendChild(t),e.querySelectorAll("[name='']").length\|\|y.push("\\["+M+"name"+M+"*="+M+"
2025-01-03 14:26:00 UTC	1378	IN	Data Raw: 6e 74 45 6c 65 6d 65 6e 74 7c 7c 65 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 6a 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 Data Ascii: ntElement\|\|e,r=t&&t.parentNode;return e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},j=t?function(e,t){if(e===t)retu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49725	18.244.18.122	443	768	C:\Users\user\Desktop\nv8401986_110422.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 14:26:00 UTC	542	OUT	GET /b?rn=1735914359603&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=30919B60838E69BC08808E09822668DF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Accept: / Referer: https://www.msn.com/?ocid=iehp Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: sb.scorecardresearch.com Connection: Keep-Alive
2025-01-03 14:26:01 UTC	435	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 03 Jan 2025 14:26:01 GMT set-cookie: UID=1DD555d6637f2e69e913c321735914361; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 cbad29402e4e90baabe7151c3f1203b6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: AEAAGNMMXtpOB_QKsnKvle-xa9mEzyem8mGrqShzlRApRyzVgb91bg==

Target ID:	0
Start time:	09:25:53
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\nv8401986_110422.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nv8401986_110422.exe"
Imagebase:	0x400000
File size:	668'064 bytes
MD5 hash:	31549917CDC6E3F9D40A48EA5998493F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qjwmonkey, Description: Yara detected Qjwmonkey, Source: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	85

Executed Functions

Function 00468E20 Relevance: 158.1, APIs: 27, Strings: 63, Instructions: 636
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004552D0: RtlInitializeCriticalSection.NTDLL(00597F68), ref: 00455352
Part of subcall function 004552D0: __Init_thread_footer.LIBCMT ref: 0045536E
Part of subcall function 004552D0: RtlEnterCriticalSection.NTDLL ref: 00455389
Part of subcall function 004552D0: RtlLeaveCriticalSection.NTDLL(00597F68), ref: 004553E1

GetProcAddress.KERNEL32(?,?), ref: 00468ED4
SetupDiGetClassDevsW.SETUPAPI(00000000,00000000,00000000,0000000E,00000000,00000020,7591F550), ref: 00468EE4
GetProcAddress.KERNEL32(?,?), ref: 00468F4C
GetProcAddress.KERNEL32(?,?), ref: 00468FC2
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(?,0000001C,00000007,00000000,?,000007FE,00000000), ref: 00468FE9
GetProcAddress.KERNEL32(?,?), ref: 0046904C
GetProcAddress.KERNEL32(?,00466E87), ref: 004690D0
GetProcAddress.KERNEL32(?,?), ref: 00469113
GetProcAddress.KERNEL32(?,?), ref: 00469156
GetProcAddress.KERNEL32(?,?), ref: 00469199
GetProcAddress.KERNEL32(?,?), ref: 004691DC
GetProcAddress.KERNEL32(?,?), ref: 0046921F
GetProcAddress.KERNEL32(?,?), ref: 00469262
GetProcAddress.KERNEL32(?,?), ref: 004692A5
GetProcAddress.KERNEL32(?,?), ref: 004692E8
GetProcAddress.KERNEL32(?,?), ref: 0046932B
GetProcAddress.KERNEL32(?,?), ref: 00469377
GetProcAddress.KERNEL32(?,?), ref: 004693C6
GetProcAddress.KERNEL32(?,?), ref: 00469415
GetProcAddress.KERNEL32(?,?), ref: 00469464
GetProcAddress.KERNEL32(?,?), ref: 004694B3
GetProcAddress.KERNEL32(?,?), ref: 00469502
GetProcAddress.KERNEL32(?,?), ref: 00469551
GetProcAddress.KERNEL32(?,?), ref: 004695A0
GetProcAddress.KERNEL32(?,?), ref: 004695EB
GetProcAddress.KERNEL32(?,?), ref: 004697C9
SetupDiDestroyDeviceInfoList.SETUPAPI(?), ref: 004697D7

Part of subcall function 00408050: RtlInitializeCriticalSection.NTDLL(00597B94), ref: 004080BE
Part of subcall function 00408050: __Init_thread_footer.LIBCMT ref: 004080DA
Part of subcall function 00408050: RtlEnterCriticalSection.NTDLL(00597B94), ref: 004080F5
Part of subcall function 00408050: RtlLeaveCriticalSection.NTDLL(00597B94), ref: 0040814B

Strings

vnd scsi, xrefs: 004693CB
alddisk, xrefs: 004692AA
DiskDrive, xrefs: 00468FFA, 00469000
StrS, xrefs: 0046935D
bnvirtualscsihba, xrefs: 0046941A
hin virtual, xrefs: 00469556
msft virtual, xrefs: 004695F0
kic.disk, xrefs: 00469224
trIA, xrefs: 0046958F
evsW, xrefs: 00468EC3
StrS, xrefs: 004693A9
StrS, xrefs: 004692D4
trIA, xrefs: 00469404
ccboot, xrefs: 0046937C
bxp virtual, xrefs: 00469469
StrS, xrefs: 00469583
StrS, xrefs: 0046920B
netzone, xrefs: 00469118
trIA, xrefs: 004691D1
kb.mdisk, xrefs: 00469507
Info, xrefs: 004697AE
StrS, xrefs: 00469291
trIA, xrefs: 004695DA
StrS, xrefs: 004695CE
trIA, xrefs: 00469214
vice, xrefs: 004697A4
trIA, xrefs: 0046914B
StrS, xrefs: 004691C8
vhd cms, xrefs: 004692ED
deepin, xrefs: 004691E1
trIA, xrefs: 004692DD
trIA, xrefs: 004694F1
trIA, xrefs: 004690C5
StrS, xrefs: 00469496
trIA, xrefs: 0046929A
StrS, xrefs: 00469447
trIA, xrefs: 00469369
trIA, xrefs: 00469257
StrS, xrefs: 00469185
StrS, xrefs: 004690FF
mzd.live, xrefs: 00469330
trIA, xrefs: 004693B5
A, xrefs: 00469043
nmenu, xrefs: 00469267
diskless, xrefs: 0046915B
StrS, xrefs: 00469142
vdiskbus, xrefs: 004690D5
trIA, xrefs: 00469320
trIA, xrefs: 00469453
trIA, xrefs: 00469108
StrS, xrefs: 004690BC
trIA, xrefs: 004694A2
s.t. virtual, xrefs: 004694B8
StrS, xrefs: 00469317
StrS, xrefs: 004694E5
trIA, xrefs: 00469540
StrS, xrefs: 00469534
List, xrefs: 004697B8
StrS, xrefs: 004693F8
StrS, xrefs: 0046924E
trIA, xrefs: 0046918E
richdisk, xrefs: 0046919E
obm virtual, xrefs: 004695A5

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalSection$Setup$DeviceEnterInit_thread_footerInitializeLeave$ClassDestroyDevsInfoListPropertyRegistry
String ID: A$DiskDrive$Info$List$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$alddisk$bnvirtualscsihba$bxp virtual$ccboot$deepin$diskless$evsW$hin virtual$kb.mdisk$kic.disk$msft virtual$mzd.live$netzone$nmenu$obm virtual$richdisk$s.t. virtual$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$vdiskbus$vhd cms$vice$vnd scsi
API String ID: 4133971413-3214769527
Opcode ID: 40a03a09d682788497bf71224092913341c22b9e281f77c82b283975d84d8802
Instruction ID: f1412aaa6c317a73c9a6238af3eaddf4ae2b8cf5081a018ee8fa29b5caced83a
Opcode Fuzzy Hash: 40a03a09d682788497bf71224092913341c22b9e281f77c82b283975d84d8802
Instruction Fuzzy Hash: D3426370A1165A9FEB51DF64CD40BAABBF8BF49304F004199E40CE7241EBB4AE84CF65

Function 00466CF0 Relevance: 73.9, APIs: 24, Strings: 18, Instructions: 385
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

GetProcAddress.KERNEL32(?,?), ref: 00466D55
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00466D77
GetProcAddress.KERNEL32(00000000), ref: 00466D7E
GetCurrentProcess.KERNEL32(00000000), ref: 00466D8D
GetCurrentProcess.KERNEL32 ref: 00466DB5
GetProcAddress.KERNEL32(?,?), ref: 00466DF7
CheckRemoteDebuggerPresent.KERNEL32(?,00000000), ref: 00466E0C
GetProcAddress.KERNEL32(?,?), ref: 00466E3B
RtlInitializeCriticalSection.NTDLL(00598088), ref: 00466EFC

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 00466F1B

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00598088), ref: 00466F3C
RtlLeaveCriticalSection.NTDLL(00598088), ref: 00466F8F
KiUserExceptionDispatcher.NTDLL ref: 00466F9A

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

GetSystemTime.KERNEL32(?,00000000,00000020,?,00000800), ref: 004670B8
GetProcAddress.KERNEL32(?,?), ref: 004670ED
GetTimeZoneInformation.KERNEL32(?), ref: 004670FC
RasEnumConnectionsW.RASAPI32(00000000,00000000,00000000,?), ref: 00467149
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0046715A
RtlAllocateHeap.NTDLL(00000000), ref: 00467161
GetProcessHeap.KERNEL32(00000000,?), ref: 0046719C
HeapFree.KERNEL32(00000000), ref: 004671A3
GetModuleHandleW.KERNEL32(ntdll.dll,RtlGetNtVersionNumbers), ref: 004671C1
GetProcAddress.KERNEL32(00000000), ref: 004671C8
GetVersionExA.KERNEL32(0000009C), ref: 00467211

Strings

IsWow64Process, xrefs: 00466D5F
kxescore.exe, xrefs: 00467033
HipsDaemon.exe, xrefs: 0046707B
gerP, xrefs: 00466DDF
baiduantray.exe, xrefs: 00467045
msmpeng.exe, xrefs: 00467057
360tray.exe, xrefs: 00467021
RtlGetNtVersionNumbers, xrefs: 004671B4
on, xrefs: 004670E3
ntdll.dll, xrefs: 004671B9
2345safetray.exe, xrefs: 00467069
kernel32, xrefs: 00466D64
mati, xrefs: 004670DC
wwww, xrefs: 004670FE
HipsTray.exe, xrefs: 00467089
zhudongfangyu.exe, xrefs: 00467013
qqpctray.exe, xrefs: 00467001
qqpcrtp.exe, xrefs: 00466FF3

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressProc$EnterHeapLeaveProcess$CurrentHandleInit_thread_footerInitializeModuleTime$AllocateCheckConnectionsDebuggerDispatcherEnumExceptionFreeInformationPresentRemoteSystemUserVersionZone__onexit
String ID: 2345safetray.exe$360tray.exe$HipsDaemon.exe$HipsTray.exe$IsWow64Process$RtlGetNtVersionNumbers$baiduantray.exe$gerP$kernel32$kxescore.exe$mati$msmpeng.exe$ntdll.dll$on$qqpcrtp.exe$qqpctray.exe$wwww$zhudongfangyu.exe
API String ID: 503798855-4277342592
Opcode ID: 860e2cb6446b8a7e6ee90e0b2c534e582757c971f93eaad0393da5a380b0451f
Instruction ID: 5f3d03645d4f314ccf5b96e68e19008c656b320bc30360567718ce4a257206da
Opcode Fuzzy Hash: 860e2cb6446b8a7e6ee90e0b2c534e582757c971f93eaad0393da5a380b0451f
Instruction Fuzzy Hash: A6E1D3719002069BDB10DF64DD45BEEBBF8FF04704F0481AAE549A7291EB34AA84DFE5

Function 00484290 Relevance: 68.8, APIs: 21, Strings: 18, Instructions: 509
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,EFE0703F,?,00000000), ref: 00484346
GetProcAddress.KERNEL32(00000000), ref: 00484353
GetNativeSystemInfo.KERNEL32(?), ref: 00484360
GetSystemInfo.KERNEL32(?), ref: 0048436B

Part of subcall function 0041BCA0: RtlInitializeCriticalSection.NTDLL(00597CEC), ref: 0041BD0E
Part of subcall function 0041BCA0: __Init_thread_footer.LIBCMT ref: 0041BD2A
Part of subcall function 0041BCA0: RtlEnterCriticalSection.NTDLL(00597CEC), ref: 0041BD45
Part of subcall function 0041BCA0: RtlLeaveCriticalSection.NTDLL(00597CEC), ref: 0041BD9B

GetModuleHandleW.KERNEL32(ntdll,RtlGetNtVersionNumbers), ref: 004843A8
GetProcAddress.KERNEL32(00000000), ref: 004843AF
GetProcAddress.KERNEL32(?,?), ref: 0048449D
GetProcAddress.KERNEL32(?,?), ref: 004844F8
GetProcAddress.KERNEL32(?,?), ref: 0048455A
GetProcAddress.KERNEL32(?,?), ref: 004845B6
GetProcAddress.KERNEL32(?,?), ref: 00484675
GetProcAddress.KERNEL32(?,?), ref: 004846F8
GetProcAddress.KERNEL32(?,?), ref: 0048499B
GetProcAddress.KERNEL32(?,?), ref: 004849DF
GetProcAddress.KERNEL32(?,?), ref: 00484A23

Strings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT %d.%d; WOW%d; Trident/5.0), xrefs: 0048445C
ttpC, xrefs: 00484542
Avai, xrefs: 0048484A
kernel32.dll, xrefs: 0048430B
ttpO, xrefs: 0048448F
pen, xrefs: 00484496
Content-Type:application/x-www-form-urlencoded, xrefs: 004845EF
ers, xrefs: 00484759
RtlGetNtVersionNumbers, xrefs: 0048439E
ntdll, xrefs: 004843A3
POST, xrefs: 004845D4
dlk, xrefs: 004847CC
labl, xrefs: 00484854
GetNativeSystemInfo, xrefs: 00484306
WinH, xrefs: 00484539
WinH, xrefs: 00484486
onne, xrefs: 00484549
spon, xrefs: 004846E7

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalSection$HandleInfoModuleSystem$EnterInit_thread_footerInitializeLeaveNative
String ID: Avai$Content-Type:application/x-www-form-urlencoded$GetNativeSystemInfo$Mozilla/5.0 (compatible; MSIE 9.0; Windows NT %d.%d; WOW%d; Trident/5.0)$POST$RtlGetNtVersionNumbers$WinH$WinH$dlk$ers$kernel32.dll$labl$ntdll$onne$pen$spon$ttpC$ttpO
API String ID: 1895558709-3909303831
Opcode ID: c3680bc09fd9fe4b06f284ddf52e57c29487363e92069cf4c727d5b25ac6ee33
Instruction ID: c9fcf2df0ea9e39ac236a7160a13d4d9c0a290458981adaaee3e139567d5a063
Opcode Fuzzy Hash: c3680bc09fd9fe4b06f284ddf52e57c29487363e92069cf4c727d5b25ac6ee33
Instruction Fuzzy Hash: 6F324F70A042599FEB24DF69DC45BAEB7F4FF48304F04819EE488A7251EB749A84CF94

Function 00406230 Relevance: 46.7, APIs: 13, Strings: 13, Instructions: 1166libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 004062B9

Part of subcall function 00408050: RtlInitializeCriticalSection.NTDLL(00597B94), ref: 004080BE
Part of subcall function 00408050: __Init_thread_footer.LIBCMT ref: 004080DA
Part of subcall function 00408050: RtlEnterCriticalSection.NTDLL(00597B94), ref: 004080F5
Part of subcall function 00408050: RtlLeaveCriticalSection.NTDLL(00597B94), ref: 0040814B

GetProcAddress.KERNEL32(?,?), ref: 00406423
PathFileExistsA.SHLWAPI(00000000,00000011,00000000,\Mozilla\Firefox\,00000011,?,00000000,?), ref: 00406430
GetProcAddress.KERNEL32(?,?), ref: 00406513
PathFileExistsA.SHLWAPI(00000000,0000000C,00000000,profiles.ini,0000000C,00000000), ref: 00406520
GetPrivateProfileSectionNamesA.KERNEL32(?,000007D0,00000000), ref: 00406561
GetPrivateProfileStringA.KERNEL32(00000000,Default,00000000,?,00000104,00000000), ref: 00406899
GetProcAddress.KERNEL32(?,?), ref: 00406A73
PathFileExistsA.SHLWAPI(00000000,00000009,00000000,\prefs.js,00000009,00000001,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00406A80
GetPrivateProfileIntA.KERNEL32(00000000,Default,00000000,00000000), ref: 00406BCA
GetPrivateProfileStringA.KERNEL32(00000000,Path,00000000,?,00000104,00000000), ref: 00406C7A
GetProcAddress.KERNEL32(?,?), ref: 00406E53
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004072E4

Strings

)@, xrefs: 004072A1
Default, xrefs: 00406893, 00406BC4
1@, xrefs: 00407267
Path, xrefs: 00406C74
");, xrefs: 00407025
Profile, xrefs: 00406B8F
\Mozilla\Firefox\, xrefs: 004063A1
erPa, xrefs: 004062AB
about:, xrefs: 00407085
profiles.ini, xrefs: 00406491
Install, xrefs: 004067DF
\prefs.js, xrefs: 004069F1, 00406DD1
user_pref("browser.startup.homepage", ", xrefs: 00406FE2

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Section$Critical$AddressProc$PrivateProfile$ExistsFilePath$EnterInit_thread_footerInitializeLeaveString$Ios_base_dtorNamesstd::ios_base::_
String ID: ");$)@$1@$Default$Install$Path$Profile$\Mozilla\Firefox\$\prefs.js$about:$erPa$profiles.ini$user_pref("browser.startup.homepage", "
API String ID: 1618428692-886994478
Opcode ID: 6fe38041be1fdfc615b5ce297cc08eeef60a7be6911b008d6ab6d34982a8a5a9
Instruction ID: cf5b45e382433dad7b66343c8106350e14a4410f024a3f984de5edf9a9f8b7f0
Opcode Fuzzy Hash: 6fe38041be1fdfc615b5ce297cc08eeef60a7be6911b008d6ab6d34982a8a5a9
Instruction Fuzzy Hash: 63B2A071E002199FDB24CF68CC44BDEBBB5AF46304F1481A9D409B7681DB79AAC4CF96

Function 00467C10 Relevance: 42.4, APIs: 15, Strings: 9, Instructions: 382
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WS2_32(w.nanweng.cn), ref: 00467D74
socket.WS2_32(00000002,00000001,00000006), ref: 00467D8E
htons.WS2_32(00000050), ref: 00467DB7
connect.WS2_32(00000000,?,00000010), ref: 00467DE1
setsockopt.WS2_32(00000000,0000FFFF,00001005,?), ref: 00467E0D
setsockopt.WS2_32(00000000,0000FFFF,00001006,00000BB8,00000004), ref: 00467E27

Part of subcall function 004681F0: ___from_strstr_to_strchr.LIBCMT ref: 00468283
Part of subcall function 004681F0: ___from_strstr_to_strchr.LIBCMT ref: 00468299
Part of subcall function 004681F0: ___from_strstr_to_strchr.LIBCMT ref: 004682E2

Part of subcall function 004833E0: MultiByteToWideChar.KERNEL32(000003A8,00000000,-00000808,000000FF,00000000,00000000,?,?,?,-00000808,?,0043952F,00000000,00000000,?), ref: 0048340F
Part of subcall function 004833E0: MultiByteToWideChar.KERNEL32(000003A8,00000000,-00000808,000000FF,00000000,?,?,?,?,?,?,?,?), ref: 00483446
Part of subcall function 004833E0: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0048345E

send.WS2_32(00000000,?,?,00000000), ref: 00467FEF
recv.WS2_32(00000000,?,00001000,00000000), ref: 00468027
closesocket.WS2_32(00000000), ref: 00468032
Sleep.KERNEL32(0000012C,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 0046803E
closesocket.WS2_32(00000000), ref: 00468047
Sleep.KERNEL32(0000012C,?,?,?,0054AF36,000000FF), ref: 00468058
closesocket.WS2_32(00000000), ref: 0046806B
_strstr.LIBCMT ref: 0046808C
_strstr.LIBCMT ref: 004680A4

Strings

POST %s HTTP/1.1Host: %s Content-Length: %d Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencoded, xrefs: 00467F54
&type=%d, xrefs: 00467E66
HTTP/1.0, xrefs: 0046809E
/qy/sv, xrefs: 00467E31
w.nanweng.cn, xrefs: 00467D5C, 00467D6F
&sig, xrefs: 00467EC9
XNtu, xrefs: 00467E9E
/qy/ov, xrefs: 00467E48
HTTP/1.1, xrefs: 00468081

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide___from_strstr_to_strchrclosesocket$Sleep_strstrsetsockopt$connectgethostbynamehtonsrecvsendsocket
String ID: &sig$&type=%d$/qy/ov$/qy/sv$HTTP/1.0$HTTP/1.1$POST %s HTTP/1.1Host: %s Content-Length: %d Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencoded$XNtu$w.nanweng.cn
API String ID: 293188133-3395050707
Opcode ID: 7e932a45503a7cf9c367a48e5592eb9f7211bb9af79cba3000aa024051e5d15c
Instruction ID: 20ad16803cbc53e3b9e6f1a94dfd60e8fc27be4d45141a1dc5012682db642f54
Opcode Fuzzy Hash: 7e932a45503a7cf9c367a48e5592eb9f7211bb9af79cba3000aa024051e5d15c
Instruction Fuzzy Hash: 20E1C1719002299BEB20DF54CC4DBDEBBB4BF69304F0141EAE609A7281EB745AC9CF55

Function 004886E0 Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 256
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 00488750
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004887C0
GetProcAddress.KERNEL32(?,?), ref: 00488821
PathFileExistsA.SHLWAPI(?), ref: 00488830
SetFileAttributesA.KERNEL32(?,00000080), ref: 00488846
GetPrivateProfileStringA.KERNEL32(info,time,00000000,?,00000014,?), ref: 00488877
GetPrivateProfileIntA.KERNEL32(info,install,00000000,?), ref: 004888C9
GetPrivateProfileIntA.KERNEL32(info,round,00000001,?), ref: 004888E0
WritePrivateProfileStringA.KERNEL32(info,round,?,?), ref: 0048892B
WritePrivateProfileStringA.KERNEL32(info,install,00578800,?), ref: 0048894C
WritePrivateProfileStringA.KERNEL32(info,install,00578624,?), ref: 00488972
WritePrivateProfileStringA.KERNEL32(info,time,?,?), ref: 004889C9
WritePrivateProfileStringA.KERNEL32(info,round,00578800,?), ref: 004889E1
WritePrivateProfileStringA.KERNEL32(info,install,00578624,?), ref: 00488A09

Strings

round, xrefs: 004888D6, 00488921, 004889D7
time, xrefs: 00488866, 004889BF
\roundinfo.ini, xrefs: 004887A6
install, xrefs: 004888BF, 00488942, 00488968, 004889FF
info, xrefs: 0048886E, 004888C4, 004888DB, 00488926, 00488947, 0048896D, 004889C4, 004889DC, 00488A04
erPa, xrefs: 00488742
%d-%d-%d, xrefs: 004887E1

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: PrivateProfile$String$Write$CriticalSection$AddressFileProc$AttributesEnterExistsInit_thread_footerInitializeLeaveLocalPathTime
String ID: %d-%d-%d$\roundinfo.ini$erPa$info$install$round$time
API String ID: 3222017063-1215182308
Opcode ID: 1a77383c345253648a27d2d35622dfc4e6db949501e5251d8b5293ddfabaf069
Instruction ID: 74520b6e4be4bcd6b7e63c33a4990e336f2dfd45e9c279385226847379a961ad
Opcode Fuzzy Hash: 1a77383c345253648a27d2d35622dfc4e6db949501e5251d8b5293ddfabaf069
Instruction Fuzzy Hash: F791F871E40218AADB10DB64EC46FEEBBBCFF14714F404156F509E2180EF75AA88DB55

Function 0046A5B0 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 131
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,75920E50), ref: 0046A5F0
LoadCursorW.USER32(00000000,00007F00), ref: 0046A60A
RegisterClassExW.USER32(00000030), ref: 0046A617
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0046A621
CreateWindowExW.USER32(00000000,DownLoadFrame_splash,00000000,960A0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0046A63E
GetModuleHandleW.KERNEL32(00000000,00000087,ZIP), ref: 0046A65D
FindResourceW.KERNEL32(00000000), ref: 0046A660
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0046A674
SizeofResource.KERNEL32(00000000), ref: 0046A677
GetModuleHandleW.KERNEL32(00000000,?), ref: 0046A68B
LoadResource.KERNEL32(00000000), ref: 0046A68E
FreeResource.KERNEL32(?), ref: 0046A6C4

Part of subcall function 00490850: CoInitialize.OLE32(00000000), ref: 00490862

Part of subcall function 004909A0: IsWindow.USER32(?), ref: 004909AE

Strings

ZIP, xrefs: 0046A651
0xW, xrefs: 0046A5C0
DownLoadFrame_splash, xrefs: 0046A5FC, 0046A637
0, xrefs: 0046A5E7
start_window, xrefs: 0046A6D8, 0046A6EA

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: HandleModule$Resource$LoadWindow$ClassCreateCursorFindFreeInitializeRegisterSizeof
String ID: 0$0xW$DownLoadFrame_splash$ZIP$start_window
API String ID: 909464850-2096845513
Opcode ID: d8ad461c0631003e10f27412f44cfaa4357ae0d26e70c484f9914ac28b92c4c6
Instruction ID: ad9b6c04108eb9a248668a967f6ccfc5f882ad1d50095b89f64277dc50d21b5c
Opcode Fuzzy Hash: d8ad461c0631003e10f27412f44cfaa4357ae0d26e70c484f9914ac28b92c4c6
Instruction Fuzzy Hash: 55419271A40305BBDB10AFA5EC4AF9FBFB8FF45705F104025F904AA291EA74D510DBA6

Function 0048BDF0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 141
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(005980E4), ref: 0048BE69

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0048BE85

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(005980E4), ref: 0048BEA6
LoadLibraryA.KERNEL32(0054C9B4,7591F550), ref: 0048BF19
GetProcAddress.KERNEL32(00000000,?), ref: 0048BF36
RtlLeaveCriticalSection.NTDLL(005980E4), ref: 0048BF5B

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

NtProtectVirtualMemory.NTDLL(00000020,EFE0703F,00000000,00827338,7591F550), ref: 0048BF66
_strstr.LIBCMT ref: 0048BFBE
_strstr.LIBCMT ref: 0048BFD0

Strings

d3d9.dll, xrefs: 0048BEEF
.dll, xrefs: 0048BF0E
@F, xrefs: 0048BEF3
0F, xrefs: 0048BEE5
Virtual, xrefs: 0048BFCA
d3d9, xrefs: 0048BF07

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$_strstr$AddressInit_thread_footerInitializeLibraryLoadMemoryProcProtectVirtual__onexit
String ID: .dll$0F$@F$Virtual$d3d9$d3d9.dll
API String ID: 3498987271-3011228226
Opcode ID: 2f6fec5cb7b27c4d206ec02e00f4b99b2f6c7e52b2bfc0d404402d38f77e4284
Instruction ID: f15275ee4044624cbc07a93cf487b0c652e3cd363e09185a1649f875cbd55c32
Opcode Fuzzy Hash: 2f6fec5cb7b27c4d206ec02e00f4b99b2f6c7e52b2bfc0d404402d38f77e4284
Instruction Fuzzy Hash: F751E2B0900215DFDB10DF68DC49BAEBBB4FF09704F00856AE618A7291DB749A48CFA4

Function 00410800 Relevance: 25.1, APIs: 11, Strings: 3, Instructions: 621
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32 ref: 00410886
GetProcAddress.KERNEL32(?,?), ref: 004108D9
SHGetPathFromIDListW.SHELL32(?,?,?,?), ref: 004108EE
FindFirstFileW.KERNEL32(?,?), ref: 00410961
CoInitialize.OLE32(00000000), ref: 004109E9
CoCreateInstance.COMBASE(00564920,00000000,00000001,005648E0,?), ref: 00410A18
_wcsrchr.LIBVCRUNTIME ref: 00410B0A
_wcschr.LIBVCRUNTIME ref: 00410BD6
CoUninitialize.COMBASE ref: 00411137
FindNextFileW.KERNELBASE(00000000,?), ref: 00411145
FindClose.KERNEL32(00000000), ref: 00411154

Strings

istW, xrefs: 004108CE
erLo, xrefs: 0041086E
*.lnk, xrefs: 00410940

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalFindSection$AddressFileInitializeProc$CloseCreateEnterFirstFromInit_thread_footerInstanceLeaveListNextPathUninitialize_wcschr_wcsrchr
String ID: *.lnk$erLo$istW
API String ID: 2365766609-1183018039
Opcode ID: 756cb243502ccf9dcbfde1438c42cb77981b3990fb4c093f882ea49872d860d3
Instruction ID: a0b16b1e9ac4d51bb1c80a6feb5eb2be886ae33204ab1d23e24a08d4a010e1f7
Opcode Fuzzy Hash: 756cb243502ccf9dcbfde1438c42cb77981b3990fb4c093f882ea49872d860d3
Instruction Fuzzy Hash: 5A428C719002599FDB24DF24CD85BDAB7B5AF44304F0445EAE509BB291EBB4AE88CF90

Function 0048FD60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0048FD9E

Part of subcall function 00408050: RtlInitializeCriticalSection.NTDLL(00597B94), ref: 004080BE
Part of subcall function 00408050: __Init_thread_footer.LIBCMT ref: 004080DA
Part of subcall function 00408050: RtlEnterCriticalSection.NTDLL(00597B94), ref: 004080F5
Part of subcall function 00408050: RtlLeaveCriticalSection.NTDLL(00597B94), ref: 0040814B

GetProcAddress.KERNEL32(?,?), ref: 0048FDD2
LoadLibraryW.KERNEL32(?), ref: 0048FDEF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 0048FE09
GetAdaptersInfo.IPHLPAPI(?,?), ref: 0048FE2B
FreeLibrary.KERNEL32(?), ref: 0048FEFA

Strings

Path, xrefs: 0048FDBB
GetAdaptersInfo, xrefs: 0048FE03
iphlpapi.dll, xrefs: 0048FDD7
Appe, xrefs: 0048FDC4

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressLibraryProc$AdaptersDirectoryEnterFreeInfoInit_thread_footerInitializeLeaveLoadSystem
String ID: Appe$GetAdaptersInfo$Path$iphlpapi.dll
API String ID: 1616508286-1552646832
Opcode ID: 1edd6e4c4d1f834106fb67e53f20c82a667814674a90d2a2a0b6453cc7e3a85a
Instruction ID: 600854405f1a26696b3c7de736002c1e2b6794db6764d014896bd2a219028a9b
Opcode Fuzzy Hash: 1edd6e4c4d1f834106fb67e53f20c82a667814674a90d2a2a0b6453cc7e3a85a
Instruction Fuzzy Hash: 9E51F271A002599FCB24DFB8C8546EEBBB5AF16300F0445EBE45DE7242DB349A88CF65

Function 00483970 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98processlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

GetProcAddress.KERNEL32 ref: 004839FF
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00483A15
Process32FirstW.KERNEL32(00000000,?), ref: 00483A24
Process32NextW.KERNEL32(00000000,?), ref: 00483A4C
CloseHandle.KERNEL32(00000000), ref: 00483A53
CloseHandle.KERNEL32(00000000), ref: 00483A7B

Strings

Snap, xrefs: 004839E1
shot, xrefs: 004839EC

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseHandleProcess32$AddressCreateEnterFirstInit_thread_footerInitializeLeaveNextProcSnapshotToolhelp32
String ID: Snap$shot
API String ID: 241911490-4032188263
Opcode ID: 3b025c79f9221de9c3128e3db336f9eff6532691b060f109fd76236a8ef8a551
Instruction ID: bcfc7a51d13a840dfb915e2186f7738b2a9a8e2f9ecd4835eebd97d0d536948a
Opcode Fuzzy Hash: 3b025c79f9221de9c3128e3db336f9eff6532691b060f109fd76236a8ef8a551
Instruction Fuzzy Hash: 013184356097419BD320EF68DC897AFB7D8EFC5715F00491EF99DC2280EB74950487A6

Function 0048F7E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048F85D
DeviceIoControl.KERNEL32(00000000,002D1400,00000000,0000000C,?,00000800,00000000,00000000), ref: 0048F8D0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0048FA19
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0048FA20

Strings

\\.\PhysicalDrive%d, xrefs: 0048F835

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive%d
API String ID: 4026078076-2935326385
Opcode ID: 26a109bb306a2b735817eb4d63b2e072ca32aac009c5cafa4deea32d63d42775
Instruction ID: 49810f156e84413fbb9d0ae973cc4d75f0afff07210655de5e1847eb7a514f9e
Opcode Fuzzy Hash: 26a109bb306a2b735817eb4d63b2e072ca32aac009c5cafa4deea32d63d42775
Instruction Fuzzy Hash: B051537594021C6BEB20EB90DC45FDEB77CAB54704F1041E7E609A61C2EB74AB88CFA4

Function 0048F380 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048F410
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 0048F459
DeviceIoControl.KERNEL32(00000000,0007C088,00000200,00000020,?,00000210,00000000,00000000), ref: 0048F50A

Part of subcall function 0048F110: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0048F17B
Part of subcall function 0048F110: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0048F18A

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0048F5B7

Strings

\\.\PhysicalDrive%d, xrefs: 0048F3E5

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contextControlDevice$CloseCreateFileHandle
String ID: \\.\PhysicalDrive%d
API String ID: 1965763561-2935326385
Opcode ID: 2cf4ba7a51fadd37345ffbb9f5bf5e04af343b3b7879102c1c8590a62626aa70
Instruction ID: d93b69fd839a378a64cbd2de74eac878bc54bf4f98035448b354ecb699a6860c
Opcode Fuzzy Hash: 2cf4ba7a51fadd37345ffbb9f5bf5e04af343b3b7879102c1c8590a62626aa70
Instruction Fuzzy Hash: BD5182B1D8021CAAEB20DB149C86BDDB778AF55704F4045E9A608671C3EA742BC9CF5D

Function 0046D180 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,EFE0703F,04071060), ref: 0046D1E9
GetProcAddress.KERNEL32(00000000,?), ref: 0046D20D

Strings

pi32, xrefs: 0046D1D7
.dll, xrefs: 0046D1DE
rasa, xrefs: 0046D1D0

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$pi32$rasa
API String ID: 2574300362-1171601560
Opcode ID: 282e85a8e29a636c75e80827ee9ef6189721a69257591488fed5861b08c5999c
Instruction ID: 8ba69286e2875fa04e2028cc30cfcc9fecd9a4cef30ff8113009bae58c8e748d
Opcode Fuzzy Hash: 282e85a8e29a636c75e80827ee9ef6189721a69257591488fed5861b08c5999c
Instruction Fuzzy Hash: 041179B0C04209DFDB00CF98E9457AEFBF8FB08704F10861EE815A3250EB74AA04CBA0

Function 00467280 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 00414B40: RtlInitializeCriticalSection.NTDLL(00597C34), ref: 00414BAE
Part of subcall function 00414B40: __Init_thread_footer.LIBCMT ref: 00414BCA
Part of subcall function 00414B40: RtlEnterCriticalSection.NTDLL(00597C34), ref: 00414BE5
Part of subcall function 00414B40: RtlLeaveCriticalSection.NTDLL(00597C34), ref: 00414C39

GetAdaptersInfo.IPHLPAPI(?,00002880), ref: 004672FE

Strings

%02X-%02X-%02X-%02X-%02X-%02X, xrefs: 00467392

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AdaptersEnterInfoInit_thread_footerInitializeLeave
String ID: %02X-%02X-%02X-%02X-%02X-%02X
API String ID: 3854266947-960560484
Opcode ID: 9e23a888994caeda64439ce0ad4aabf21f5f9e37cad4cdececbd54cfffda7eff
Instruction ID: 27a56018961e61ea3aa1aafbc4271de6f5053c71d0accbddf7e508503ec92722
Opcode Fuzzy Hash: 9e23a888994caeda64439ce0ad4aabf21f5f9e37cad4cdececbd54cfffda7eff
Instruction Fuzzy Hash: B5613C71A042549FDB31CF64CC59BDABBB4AF05314F0441CAE55997682EF38AAC4CB52

Function 0041ED10 Relevance: 118.5, APIs: 5, Strings: 62, Instructions: 1281
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00415DC0: RtlInitializeCriticalSection.NTDLL(00597C64), ref: 00415E2E
Part of subcall function 00415DC0: __Init_thread_footer.LIBCMT ref: 00415E4A
Part of subcall function 00415DC0: RtlEnterCriticalSection.NTDLL(00597C64), ref: 00415E65
Part of subcall function 00415DC0: RtlLeaveCriticalSection.NTDLL(00597C64), ref: 00415EBB

GetProcAddress.KERNEL32(?,?), ref: 0041EE44
GetProcAddress.KERNEL32(?,?), ref: 0041EEC2
GetProcAddress.KERNEL32(?,?), ref: 0041EF05

Strings

sftk, xrefs: 0042048A
eyEx, xrefs: 0041EFE1
RegC, xrefs: 0041F58F
p3t, xrefs: 00420025
sbclk, xrefs: 0041F7A0
uid, xrefs: 0041F691
trIW, xrefs: 0041EEB7
slg, xrefs: 0041FEC4
tskid, xrefs: 0041F967
ddr, xrefs: 0042067F
avlt, xrefs: 00420527
StrS, xrefs: 0041EEAE
cont, xrefs: 0041FE58
appid, xrefs: 0041F707
dlr, xrefs: 004206BB
trIW, xrefs: 0041EEFA
mdo, xrefs: 0041FB10
zid, xrefs: 0041F6D4
conw, xrefs: 0041FE8E
numK, xrefs: 0041EE30
md5, xrefs: 0041F82E
lbc, xrefs: 0041FA0A
RegE, xrefs: 0041EE27
etrc, xrefs: 004205CB
.NET Framework, xrefs: 0041EF0A
sid, xrefs: 0041F73A
p1t, xrefs: 0041FFB9
kspdf, xrefs: 0041FEFA
&inf=, xrefs: 0042070C
fre, xrefs: 0041FC54
kspic, xrefs: 0041FF30
RegO, xrefs: 0041EFD1
p2t, xrefs: 0041FFEF
bclk, xrefs: 0041F76D
mio, xrefs: 0041FB7C
microsoft, xrefs: 0041EEC7
skid, xrefs: 00420553
Publisher, xrefs: 0041F06B
clr, xrefs: 00420643
mnri, xrefs: 0041FBB2
ckw, xrefs: 0041FAA4
round, xrefs: 0041F9D7
sk2id, xrefs: 0042058F
pgtp, xrefs: 0041F901
P}A, xrefs: 004207E3
kszip, xrefs: 0041FF66
cid, xrefs: 0041FA70
sftck, xrefs: 00420303
eyEx, xrefs: 0041EE37
penK, xrefs: 0041EFDA
mbp, xrefs: 0041FBE8
Key, xrefs: 0041F59F
frr, xrefs: 0041FC1E
etrc2, xrefs: 00420607
lbcr, xrefs: 0041FA3D
avs, xrefs: 0041F8CE
gqp, xrefs: 0041FD37
lose, xrefs: 0041F598
DisplayName, xrefs: 0041F0A2
p4t, xrefs: 0042005B
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041EDC0, 0041EF37
pgid, xrefs: 0041F934

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressCriticalProcSection$EnterInit_thread_footerInitializeLeave
String ID: &inf=$.NET Framework$DisplayName$Key$Publisher$P}A$RegC$RegE$RegO$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$StrS$appid$avlt$avs$bclk$cid$ckw$clr$cont$conw$ddr$dlr$etrc$etrc2$eyEx$eyEx$fre$frr$gqp$kspdf$kspic$kszip$lbc$lbcr$lose$mbp$md5$mdo$microsoft$mio$mnri$numK$p1t$p2t$p3t$p4t$penK$pgid$pgtp$round$sbclk$sftck$sftk$sid$sk2id$skid$slg$trIW$trIW$tskid$uid$zid
API String ID: 1294845845-3276813324
Opcode ID: 298135c10aa60212f5c364afa4904734bb7c0ad070eef5cc20314be292253638
Instruction ID: 42cb36eda225d88379692d1e440af2bd53be63478b1ccf7c2c8711e0ac85645b
Opcode Fuzzy Hash: 298135c10aa60212f5c364afa4904734bb7c0ad070eef5cc20314be292253638
Instruction Fuzzy Hash: 54C2B230911258EEDF14EBA5DD45BEEBBB4BF10308F40819EE049A3191EB786B48DF95

Function 004697F0 Relevance: 105.4, APIs: 21, Strings: 39, Instructions: 448
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004552D0: RtlInitializeCriticalSection.NTDLL(00597F68), ref: 00455352
Part of subcall function 004552D0: __Init_thread_footer.LIBCMT ref: 0045536E
Part of subcall function 004552D0: RtlEnterCriticalSection.NTDLL ref: 00455389
Part of subcall function 004552D0: RtlLeaveCriticalSection.NTDLL(00597F68), ref: 004553E1

GetProcAddress.KERNEL32(?,?), ref: 004698A2
SetupDiGetClassDevsW.SETUPAPI(00000000,00000000,00000000,0000000E,00000000,00000020,7591F550), ref: 004698B2
GetProcAddress.KERNEL32(?,?), ref: 00469907
GetProcAddress.KERNEL32(?,?), ref: 0046997D
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(?,0000001C,00000007,00000000,?,000007FE,00000000), ref: 004699A4
GetProcAddress.KERNEL32(?,?), ref: 00469A07
SetupDiGetDeviceRegistryPropertyA.SETUPAPI(?,0000001C,00000000,00000000,?,000007FE,00000000), ref: 00469A2E
GetProcAddress.KERNEL32(?,?), ref: 00469A8B
GetProcAddress.KERNEL32(?,00000000), ref: 00469ACE
GetProcAddress.KERNEL32(?,?), ref: 00469B11
StrStrIA.SHLWAPI(?,richdisk), ref: 00469B25
GetProcAddress.KERNEL32(?,?), ref: 00469B54
GetProcAddress.KERNEL32(?,?), ref: 00469B97
GetProcAddress.KERNEL32(?,?), ref: 00469BDA
GetProcAddress.KERNEL32(?,?), ref: 00469C1D
GetProcAddress.KERNEL32(?,?), ref: 00469C60
GetProcAddress.KERNEL32(?,?), ref: 00469CA3
GetProcAddress.KERNEL32(?,?), ref: 00469CE6
GetProcAddress.KERNEL32(?,?), ref: 00469D2E
GetProcAddress.KERNEL32(?,?), ref: 00469E82
SetupDiDestroyDeviceInfoList.SETUPAPI(?), ref: 00469E90

Part of subcall function 00408050: RtlInitializeCriticalSection.NTDLL(00597B94), ref: 004080BE
Part of subcall function 00408050: __Init_thread_footer.LIBCMT ref: 004080DA
Part of subcall function 00408050: RtlEnterCriticalSection.NTDLL(00597B94), ref: 004080F5
Part of subcall function 00408050: RtlLeaveCriticalSection.NTDLL(00597B94), ref: 0040814B

Strings

vice, xrefs: 00469E5D
vnd scsi, xrefs: 00469CA8
StrS, xrefs: 00469ABA
StrS, xrefs: 00469C8F
nxd xp, xrefs: 00469AD3
Info, xrefs: 00469E67
evsW, xrefs: 00469891
trIA, xrefs: 00469CDB
StrS, xrefs: 00469B83
StrS, xrefs: 00469D14
trIA, xrefs: 00469C55
mzd.live, xrefs: 00469C22
StrS, xrefs: 00469CD2
nmenu, xrefs: 00469B9C
vdiskbus, xrefs: 00469A90
bxp scsi, xrefs: 00469CEB
hangzhou changjin, xrefs: 00469D33
StrS, xrefs: 00469C09
StrS, xrefs: 00469B40
ccboot, xrefs: 00469C65
List, xrefs: 00469E71
A, xrefs: 004699FE
trIA, xrefs: 00469B8C
StrS, xrefs: 00469C4C
trIA, xrefs: 00469AC3
trIA, xrefs: 00469C12
trIA, xrefs: 00469B49
trIA, xrefs: 00469BCF
trIA, xrefs: 00469C98
StrS, xrefs: 00469A77
StrS, xrefs: 00469AFD
trIA, xrefs: 00469D20
ter, xrefs: 00469829
vhd cms, xrefs: 00469BDF
trIA, xrefs: 00469B06
deepin, xrefs: 00469B59
richdisk, xrefs: 00469B16
trIA, xrefs: 00469A80
StrS, xrefs: 00469BC6

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalSection$Setup$Device$EnterInit_thread_footerInitializeLeavePropertyRegistry$ClassDestroyDevsInfoList
String ID: A$Info$List$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$StrS$bxp scsi$ccboot$deepin$evsW$hangzhou changjin$mzd.live$nmenu$nxd xp$richdisk$ter$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$trIA$vdiskbus$vhd cms$vice$vnd scsi
API String ID: 2279208414-2458627454
Opcode ID: a345448e2b9446b60aeca82d63a069c040a82c70df20a837f092cf8f5c6a21b0
Instruction ID: 46e34079cb28ee3dac007b19e727f48e6ac5ef881adbdfc1ca7c33a713eff10d
Opcode Fuzzy Hash: a345448e2b9446b60aeca82d63a069c040a82c70df20a837f092cf8f5c6a21b0
Instruction Fuzzy Hash: CF12427091025A9FDB10DF64DD41BA9BBF8BF19304F00819AE45CE7251EBB4AE85CFA1

Function 0040F7C0 Relevance: 62.3, APIs: 10, Strings: 25, Instructions: 1003
registrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0041052C
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00410539
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00410546

Part of subcall function 00410800: GetProcAddress.KERNEL32 ref: 00410886
Part of subcall function 00410800: GetProcAddress.KERNEL32(?,?), ref: 004108D9
Part of subcall function 00410800: SHGetPathFromIDListW.SHELL32(?,?,?,?), ref: 004108EE
Part of subcall function 00410800: FindFirstFileW.KERNEL32(?,?), ref: 00410961

Part of subcall function 00410800: CoInitialize.OLE32(00000000), ref: 004109E9
Part of subcall function 00410800: CoCreateInstance.COMBASE(00564920,00000000,00000001,005648E0,?), ref: 00410A18

GetModuleHandleW.KERNEL32(00000000,?,SLBrowser.exe,00000000,?,?), ref: 0041061D
RegisterClassExW.USER32(00000030), ref: 0041063D
GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 00410647
CreateWindowExW.USER32(00000000,UJNGRFSBFJWOKS,00000000,86CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00410664

Part of subcall function 00481F30: GetClientRect.USER32(00000000), ref: 00481F69

SetTimer.USER32(00000000,00007E43,00001770,00000000), ref: 0041070E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,?,?), ref: 00410764
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 0041076B

Strings

liebao010203.11exe, xrefs: 004100C4
lore., xrefs: 0040F86D
firefox.exe, xrefs: 0040FF07
360se.exe, xrefs: 0040FA1B
MxStart010203.11exe, xrefs: 004103B0
TheWorld010203.11exe, xrefs: 0040FE2A
Opera\launcher010203.11exe, xrefs: 00410439
UJNGRFSBFJWOKS, xrefs: 0041062C, 0041065D
baiduBrowser010203.11exe, xrefs: 0041003B
2345Explorer.exe, xrefs: 00410289
mse, xrefs: 0041053E
chrome.exe, xrefs: 0040FBBD
Maxthon010203.11exe, xrefs: 0040FD62
QQBrowser.exe, xrefs: 0040FF9D
shortcut, xrefs: 00410730
Tango3010203.11exe, xrefs: 00410312
iexp, xrefs: 0040F888
SLBrowser.exe, xrefs: 004105A2
exe, xrefs: 0040F879, 00410531
TaoBrowser010203.11exe, xrefs: 004101EB
dge., xrefs: 00410524
UCBrowser.exe, xrefs: 00410162
sogouexplorer.exe, xrefs: 0040FC85
qianying010203.11exe, xrefs: 004104C2
360chrome.exe, xrefs: 0040FAE0

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CreateSimpleString::operator=$AddressEventHandleModuleProc$ClassClientFileFindFirstFromInitializeInstanceListPathRectRegisterTimerWindow
String ID: 2345Explorer.exe$360chrome.exe$360se.exe$Maxthon010203.11exe$MxStart010203.11exe$Opera\launcher010203.11exe$QQBrowser.exe$SLBrowser.exe$Tango3010203.11exe$TaoBrowser010203.11exe$TheWorld010203.11exe$UCBrowser.exe$UJNGRFSBFJWOKS$baiduBrowser010203.11exe$chrome.exe$dge.$exe$firefox.exe$iexp$liebao010203.11exe$lore.$mse$qianying010203.11exe$shortcut$sogouexplorer.exe
API String ID: 4163093286-2938698853
Opcode ID: 40b20a862301f5aea954fdb987e9bbb8bda5afa14a7635b0de9bb88c0959dd8d
Instruction ID: 23ebb9a8916a565e2745ce6d40a011bcf8e2e70713e5ae40f8ab8740941a9c4c
Opcode Fuzzy Hash: 40b20a862301f5aea954fdb987e9bbb8bda5afa14a7635b0de9bb88c0959dd8d
Instruction Fuzzy Hash: 85A27E70D05358DAEB20DF64C945BDEBBB0BF51308F10869ED049BB292DB786A84CF55

Function 0049A480 Relevance: 57.1, APIs: 29, Strings: 3, Instructions: 1065windowCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0059699C), ref: 0049A59C
RtlLeaveCriticalSection.NTDLL(0059699C), ref: 0049A5F0
GetCapture.USER32 ref: 0049A60E
CallWindowProcW.USER32(?,?,?,?,?,?,EFE0703F,?,?), ref: 0049A72C
SendMessageW.USER32(00000000,00000407,00000000,?), ref: 0049AA29
BeginPaint.USER32(?,?,EFE0703F,?,?), ref: 0049ACF9
EndPaint.USER32(?,?,00000000,?,?), ref: 0049AD0F
LoadCursorW.USER32(00000000,00007F00), ref: 0049ADAF
SetCursor.USER32(00000000,?,?), ref: 0049ADB6
LoadCursorW.USER32(00000000,00007F85), ref: 0049ADF3
SetCursor.USER32(00000000,?,?), ref: 0049ADFA
ScreenToClient.USER32(?,?), ref: 0049AE2F
SendMessageW.USER32(?,00000112,?,?), ref: 0049AE71
73A0A570.USER32(?,?,?), ref: 0049AEE7
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0049AF35
RemovePropW.USER32(?,SYSPLUGIN), ref: 0049AF62

Part of subcall function 00496970: DeleteObject.GDI32(?), ref: 004969AB
Part of subcall function 00496970: DeleteObject.GDI32(?), ref: 004969BC

RtlInitializeCriticalSection.NTDLL(0059699C), ref: 0049B6D3
__Init_thread_footer.LIBCMT ref: 0049B6E8

Strings

DownLoadFrame_splash, xrefs: 0049B13F
dulibMenuClass, xrefs: 0049B0A4, 0049B4BC, 0049B593
SYSPLUGIN, xrefs: 0049AF5A

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Cursor$CriticalSection$DeleteLoadMessageObjectPaintSend$A570BeginCallCaptureClientEnterInit_thread_footerInitializeInvalidateLeaveProcPropRectRemoveScreenWindow
String ID: DownLoadFrame_splash$SYSPLUGIN$dulibMenuClass
API String ID: 273701605-2935986418
Opcode ID: c4c6417015f089dce10c0349ab81e108fad9e456b07fda7e27c49860a080dd04
Instruction ID: f084a153acb2df5a4f5caecbd66f76ff173d37e4b7a2dc1f39f52cb0512712aa
Opcode Fuzzy Hash: c4c6417015f089dce10c0349ab81e108fad9e456b07fda7e27c49860a080dd04
Instruction Fuzzy Hash: 1E924130A00215AFDF249F54DD89FAEBBB8FF45304F1401AAE549A7251DB34AD90CF96

Function 004234B0 Relevance: 37.1, APIs: 11, Strings: 10, Instructions: 340
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408050: RtlInitializeCriticalSection.NTDLL(00597B94), ref: 004080BE
Part of subcall function 00408050: __Init_thread_footer.LIBCMT ref: 004080DA
Part of subcall function 00408050: RtlEnterCriticalSection.NTDLL(00597B94), ref: 004080F5
Part of subcall function 00408050: RtlLeaveCriticalSection.NTDLL(00597B94), ref: 0040814B

GetProcAddress.KERNEL32 ref: 0042350B
StrRChrIA.SHLWAPI(?,00000000,0000005F,00000000,00000000,00000000), ref: 00423518
GetProcAddress.KERNEL32(?,StrR), ref: 00423551
GetProcAddress.KERNEL32 ref: 004235A7
GetProcAddress.KERNEL32(?,StrR), ref: 004235F3
GetProcAddress.KERNEL32(?,?), ref: 0042365E
GetProcAddress.KERNEL32(?,?), ref: 004236AE
GetProcAddress.KERNEL32(?,?), ref: 0042370C
GetProcAddress.KERNEL32(?,?), ref: 00423757
GetProcAddress.KERNEL32(?,?), ref: 004237AF
GetProcAddress.KERNEL32(?,?), ref: 004237FD

Strings

%76, xrefs: 004235BE
A, xrefs: 004236A7
StrI, xrefs: 0042369F
StrR, xrefs: 0042373A, 00423746
StrI, xrefs: 004237EE
StrR, xrefs: 00423534, 00423540
%5F, xrefs: 0042355F, 00423608, 00423563
A, xrefs: 004237F6
%40, xrefs: 004237C8
A, xrefs: 00423657

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalSection$EnterInit_thread_footerInitializeLeave
String ID: %40$%5F$%76$A$A$A$StrI$StrI$StrR$StrR
API String ID: 1506207541-333352116
Opcode ID: 81b81600f2cb593c77551468dad1d8a4abc8639d2d0a78a0ddebd3a08e9c92ef
Instruction ID: 48f97e0e5b0175d9a4ac7cb73ca2d921a8b35f7d8ba6d1705d3cbafb0d7e01cc
Opcode Fuzzy Hash: 81b81600f2cb593c77551468dad1d8a4abc8639d2d0a78a0ddebd3a08e9c92ef
Instruction Fuzzy Hash: 2DC190B1709311AFC314DF59D980A2BBBF4AF88304F41496EFA59C7350DB78D9048BAA

Function 0044CE90 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0044CFFC
SetEvent.KERNEL32(?,EFE0703F), ref: 0044D079
SetWindowTextA.USER32(?,?), ref: 0044D096

Strings

0, xrefs: 0044D64A
jkj, xrefs: 0044D7A6
ttj, xrefs: 0044D824
W, xrefs: 0044D56F
btn_openfile, xrefs: 0044CF3B
jjjjjjh, xrefs: 0044D697
main_text1, xrefs: 0044D434
jkj, xrefs: 0044D655
GWPGWPGWPNB, xrefs: 0044D65C, 0044D6AA

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CountEventTextTickWindow
String ID: 0$GWPGWPGWPNB$W$btn_openfile$jjjjjjh$jkj$jkj$main_text1$ttj
API String ID: 1892856236-1426361691
Opcode ID: f5b603520864e1c63cd1a3c1161cdd37d28df692521ced6fbbf9a146783235db
Instruction ID: 4db247760b552e3c20b62f4a37da0c28fdf706a323f357a3a0a9242cd321078b
Opcode Fuzzy Hash: f5b603520864e1c63cd1a3c1161cdd37d28df692521ced6fbbf9a146783235db
Instruction Fuzzy Hash: 2302D370A00205ABFF14DF68CD89BAE77B5AF08308F14017BE9059B296DB78DD44DB69

Function 004996E0 Relevance: 31.8, APIs: 21, Instructions: 273
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteObject.GDI32(?), ref: 00499736
GetClientRect.USER32(?,?), ref: 0049974B
SelectObject.GDI32(00000000,00000000), ref: 0049979E
CreateRectRgn.GDI32(?,?,?,?), ref: 00499881
SelectClipRgn.GDI32(?,00000000), ref: 004998A4
SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 004998BD
SetViewportOrgEx.GDI32(?,00000000,00000000,00000000), ref: 004998EC
SelectClipRgn.GDI32(?,00000000), ref: 004998F5
DeleteObject.GDI32(00000000), ref: 004998FC
IsWindow.USER32(?), ref: 00499942
GetWindowRect.USER32(?,?), ref: 00499969
IsWindow.USER32(?), ref: 004999C3
KillTimer.USER32(?,?,?,75A92370,00000000), ref: 004999E1
HideCaret.USER32(?), ref: 004999EC
UpdateLayeredWindow.USER32(?,?,?,?,00000000,00000000,00000000,01FF0000,00000002), ref: 00499A1C
IsWindow.USER32(?), ref: 00499A2A
GetCaretBlinkTime.USER32(00000000,?,75A92370,00000000), ref: 00499A44
SetTimer.USER32(?,?,00000000), ref: 00499A51
ShowCaret.USER32(?), ref: 00499A5C
SelectObject.GDI32(00000000,?), ref: 00499A97
DeleteDC.GDI32(00000000), ref: 00499A9E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Window$ObjectSelect$CaretDeleteRect$ClipTimerViewport$BlinkClientCreateHideKillLayeredShowTimeUpdate
String ID:
API String ID: 793400785-0
Opcode ID: 97107376e8f533a1afee41e3162c9107674a22122ee761a397bfe97a5f7dae0c
Instruction ID: dd10437a4ec9ca5634d3f4d2c0e82f3ba4c1eb554d4f6e2bbd6ba775d0c32502
Opcode Fuzzy Hash: 97107376e8f533a1afee41e3162c9107674a22122ee761a397bfe97a5f7dae0c
Instruction Fuzzy Hash: 51B16E75900218AFDF20DFA5CD45FEEBBB9AF15304F0000A9F50AA21A1DB34AE49DF64

Function 0048FF50 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 205
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00415DC0: RtlInitializeCriticalSection.NTDLL(00597C64), ref: 00415E2E
Part of subcall function 00415DC0: __Init_thread_footer.LIBCMT ref: 00415E4A
Part of subcall function 00415DC0: RtlEnterCriticalSection.NTDLL(00597C64), ref: 00415E65
Part of subcall function 00415DC0: RtlLeaveCriticalSection.NTDLL(00597C64), ref: 00415EBB

GetProcAddress.KERNEL32(?,?), ref: 0048FFD7
RegOpenKeyExA.KERNEL32(80000002,System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318},00000000,00020019,00000000,?,00000000), ref: 0048FFF7
GetProcAddress.KERNEL32(?,?), ref: 0049005C
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,00000000), ref: 0049007F
GetProcAddress.KERNEL32(?,?), ref: 004900CB
RegQueryValueExA.KERNEL32(?,MediaSubType,00000000,00000004,00000000,00000004), ref: 004900F5
GetProcAddress.KERNEL32(?,?), ref: 004901F7
RegCloseKey.KERNEL32(?), ref: 00490205
GetProcAddress.KERNEL32(?,?), ref: 0049023B

Strings

System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}, xrefs: 0048FFED
MediaSubType, xrefs: 004900EA
PCI, xrefs: 0049016C, 00490195
Key, xrefs: 00490234
%s\Connection, xrefs: 0049000D
RegO, xrefs: 0049003F
RegC, xrefs: 00490224
lose, xrefs: 0049022D
PnpInstanceID, xrefs: 0049013E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalSection$Open$CloseEnterInit_thread_footerInitializeLeaveQueryValue
String ID: %s\Connection$Key$MediaSubType$PCI$PnpInstanceID$RegC$RegO$System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}$lose
API String ID: 1220120693-1602475108
Opcode ID: 5fa2da8577e4b1ab779ed0a0afea5a12b975507f685e46f4d0d40af66012d746
Instruction ID: 66da33d3f6c143058e4c25fcf34c8e9f009c8e153576b8512393f1f7a8799eef
Opcode Fuzzy Hash: 5fa2da8577e4b1ab779ed0a0afea5a12b975507f685e46f4d0d40af66012d746
Instruction Fuzzy Hash: C7810AB09002199FDB20DF65DD86BDEBBF8BF08304F4045A9E549E6241EB74AB94CF94

Function 0049F9C0 Relevance: 25.0, APIs: 4, Strings: 10, Instructions: 527COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0049FA00
_wcsrchr.LIBVCRUNTIME ref: 0049FCAF
GlobalSize.KERNEL32(00000000), ref: 0049FDBF
GlobalSize.KERNEL32(00000000), ref: 0049FF22

Strings

resManager, xrefs: 0049FFAD
theme, xrefs: 0049FE42
CollectGarbage();, xrefs: 0049FF6A
winManager, xrefs: 0049FF98
ducontrol, xrefs: 0049FA40
directui, xrefs: 0049FA27, 0049FE2A
config.xml, xrefs: 0049FD08
name, xrefs: 0049FA70
duwindow, xrefs: 0049FA37, 0049FB13
DirectUI.js, xrefs: 0049FEDB

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: GlobalSize$Window_wcsrchr
String ID: CollectGarbage();$DirectUI.js$config.xml$directui$ducontrol$duwindow$name$resManager$theme$winManager
API String ID: 1149426230-2029015323
Opcode ID: 072d02c2918d1fe43110286889bc25812681e4530c93af0beb96ce42ce721cb6
Instruction ID: 87e1b301245808ad0760709a805c9936a8d763eab8b64b3ce337e060a2ad52e3
Opcode Fuzzy Hash: 072d02c2918d1fe43110286889bc25812681e4530c93af0beb96ce42ce721cb6
Instruction Fuzzy Hash: F112A3B1A00205ABDF24DF64C855BEEBBB8BF49314F44417EE509E7281EB74AE44CB58

Function 0048D3A0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 325fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,EFE0703F,00000000,00000000), ref: 0048D407
SetEndOfFile.KERNEL32(?), ref: 0048D413
GetFileSize.KERNEL32(?,?), ref: 0048D425
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 0048D44B
CloseHandle.KERNEL32(00000000), ref: 0048D46D
WriteFile.KERNEL32(?,?,?,?,00000000,00000000), ref: 0048D825
CloseHandle.KERNEL32(?), ref: 0048D837

Strings

config4, xrefs: 0048D61C
[Profile], xrefs: 0048D4C2
config5, xrefs: 0048D67E
%02x, xrefs: 0048D498
config3, xrefs: 0048D5BA
config1, xrefs: 0048D4F8
config2, xrefs: 0048D558

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerSizeWrite
String ID: %02x$[Profile]$config1$config2$config3$config4$config5
API String ID: 723050636-2983988086
Opcode ID: 5348974cc467094eba23520932fcfbe9b9d6d008d263bc6e40c42bf4397ceca7
Instruction ID: 68861774f9ae05e4148281d3363de4f193ef476ba505d0949c7b9316a25c96b1
Opcode Fuzzy Hash: 5348974cc467094eba23520932fcfbe9b9d6d008d263bc6e40c42bf4397ceca7
Instruction Fuzzy Hash: A5D1A670D05248DEEB10D764D946BDDBBB0AF25308F1481ADE849732C3EB746B08DB66

Function 004A0890 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 308COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 004A0903
GlobalSize.KERNEL32(00000000), ref: 004A0A53
73A0A570.USER32(00000000,00000000,004A0160,00000000,00000000,?,theme,directui), ref: 004A0B0A
EnumFontsW.GDI32(00000000), ref: 004A0B11
GlobalSize.KERNEL32(00000000), ref: 004A0C02

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

Part of subcall function 0046CE40: GetProcAddress.KERNEL32(?,?), ref: 0046CE79

Part of subcall function 004CD160: RtlEnterCriticalSection.NTDLL(005980A4), ref: 004CD1DC
Part of subcall function 004CD160: RtlLeaveCriticalSection.NTDLL(005980A4), ref: 004CD22A
Part of subcall function 004CD160: CoCreateInstance.COMBASE(00000000,00000000,00000017,00564AB0,00000000), ref: 004CD253

Strings

resManager, xrefs: 004A0CB5
theme, xrefs: 004A0AC9
CollectGarbage();, xrefs: 004A0C3A
winManager, xrefs: 004A0C9F
directui, xrefs: 004A0AB3
config.xml, xrefs: 004A0996, 004A099E
DirectUI.js, xrefs: 004A0BBB

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterGlobalLeaveSize$A570AddressCreateEnumFontsInit_thread_footerInitializeInstanceProc_wcsrchr
String ID: CollectGarbage();$DirectUI.js$config.xml$directui$resManager$theme$winManager
API String ID: 3226567190-724004937
Opcode ID: ad7d919d22f53e32f66c48d252bedbd18532f11725e4def1f9929a6088f255bb
Instruction ID: 21ccf36060daee3d55d043c68d4f806dba8e99775befe815b9ec61268d8b935d
Opcode Fuzzy Hash: ad7d919d22f53e32f66c48d252bedbd18532f11725e4def1f9929a6088f255bb
Instruction Fuzzy Hash: 02C1A575A40215AFEB14EFA0CC9DFEAB7B8BF59300F10059AF50997281EB74A944CF94

Function 0041B580 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 194filesynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BF60: RtlInitializeCriticalSection.NTDLL(00597D08), ref: 0041BFCE
Part of subcall function 0041BF60: __Init_thread_footer.LIBCMT ref: 0041BFEA
Part of subcall function 0041BF60: RtlEnterCriticalSection.NTDLL(00597D08), ref: 0041C005
Part of subcall function 0041BF60: RtlLeaveCriticalSection.NTDLL(00597D08), ref: 0041C115

CreateMutexW.KERNEL32(00000000,00000000,?,00000000,?), ref: 0041B674
GetLastError.KERNEL32 ref: 0041B6E0
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000400,00000000,?), ref: 0041B71E
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 0041B78C
IsWindow.USER32(00000000), ref: 0041B796
SendMessageW.USER32(00000000,000007E8,00000000,00000000), ref: 0041B7AB
ShowWindow.USER32(00000000,00000001), ref: 0041B7B9
SetForegroundWindow.USER32(00000000), ref: 0041B7C1
UnmapViewOfFile.KERNEL32(00000000), ref: 0041B7C8
CloseHandle.KERNEL32(00000000), ref: 0041B7CF
CloseHandle.KERNEL32(FFFFFFFF), ref: 0041B7DB

Strings

ATL:MemData03EA, xrefs: 0041B5C5

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalFileSectionWindow$CloseCreateHandleView$EnterErrorForegroundInit_thread_footerInitializeLastLeaveMappingMessageMutexSendShowUnmap
String ID: ATL:MemData03EA
API String ID: 2049962414-709304236
Opcode ID: 1f234b4b6f5a76aeb3b19fd0fb72c9a2173e7b886c40ecf5e61edd3b3c9bc17c
Instruction ID: 8c234a87740ad5e44fa06b2b6c16da18d7a94b08daf6779525c0ac8bc8160d1f
Opcode Fuzzy Hash: 1f234b4b6f5a76aeb3b19fd0fb72c9a2173e7b886c40ecf5e61edd3b3c9bc17c
Instruction Fuzzy Hash: B471E271A00208EBEB14DFA8DD89BDEBBB1FF85714F204519F510A72E0D7789A848B94

Function 00497640 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

SetPropW.USER32(?,SYSPLUGIN), ref: 004976A1
RemovePropW.USER32(?,SYSPLUGIN), ref: 0049770C
GetClassLongW.USER32(?,000000E6), ref: 0049772B
SetClassLongW.USER32(?,000000E6,00000000), ref: 00497738
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000237), ref: 004977B0

Part of subcall function 004A2A00: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004A2A47
Part of subcall function 004A2A00: SetWindowPos.USER32(?,00000000,?,?,00000000,?,00000214,75A92370,00000000,00000000), ref: 004A2AB9

Part of subcall function 004992F0: IsWindow.USER32(?), ref: 004992FB

73A0A570.USER32(?), ref: 004977C8

Part of subcall function 004996E0: DeleteObject.GDI32(?), ref: 00499736
Part of subcall function 004996E0: GetClientRect.USER32(?,?), ref: 0049974B
Part of subcall function 004996E0: SelectObject.GDI32(00000000,00000000), ref: 0049979E

GetModuleHandleW.KERNEL32(00000000,00000000), ref: 004977E6
CreateWindowExW.USER32(00000000,tooltips_class32,00571978,80000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0049780B
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000213), ref: 00497823

Strings

tooltips_class32, xrefs: 00497804
SYSPLUGIN, xrefs: 00497698, 00497706

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Window$ClassLongObjectProp$A570ClientCreateDeleteHandleInfoModuleParametersRectRemoveSelectSystem
String ID: SYSPLUGIN$tooltips_class32
API String ID: 2739756791-1711320849
Opcode ID: c92ddd6769d7665c02f2c9d002a0e3fc505f1d64b5d2ff7c897796eeb7d4fd81
Instruction ID: fba20f7986df18ab2ce0285e8c17044c9a2b9f366ebf99f742542b02dfec179f
Opcode Fuzzy Hash: c92ddd6769d7665c02f2c9d002a0e3fc505f1d64b5d2ff7c897796eeb7d4fd81
Instruction Fuzzy Hash: B951C331644204BBDF10AF68CC45F5B7FA8EF56764F10426AF915EB2E1CB78E9008BA4

Function 004F3190 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,75920E50,00000002,004D80FF), ref: 004F319E
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 004F31B8

Strings

LoadLibraryExA, xrefs: 004F31B2
kernel32, xrefs: 004F3197
AddDllDirectory, xrefs: 004F3200

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1646373207-3327535076
Opcode ID: 8bc75b4a7cfa62d7bfb5fa97cd9b3d04a01ea3466b8b4b09afe4742b6252688f
Instruction ID: d0f0a0077bccb34425ef9b4ac95bebf668861f8af76a6435c59df848463201ff
Opcode Fuzzy Hash: 8bc75b4a7cfa62d7bfb5fa97cd9b3d04a01ea3466b8b4b09afe4742b6252688f
Instruction Fuzzy Hash: DA415B35300305ABEF104F68AC487BBBB68EF56316F1440BBED05D7352EA768A0A8354

Function 0046DC70 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,EFE0703F,00000000,007F9738), ref: 0046DCE4
GetProcAddress.KERNEL32(00000000,?), ref: 0046DD1B
GetProcAddress.KERNEL32(?,?), ref: 0046DD40
GetProcAddress.KERNEL32(?,?), ref: 0046DD5E

Strings

dll, xrefs: 0046DCDD
foSi, xrefs: 0046DD32
vers, xrefs: 0046DCCF
Valu, xrefs: 0046DD0A
VerQ, xrefs: 0046DCFC
uery, xrefs: 0046DD03
ion., xrefs: 0046DCD6

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Valu$VerQ$dll$foSi$ion.$uery$vers
API String ID: 2238633743-3386711270
Opcode ID: 4979028e2a5a69b3c06800cdf58786957db35159d2fd76c2291e31f453e3b0ee
Instruction ID: 74823da3dc24b8292d3ced95fd42fbba1b00a736b9c2f89e65147783e8b47aa0
Opcode Fuzzy Hash: 4979028e2a5a69b3c06800cdf58786957db35159d2fd76c2291e31f453e3b0ee
Instruction Fuzzy Hash: 9E3129B1D0064AEBDB00CF99D9447DEFBF8FF58304F10821AE428A7650EB74A654CB95

Function 004041F0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 263registrytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00483970: GetProcAddress.KERNEL32 ref: 004839FF
Part of subcall function 00483970: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00483A15
Part of subcall function 00483970: Process32FirstW.KERNEL32(00000000,?), ref: 00483A24
Part of subcall function 00483970: Process32NextW.KERNEL32(00000000,?), ref: 00483A4C
Part of subcall function 00483970: CloseHandle.KERNEL32(00000000), ref: 00483A53

GetModuleHandleW.KERNEL32(00000000,EFE0703F), ref: 00404337
RegisterClassExW.USER32(00000030), ref: 00404357
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 00404361
CreateWindowExW.USER32(00000000,THUIDBEGKGSADW,00000000,86CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040437E
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 004043A3

Part of subcall function 00483970: CloseHandle.KERNEL32(00000000), ref: 00483A7B

SetTimer.USER32(?,00002F59,00001770,00000000), ref: 00404467

Part of subcall function 004045E0: RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,00000000,EFE0703F,?,?), ref: 004046D6
Part of subcall function 004045E0: RegQueryValueExW.ADVAPI32(00000000,0061006C,00000000,00000000,?,0000020A,?,?,?), ref: 00404776
Part of subcall function 004045E0: RegCloseKey.ADVAPI32(00000000,?,?,?), ref: 00404782

Part of subcall function 004050C0: RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,?,EFE0703F,?), ref: 0040538D
Part of subcall function 004050C0: RegQueryValueExW.ADVAPI32(00000000,0061006C,00000000,00000000,?,0000020A), ref: 00405433
Part of subcall function 004050C0: RegCloseKey.ADVAPI32(00000000), ref: 0040543F

CreateEventA.KERNEL32(00000000,00000001,00000000,?,home), ref: 0040452F
SetEvent.KERNEL32(00000000), ref: 00404536

Strings

home, xrefs: 0040448F
THUIDBEGKGSADW, xrefs: 00404346, 00404377

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CloseHandle$Create$EventModuleOpenProcess32QueryValueWindow$AddressClassFirstLongNextProcRegisterSnapshotTimerToolhelp32
String ID: THUIDBEGKGSADW$home
API String ID: 3099295237-1807252216
Opcode ID: 5d34372b7bd3ee3651931b0817b8e93c7a9ae7619bbc4397521099f72e0b056b
Instruction ID: de3f61e570d049e69affd51998ca8969852e6dcd6c4531ab67e07bd7b4b86903
Opcode Fuzzy Hash: 5d34372b7bd3ee3651931b0817b8e93c7a9ae7619bbc4397521099f72e0b056b
Instruction Fuzzy Hash: DDA1D5B0A102089BEB14EFA4CC49B9EBF75FF81308F104269E505BB2D1DBB95A84CB55

Function 0046F28E Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 219threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0046F2A1

Strings

({Y, xrefs: 0046F4A1
dtrR, xrefs: 0046F4A8

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID: ({Y$dtrR
API String ID: 2882836952-3251534292
Opcode ID: b9d3db8f0998f64f23b0f49ef3fb0bbfc950efb19b83652c75b400f21217ff7c
Instruction ID: 2c0bf983d58812fb3ef5785e21656bdbf6918a1aa19d560037ee40d037b65249
Opcode Fuzzy Hash: b9d3db8f0998f64f23b0f49ef3fb0bbfc950efb19b83652c75b400f21217ff7c
Instruction Fuzzy Hash: 0F810275100605DFCB20CF24E884A66B7B2FF69314B20417BD89587751EB38EC8ADF96

Function 00437ED0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 106libraryloaderregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00415DC0: RtlInitializeCriticalSection.NTDLL(00597C64), ref: 00415E2E
Part of subcall function 00415DC0: __Init_thread_footer.LIBCMT ref: 00415E4A
Part of subcall function 00415DC0: RtlEnterCriticalSection.NTDLL(00597C64), ref: 00415E65
Part of subcall function 00415DC0: RtlLeaveCriticalSection.NTDLL(00597C64), ref: 00415EBB

GetProcAddress.KERNEL32(?,?), ref: 00437F24
GetProcAddress.KERNEL32(?,?), ref: 00437F7E
RegQueryValueExA.KERNEL32(00000000,InstallDate,00000000,?,?,00000100,?,00000000), ref: 00437F99
GetProcAddress.KERNEL32(?,?), ref: 00437FCB

Strings

lose, xrefs: 00437FBD
RegO, xrefs: 00437F07
Key, xrefs: 00437FC4
RegC, xrefs: 00437FB4
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00437F3B
InstallDate, xrefs: 00437F93

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressCriticalProcSection$EnterInit_thread_footerInitializeLeaveQueryValue
String ID: InstallDate$Key$RegC$RegO$SOFTWARE\Microsoft\Windows NT\CurrentVersion$lose
API String ID: 1722220145-3360175959
Opcode ID: eeb8f4af582e9e18a070b9b1cf8443e48bd264543de679c0b597f88aede0d498
Instruction ID: f51dd1c5e7569d7ee64366b7a600911872349635878d4a96c5e6906628fae09d
Opcode Fuzzy Hash: eeb8f4af582e9e18a070b9b1cf8443e48bd264543de679c0b597f88aede0d498
Instruction Fuzzy Hash: 49413EB1A002099FDB10DFA9D981AEFBBF8FF48300F10556EE545F3241DB74AA448BA4

Function 004050C0 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 717registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,?,EFE0703F,?), ref: 0040538D
RegQueryValueExW.ADVAPI32(00000000,0061006C,00000000,00000000,?,0000020A), ref: 00405433
RegCloseKey.ADVAPI32(00000000), ref: 0040543F
GetProcAddress.KERNEL32(?,?), ref: 00405607
RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,?,EFE0703F), ref: 00405AB4
RegQueryValueExW.KERNEL32(00000000,00740053,00000000,00000001,?,00000104), ref: 00405B35
RegCloseKey.ADVAPI32(00000000), ref: 00405B41

Strings

home, xrefs: 004056D1
page, xrefs: 004056DF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue$AddressProc
String ID: home$page
API String ID: 3111369219-3140408881
Opcode ID: 7b79eba9263786893866ec1fa9af5feaea01591360d849ea7da4990455b0358d
Instruction ID: 38e7d1d0abe333740f891d0304dc5927cb132ff78b16d22ca422c218e70641b8
Opcode Fuzzy Hash: 7b79eba9263786893866ec1fa9af5feaea01591360d849ea7da4990455b0358d
Instruction Fuzzy Hash: 8F627DB0901618DBEB24DF54CD48BDEBBB5FF44308F1042ADD509A7291DBB96A88CF94

Function 00405C80 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 00405D0F

Part of subcall function 004717A0: std::locale::facet::facet.LIBCPMTD ref: 00471814
Part of subcall function 004717A0: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471844

GetProcAddress.KERNEL32(?,?), ref: 00405D8C
PathFileExistsA.SHLWAPI(?,?,?,?,?,?,?), ref: 00405D9B

Strings

ces, xrefs: 00405D5F
urls, xrefs: 00405EBF
sess, xrefs: 00405E4D
star, xrefs: 00405EB1
tup_, xrefs: 00405EB8
ion, xrefs: 00405E5B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressProc$Affinity::operator!=Concurrency::details::EnterExistsFileHardwareInit_thread_footerInitializeLeavePathstd::locale::facet::facet
String ID: ces$ion$sess$star$tup_$urls
API String ID: 2857489092-3847234075
Opcode ID: 144d4fe3b548dfb2d315c02852a20befee574216dbad169d1b1e79d1547f0957
Instruction ID: c03e4c8e7f3104c698af547b441a8db5b5e61d86c528da2eac5f0a599ab7c7c2
Opcode Fuzzy Hash: 144d4fe3b548dfb2d315c02852a20befee574216dbad169d1b1e79d1547f0957
Instruction Fuzzy Hash: 80E19171D002589BDB25DB64CD457DEB7B8AF55304F1082EEE409B7292EB386B88CF94

Function 00407510 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 359libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 0040759F

Part of subcall function 004717A0: std::locale::facet::facet.LIBCPMTD ref: 00471814
Part of subcall function 004717A0: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471844

GetProcAddress.KERNEL32(?,?), ref: 00407620
PathFileExistsA.SHLWAPI(?,?,?,?,?,?,?), ref: 0040762F

Strings

sess, xrefs: 004076E1
star, xrefs: 00407745
urls, xrefs: 00407753
nces, xrefs: 004075EF
tup_, xrefs: 0040774C
ion, xrefs: 004076EF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressProc$Affinity::operator!=Concurrency::details::EnterExistsFileHardwareInit_thread_footerInitializeLeavePathstd::locale::facet::facet
String ID: ion$nces$sess$star$tup_$urls
API String ID: 2857489092-3048481300
Opcode ID: d5136dc851da2c277e804589074bbde125e70991f62ccf397ad0d931ae745db1
Instruction ID: 52ea1bf94da476a521094806a63c5578b8c33458e04c5f20b5cbe593ff7f6378
Opcode Fuzzy Hash: d5136dc851da2c277e804589074bbde125e70991f62ccf397ad0d931ae745db1
Instruction Fuzzy Hash: 09E1E271D042589BEB21DB64CD45BDEB7B8AF15304F0081EAE408B7291EB386BC8CF95

Function 00407AB0 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 353libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 00407B3F

Part of subcall function 004717A0: std::locale::facet::facet.LIBCPMTD ref: 00471814
Part of subcall function 004717A0: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471844

GetProcAddress.KERNEL32(?,?), ref: 00407BC6
PathFileExistsA.SHLWAPI(?), ref: 00407BD5

Strings

urls, xrefs: 00407CF9
ion, xrefs: 00407C95
sess, xrefs: 00407C87
renc, xrefs: 00407B8F
star, xrefs: 00407CEB
tup_, xrefs: 00407CF2

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressProc$Affinity::operator!=Concurrency::details::EnterExistsFileHardwareInit_thread_footerInitializeLeavePathstd::locale::facet::facet
String ID: ion$renc$sess$star$tup_$urls
API String ID: 2857489092-1472271390
Opcode ID: d517398d135e40a8c35e5436d6a442766f4d21db3bf6c25803f1051526472af4
Instruction ID: 4f18e852039a81dd0aca6fceb0e2757b3ddb86dfec1834c94160d8a079b48f0e
Opcode Fuzzy Hash: d517398d135e40a8c35e5436d6a442766f4d21db3bf6c25803f1051526472af4
Instruction Fuzzy Hash: D6E1C271C012589BDB21DB64CD45BEEB7B8AF15304F0081EAE408B7291EB786B88CF95

Function 004231E0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 217libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,005733F8,00000000), ref: 00423228

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

GetProcAddress.KERNEL32(?,?), ref: 00423258
_strrchr.LIBCMT ref: 00423282
GetModuleHandleW.KERNEL32(00000000,?,?,@1_360.exe), ref: 004232FF
GetProcAddress.KERNEL32(?,?), ref: 0042332F
GetLastError.KERNEL32(?,?,?,@1_360.exe), ref: 004233FC

Strings

@1_360.exe, xrefs: 004232DD
eA, xrefs: 00423325
v0001360.exe, xrefs: 004232D6

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressHandleModuleProc$EnterErrorInit_thread_footerInitializeLastLeave_strrchr
String ID: @1_360.exe$eA$v0001360.exe
API String ID: 2216385903-2796156030
Opcode ID: bcc402a24a81acf323bd091558bf85ea3eed10d5f581eef234b029f8eec36962
Instruction ID: 4808f37d2c3689c0db1d776ec11129cb46ed44d0e7024bd2e76846e01928d9ba
Opcode Fuzzy Hash: bcc402a24a81acf323bd091558bf85ea3eed10d5f581eef234b029f8eec36962
Instruction Fuzzy Hash: 79814671A002099BEB14EF64DC45BEFBBB5FF45305F14425EE405A7281EB78AB48CBA4

Function 004045E0 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 464registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,00000000,EFE0703F,?,?), ref: 004046D6
RegQueryValueExW.ADVAPI32(00000000,0061006C,00000000,00000000,?,0000020A,?,?,?), ref: 00404776
RegCloseKey.ADVAPI32(00000000,?,?,?), ref: 00404782
GetProcAddress.KERNEL32(?,?), ref: 00404921

Part of subcall function 004717A0: std::locale::facet::facet.LIBCPMTD ref: 00471814
Part of subcall function 004717A0: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471844

Strings

ion, xrefs: 004049F9
sess, xrefs: 004049EB
on_s, xrefs: 00404A60
tart, xrefs: 00404A6A

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressAffinity::operator!=CloseConcurrency::details::HardwareOpenProcQueryValuestd::locale::facet::facet
String ID: ion$on_s$sess$tart
API String ID: 1128421385-1165013425
Opcode ID: 849f31abba986c8d13efc73d28ff38aa34d7b5ae23e4ba826919106a7963f06e
Instruction ID: 27f32b18423dbf5d08f02fbabdd1180e3e5dbf8682b9e4d71c4c8e62e6362810
Opcode Fuzzy Hash: 849f31abba986c8d13efc73d28ff38aa34d7b5ae23e4ba826919106a7963f06e
Instruction Fuzzy Hash: A0229BB09012589BDB25DF64CD54BDEBBB9AF44308F1081EDE508B7291DB785B88CF98

Function 0046B140 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 215comlibraryloaderCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(005980A4), ref: 0046B1B1

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0046B1D0

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(005980A4), ref: 0046B1EB
RtlLeaveCriticalSection.NTDLL(005980A4), ref: 0046B244

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

GetProcAddress.KERNEL32(763B0000,?), ref: 0046B261
CLSIDFromString.COMBASE(Shell.Explorer,?,EFE0703F,?,00000000,?,?,?,?,?,?,?,?,?,00000000,0054AFE3), ref: 0046B276
CoCreateInstance.COMBASE(?,00000000,00000005,00564970,00000000), ref: 0046B291

Strings

Shell.Explorer, xrefs: 0046B271

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AddressCreateFromInit_thread_footerInitializeInstanceProcString__onexit
String ID: Shell.Explorer
API String ID: 431855302-3462212939
Opcode ID: b5f9fc79da250f4a2047e6d424e98c563207e2aed768bdeaf1560b4454a17ddd
Instruction ID: a560f8fd9a1407668bb8e3818704dd96ee213fc6ffe290408ffc507773f67e3d
Opcode Fuzzy Hash: b5f9fc79da250f4a2047e6d424e98c563207e2aed768bdeaf1560b4454a17ddd
Instruction Fuzzy Hash: 81817D70A0061AAFDB14DFA4D849FAEBBB8FF49714F100159F905DB390EB74A944CB91

Function 00483AC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 88processlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

GetProcAddress.KERNEL32(?,?), ref: 00483B30
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000001), ref: 00483B46
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00483B6A
Process32NextW.KERNEL32(00000000,0000022C), ref: 00483BA6
CloseHandle.KERNEL32(00000000), ref: 00483BB9

Strings

QQBrowser.exe, xrefs: 00483B86
shot, xrefs: 00483B25
Snap, xrefs: 00483B1E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$Process32$AddressCloseCreateEnterFirstHandleInit_thread_footerInitializeLeaveNextProcSnapshotToolhelp32
String ID: QQBrowser.exe$Snap$shot
API String ID: 142191753-275083281
Opcode ID: 703b145001b9f67260b2335f9d2604852c26ee50beb10ad54e36c8e6a096dde6
Instruction ID: 96f938405f9b234ddc3cd4e3ab6be8807641781c1e8fcd67f60a425441f6f87c
Opcode Fuzzy Hash: 703b145001b9f67260b2335f9d2604852c26ee50beb10ad54e36c8e6a096dde6
Instruction Fuzzy Hash: CC31DE75E00115ABDB10EFA4DC49BEEF7F8EF49715F000599E809D3281E774AB448B64

Function 0044A880 Relevance: 13.9, APIs: 1, Strings: 8, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,?,00000000), ref: 0044AACC

Strings

?p, xrefs: 0044A88D
js=, xrefs: 0044A941
w.nanweng.cn, xrefs: 0044A9F3
P}A, xrefs: 0044AD54
?p, xrefs: 0044A8A3
url, xrefs: 0044AA38, 0044AB53, 0044AB68, 0044AB88
/qy/png, xrefs: 0044A9ED
png, xrefs: 0044A8FB

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: /qy/png$?p$?p$P}A$js=$png$url$w.nanweng.cn
API String ID: 3472027048-2782442111
Opcode ID: 74afa54cf65b7d1373d6833aafc43d121e55fb8b6cc574ed6f79126d0d48fa9f
Instruction ID: 6d5b0a7da77640b881c1675866e11ab7b5a9b98f5605a488d7309208466c0ee2
Opcode Fuzzy Hash: 74afa54cf65b7d1373d6833aafc43d121e55fb8b6cc574ed6f79126d0d48fa9f
Instruction Fuzzy Hash: 4BE1E370D10258ABFB19DB64CD89BDEBB72BF41308F10825EE005A72C1DB7D5A94CB96

Function 005312B2 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f4e289fd7cd042e0cdd96788d9668369e5f3209cb7a29074b6b389720523cd
Instruction ID: 87d9acf5e25aa00db8412d801c4bd33fabfff0a4185627600757bed709b48f02
Opcode Fuzzy Hash: 88f4e289fd7cd042e0cdd96788d9668369e5f3209cb7a29074b6b389720523cd
Instruction Fuzzy Hash: 26C1D274E04A4A9FDB12DFB8C846BADBFB4BF59310F184199E811A7392C7309941CF68

Function 0041D140 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 158registryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0041D171
LoadCursorW.USER32(00000000,00007F00), ref: 0041D1C6
RegisterClassExW.USER32(00000030), ref: 0041D1E1
CreateWindowExW.USER32(00000000,ThumWndClass,00000000,46000000,00000000,00000000,00000208,000000F0,?,00000000,00000000,00000000), ref: 0041D20A
SetRectEmpty.USER32(00000024), ref: 0041D29A

Part of subcall function 0046B140: RtlInitializeCriticalSection.NTDLL(005980A4), ref: 0046B1B1
Part of subcall function 0046B140: __Init_thread_footer.LIBCMT ref: 0046B1D0
Part of subcall function 0046B140: RtlEnterCriticalSection.NTDLL(005980A4), ref: 0046B1EB
Part of subcall function 0046B140: RtlLeaveCriticalSection.NTDLL(005980A4), ref: 0046B244
Part of subcall function 0046B140: GetProcAddress.KERNEL32(763B0000,?), ref: 0046B261
Part of subcall function 0046B140: CLSIDFromString.COMBASE(Shell.Explorer,?,EFE0703F,?,00000000,?,?,?,?,?,?,?,?,?,00000000,0054AFE3), ref: 0046B276
Part of subcall function 0046B140: CoCreateInstance.COMBASE(?,00000000,00000005,00564970,00000000), ref: 0046B291

Part of subcall function 00421B40: RtlInitializeCriticalSection.NTDLL(00597D48), ref: 00421BAE
Part of subcall function 00421B40: __Init_thread_footer.LIBCMT ref: 00421BCA
Part of subcall function 00421B40: RtlEnterCriticalSection.NTDLL(00597D48), ref: 00421BE5

Strings

ThumWndClass, xrefs: 0041D1DA, 0041D203
0, xrefs: 0041D187

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateEnterInit_thread_footer$AddressClassCursorEmptyFromInstanceLeaveLoadProcRectRegisterStringWindow
String ID: 0$ThumWndClass
API String ID: 489526686-2620089244
Opcode ID: 09dbf71376382246d49a0a98356eeb4732abed6087f5bc6596bdebe5bbb3be5d
Instruction ID: 250c36cab393547e0e864f200ea3947e2c97481a1798632d18ce7e27eca3e3b1
Opcode Fuzzy Hash: 09dbf71376382246d49a0a98356eeb4732abed6087f5bc6596bdebe5bbb3be5d
Instruction Fuzzy Hash: F751AEB0A01708ABE724DF64DC59B8EBBF4FF44704F10851DE519AB680DBB8A548CB99

Function 0043B0B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0043B176

Part of subcall function 0043BCD0: RtlInitializeCriticalSection.NTDLL(00598018), ref: 0043BD52
Part of subcall function 0043BCD0: __Init_thread_footer.LIBCMT ref: 0043BD6E
Part of subcall function 0043BCD0: RtlEnterCriticalSection.NTDLL ref: 0043BD89
Part of subcall function 0043BCD0: RtlLeaveCriticalSection.NTDLL(00598018), ref: 0043BE0F

Strings

www.baidu.com/s?wd=%s&%s, xrefs: 0043B13A
lExe, xrefs: 0043B162
cute, xrefs: 0043B169
Shel, xrefs: 0043B159
open, xrefs: 0043B18F
A, xrefs: 0043B170

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressEnterInit_thread_footerInitializeLeaveProc
String ID: A$Shel$cute$lExe$open$www.baidu.com/s?wd=%s&%s
API String ID: 3908199253-3770675778
Opcode ID: cf357bf981e7ad079372dcd6da146e0fe595968fe6b3e822861ff6851a2f8397
Instruction ID: b925b08b0e03e96236e0e07b64d2234ba9f73523150cea09b43ccfb927649aed
Opcode Fuzzy Hash: cf357bf981e7ad079372dcd6da146e0fe595968fe6b3e822861ff6851a2f8397
Instruction Fuzzy Hash: AE41E5719006189BDB20DF65CC46BDEB7B8FF08714F0042AEE519A72C1EB75AA44CF94

Function 0046A500 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58windowsynchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000096), ref: 0046A51B
PostMessageW.USER32(?,00000464,00000000,00000000), ref: 0046A54A
WaitForSingleObject.KERNEL32(?,00000096), ref: 0046A55B
SendMessageW.USER32(?,00000465,00000000,00000000), ref: 0046A577
Sleep.KERNEL32(0000000A), ref: 0046A588
SendMessageW.USER32(?,00000465,00000000,00000000), ref: 0046A596

Strings

gfff, xrefs: 0046A525

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Message$ObjectSendSingleWait$PostSleep
String ID: gfff
API String ID: 1155176049-1553575800
Opcode ID: 9497eb4904ac721a7f2473d0367d110811cd20015e4b099a5166a66c894f42ab
Instruction ID: 028b849916d0d22fc0270e815e4da6178435d7c03c3400830d893e29c3a98bd7
Opcode Fuzzy Hash: 9497eb4904ac721a7f2473d0367d110811cd20015e4b099a5166a66c894f42ab
Instruction Fuzzy Hash: A411C4313407067BE7205F19DC85F677755AB81B49F048435F305AA1E0E662E8119B5A

Function 00424200 Relevance: 12.2, APIs: 8, Instructions: 191threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00424231
InterlockedCompareExchange.KERNEL32(00597B1C,00000000), ref: 00424239
VirtualProtect.KERNEL32(00000000,00010000,00000040,?), ref: 0042426C
GetCurrentThread.KERNEL32 ref: 00424284
GetCurrentThreadId.KERNEL32 ref: 00424291
GetLastError.KERNEL32 ref: 004242C8
VirtualProtect.KERNEL32(?,?,00000040,?), ref: 004243CE
GetLastError.KERNEL32 ref: 004243D8

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentThread$ErrorLastProtectVirtual$CompareExchangeInterlocked
String ID:
API String ID: 3841906899-0
Opcode ID: a18261fd56c010708a02091f11256a42539a12f3bbf87b46f9a5bc4eefd7b812
Instruction ID: 73ba54a59d4c857f74cbfcf82a1ed4fd02bdc67698638d31dc707ef58c814aa2
Opcode Fuzzy Hash: a18261fd56c010708a02091f11256a42539a12f3bbf87b46f9a5bc4eefd7b812
Instruction Fuzzy Hash: 7A710470B04225DFDB20DF28E80036ABBE2FFA5714F95456BD84597381E739AC46CB89

Function 00486180 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

GetProcAddress.KERNEL32(?,?), ref: 004861F0
GetFileVersionInfoSizeA.KERNELBASE(?,00000000,?,?,?,00000000,00000000,00000000), ref: 0048623C
GetFileVersionInfoA.KERNELBASE(?,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00486273

Strings

%d.%d.%d.%d, xrefs: 004862EB
\, xrefs: 00486279
eA, xrefs: 004861E6

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$FileInfoVersion$AddressEnterInit_thread_footerInitializeLeaveProcSize
String ID: %d.%d.%d.%d$\$eA
API String ID: 446412201-3353862543
Opcode ID: 827db5794c334795b116db1802b559a551622448f2f012836a8679adfd08c2f1
Instruction ID: 93930e2c46c3b311bcfa1faeef95bf45aaa0cc7493fd1fb4ac7ebc342745cea8
Opcode Fuzzy Hash: 827db5794c334795b116db1802b559a551622448f2f012836a8679adfd08c2f1
Instruction Fuzzy Hash: D851C871900215ABDB50EBA4DC49FEEB7B8AF48314F0545D9E909A7241EB78EF84CB60

Function 0046A370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 0046A4AA
ShowWindow.USER32(?,00000005), ref: 0046A4BB
ShowWindow.USER32(?,00000000), ref: 0046A4C2
KiUserCallbackDispatcher.NTDLL(?), ref: 0046A4C7

Strings

., xrefs: 0046A3FE
progress_text_2, xrefs: 0046A405

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Window$Show$CallbackDispatcherEnableUser
String ID: .$progress_text_2
API String ID: 2643563226-2071466166
Opcode ID: c1bd88f12720634873981be8b1e279e6f1ba1049d8af04cb66bf33b79b59a600
Instruction ID: d9be28c9c65cb1140b763adcb3bb0c0c982ad328e8f4b4d5f387a3b095b57222
Opcode Fuzzy Hash: c1bd88f12720634873981be8b1e279e6f1ba1049d8af04cb66bf33b79b59a600
Instruction Fuzzy Hash: 40411731A00508BBCB109F68DC49BEFBB64EF55310F114267F805A7291EFB49A609F96

Function 0041BB20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597CD4), ref: 0041BB8F

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0041BBAB

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597CD4), ref: 0041BBC6
RtlLeaveCriticalSection.NTDLL(00597CD4), ref: 0041BC67

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Strings

@/B, xrefs: 0041BC00
d/B, xrefs: 0041BC24

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID: @/B$d/B
API String ID: 916978925-3891156361
Opcode ID: e89d293cc6f43baeae4c7ee4a275d08ccf4f8a59759e68ab998d6fc359240ff2
Instruction ID: e38103c641343cb5d3bc4d8a8e41327d8992d39a483517a852c7ba269d488704
Opcode Fuzzy Hash: e89d293cc6f43baeae4c7ee4a275d08ccf4f8a59759e68ab998d6fc359240ff2
Instruction Fuzzy Hash: A441CC70A08609EFDB00DF58D90AB9DBFB4FB58724F10425BE918A7380DBB42A04DB81

Function 0041BCA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597CEC), ref: 0041BD0E

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0041BD2A

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597CEC), ref: 0041BD45
RtlLeaveCriticalSection.NTDLL(00597CEC), ref: 0041BD9B

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Strings

h|Y, xrefs: 0041BD14
|Y, xrefs: 0041BD37

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID: h|Y$|Y
API String ID: 916978925-1160884022
Opcode ID: 84fdaac8ad93ef91a329be4d2c44522c410de9c2249f0c112c1177446758e0a2
Instruction ID: 2024343d8898a4aa7da2f1cef3246a4f5f20e8986fe773f635a54903359e9df4
Opcode Fuzzy Hash: 84fdaac8ad93ef91a329be4d2c44522c410de9c2249f0c112c1177446758e0a2
Instruction Fuzzy Hash: 3231DF31A586089FDB25DF58DC0679DBBA4FB18B24F10029BE810A73C1DBB51E048BC5

Function 004824A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,Static,00571978,40000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 004824DD
SetEvent.KERNEL32(?), ref: 00482504
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0048251A
DispatchMessageW.USER32(?), ref: 0048252A
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 0048253C

Strings

Static, xrefs: 004824CF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Message$CallbackCreateDispatchDispatcherEventUserWindow
String ID: Static
API String ID: 312368105-2272013587
Opcode ID: fa1ece8e85bdf012145b54dadb40929e6a1536082b7114be0bf3f0c354d4179e
Instruction ID: 979fb23471b1be8e337246d7cc5ea988c0ea6b3f1cb88725fb2cb1a198af4a63
Opcode Fuzzy Hash: fa1ece8e85bdf012145b54dadb40929e6a1536082b7114be0bf3f0c354d4179e
Instruction Fuzzy Hash: 2721EB30A80319BBEF109F64DC0AF5BBB68FB05714F204626F604B61D0DBB4F9048B98

Function 00416F20 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 51registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00415DC0: RtlInitializeCriticalSection.NTDLL(00597C64), ref: 00415E2E
Part of subcall function 00415DC0: __Init_thread_footer.LIBCMT ref: 00415E4A
Part of subcall function 00415DC0: RtlEnterCriticalSection.NTDLL(00597C64), ref: 00415E65
Part of subcall function 00415DC0: RtlLeaveCriticalSection.NTDLL(00597C64), ref: 00415EBB

GetProcAddress.KERNEL32(?,?), ref: 00416F73
RegOpenKeyExW.KERNEL32(?,?,00000000,0002001F,00000000), ref: 00416F8E

Strings

RegO, xrefs: 00416F56
penK, xrefs: 00416F5F
eyEx, xrefs: 00416F66
W, xrefs: 00416F6D

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressEnterInit_thread_footerInitializeLeaveOpenProc
String ID: RegO$W$eyEx$penK
API String ID: 3740573167-4071215687
Opcode ID: 7865db6372ee84a016aba1b633210a5238004aaec30d83d770ee428be26785f5
Instruction ID: 79ad6419baba601a1acab5e772e6df031d7fb47b8aa7ff297b28d04578d5b2d8
Opcode Fuzzy Hash: 7865db6372ee84a016aba1b633210a5238004aaec30d83d770ee428be26785f5
Instruction Fuzzy Hash: F4115275A00309EBCB10DF99D885AEFBBF8AF48704F11401DE509E7341DB74AA44DBA4

Function 00475100 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00475132
allocator.LIBCONCRTD ref: 0047513F
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0047514A
construct.LIBCPMTD ref: 0047516E
construct.LIBCPMTD ref: 0047518E
construct.LIBCPMTD ref: 004751AE

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: construct$Base::Concurrency::details::ContextIdentityQueueWork$allocator
String ID:
API String ID: 1129248848-0
Opcode ID: 67aaf804942d44862f1a7b588047046d6beb734b74c1f61d0beb492d2886c769
Instruction ID: 28ea19999b259fdf4395a56d3663ef73513a12457648f4b45807214c0ac3fe85
Opcode Fuzzy Hash: 67aaf804942d44862f1a7b588047046d6beb734b74c1f61d0beb492d2886c769
Instruction Fuzzy Hash: 222136B5E001099BCB04DFA5DC52AFFB7B8EB48718F10452EF519B7341D73969008BA5

Function 0048CE20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145filelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 0048CEBF
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,?,?,EFE0703F,00000000,00000000), ref: 0048CF72
GetLastError.KERNEL32(?,?,?,EFE0703F,00000000,00000000), ref: 0048CF83
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,?,?,EFE0703F,00000000,00000000), ref: 0048CFB5

Strings

\GlobalMgr.db, xrefs: 0048CF13

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateFile$AddressEnterErrorInit_thread_footerInitializeLastLeaveProc
String ID: \GlobalMgr.db
API String ID: 2937582819-1229192486
Opcode ID: 7283598c3a9f5df7ff006fdca25e4c5fdcb2c7374817a5b1d7b12a5f41eb3c27
Instruction ID: 905591a37d6a8b43dd220e73fc9161e0434049f184543c8f5e2753b4af7db452
Opcode Fuzzy Hash: 7283598c3a9f5df7ff006fdca25e4c5fdcb2c7374817a5b1d7b12a5f41eb3c27
Instruction Fuzzy Hash: 2A51A371A00219ABEB20DF64CC81FDDB7B8FB08714F10459AE659A71D1EBB46A84CF64

Function 0048FA50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048FAE0
DeviceIoControl.KERNEL32(00000000,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 0048FB7F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0048FC35

Part of subcall function 0048F110: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0048F17B
Part of subcall function 0048F110: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 0048F18A

Strings

\\.\Scsi%d:, xrefs: 0048FAB5
SCSIDISK, xrefs: 0048FB13

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_context$CloseControlCreateDeviceFileHandle
String ID: SCSIDISK$\\.\Scsi%d:
API String ID: 2060200711-2176293039
Opcode ID: 5b7d8f7ad94e34154c4cbcf00bd48e9a2534786f9e2be30f8342ced1859308db
Instruction ID: c157bf79228966d2e194857386f233021b19a9b6f4e0922547532a4889904160
Opcode Fuzzy Hash: 5b7d8f7ad94e34154c4cbcf00bd48e9a2534786f9e2be30f8342ced1859308db
Instruction Fuzzy Hash: 0B5196B098021CAAEB30EB14DC89BDDB774AF55704F1044EAAA08B71C2E7745BC8CF59

Function 00486350 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(005980C8), ref: 004863D2

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 004863EE

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL ref: 00486409
RtlLeaveCriticalSection.NTDLL(005980C8), ref: 0048645C

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Strings

+bH, xrefs: 0048635D

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID: +bH
API String ID: 916978925-3835015316
Opcode ID: 575ac6e47312d7d60619535353d645e1a5b02cba07ea9d827ff3e3f384706f11
Instruction ID: 0cca4ead0e6ea6a440e6237e246306b027ed8b2c37d93d01c6d358624936cf3f
Opcode Fuzzy Hash: 575ac6e47312d7d60619535353d645e1a5b02cba07ea9d827ff3e3f384706f11
Instruction Fuzzy Hash: AF31E3B1D04208DFDB00DF58D90A79EBBF0FB16B24F15436AE811A7391EB716A089B95

Function 004822B0 Relevance: 7.6, APIs: 5, Instructions: 95synchronizationthreadCOMMON

Download Yara Rule

APIs

GetExitCodeThread.KERNEL32(?,00000000,?,?,?,?,?,?,000000FF), ref: 004822FC
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,000000FF), ref: 00482314
CloseHandle.KERNEL32(?,?,?,?,?,?,?,000000FF), ref: 00482322
RtlDeleteCriticalSection.NTDLL(00000028), ref: 00482333
CloseHandle.KERNEL32(?,?,?,?,?,?,?,000000FF), ref: 004823A4

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CloseHandle$CodeCriticalDeleteExitObjectSectionSingleThreadWait
String ID:
API String ID: 2738947277-0
Opcode ID: 16a27bef36c3ba62ba695cd804531c77dd142ba971d52ad26475b38dbc73e17f
Instruction ID: 779a24adda17da7d69651057d122a5d630690dcffa00759ba924d4571b4758df
Opcode Fuzzy Hash: 16a27bef36c3ba62ba695cd804531c77dd142ba971d52ad26475b38dbc73e17f
Instruction Fuzzy Hash: 2231A0705007059FEB20DF64DA587AFBBF8FB05715F104A2DE85297780DBB9AA08CB54

Function 00490690 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0059699C), ref: 004906F6
RtlLeaveCriticalSection.NTDLL(0059699C), ref: 0049072F
74A5E3D0.COMCTL32(0041B390,00000000,?,?,?,?,?,00000000,00543F35,000000FF,?,0041AE4C), ref: 00490737

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

RtlInitializeCriticalSection.NTDLL(0059699C), ref: 004907AA
__Init_thread_footer.LIBCMT ref: 004907BF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize
String ID:
API String ID: 1517317770-0
Opcode ID: 241b30e65a021626b0382ea85a6c70b8a47595e29c6c836debbe46eb745d4db7
Instruction ID: 90fa9c0c4f31fb1ff98b4c1f4cab6027ce4007c811b0ac067db5f816bbeff7b3
Opcode Fuzzy Hash: 241b30e65a021626b0382ea85a6c70b8a47595e29c6c836debbe46eb745d4db7
Instruction Fuzzy Hash: 93313970A403109FDF206F749C16B6A3E94BB54F50F05043BE80597391EBB97D489BDA

Function 00473C80 Relevance: 7.6, APIs: 5, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00473CB2
allocator.LIBCONCRTD ref: 00473CBF
construct.LIBCPMTD ref: 00473CE3
construct.LIBCPMTD ref: 00473D03
construct.LIBCPMTD ref: 00473D23

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: construct$Base::Concurrency::details::ContextIdentityQueueWorkallocator
String ID:
API String ID: 516655193-0
Opcode ID: f71da5210e215d4c4b9da9c98a74acfd21a708a65f638d528a6cf97167982fa8
Instruction ID: 939b9391356c5d5b4b57b71079dadd5257edf8891a5786d6e093f8026eca27aa
Opcode Fuzzy Hash: f71da5210e215d4c4b9da9c98a74acfd21a708a65f638d528a6cf97167982fa8
Instruction Fuzzy Hash: 0B2174B5D001099BC704DF95E941BFFB7B8EB44318F14852EE919B7381D739AA058BA2

Function 004823E0 Relevance: 7.6, APIs: 5, Instructions: 67synchronizationthreadCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,00000000,?,00800BF0), ref: 004823F6
GetExitCodeThread.KERNEL32(?,?), ref: 0048240F
WaitForSingleObject.KERNEL32(?,00000000), ref: 00482427
ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,?,00800BF0), ref: 00482455
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,?,?,?,00800BF0), ref: 00482479

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ObjectSingleThreadWait$CodeEventExitResetResume
String ID:
API String ID: 1519825774-0
Opcode ID: eed652405ae0e3b0f9b019688ef0d1c3f386c98a4ed8e9bb24e3dc3c589cc83f
Instruction ID: 09e949730f6cb33b8b8fb81988e2fce70307fea12bf055cedfcf1a6782e14d46
Opcode Fuzzy Hash: eed652405ae0e3b0f9b019688ef0d1c3f386c98a4ed8e9bb24e3dc3c589cc83f
Instruction Fuzzy Hash: DC11B674700305EBDB20AFA5DD4ABAF7BA8EF14B01F00486AF946D2190DBB4E908D764

Function 00496970 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 004969AB
DeleteObject.GDI32(?), ref: 004969BC
SetPropW.USER32(?,SYSPLUGIN,00000000), ref: 00496B17

Strings

SYSPLUGIN, xrefs: 00496B0F

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: DeleteObject$Prop
String ID: SYSPLUGIN
API String ID: 2430622332-1574318955
Opcode ID: 465c74ea88c504b4bdccb5b3f9971d6c01e50ba518fed73208c003f2fd58de58
Instruction ID: b26c9207bf5ceac2e2a869887d4010c9d13d7af46911e142edc22cfd9248cec1
Opcode Fuzzy Hash: 465c74ea88c504b4bdccb5b3f9971d6c01e50ba518fed73208c003f2fd58de58
Instruction Fuzzy Hash: 14816B71A002199FCF00DFA9C884AAEFBB9FF49714F15412AE914B7361D779A900CBA4

Function 0044A5A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 210COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 0044A7DD
SetEvent.KERNEL32(00000000), ref: 0044A7E4

Strings

?p, xrefs: 0044A74F, 0044A838
pngquery, xrefs: 0044A771

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Event$Create
String ID: ?p$pngquery
API String ID: 1287507382-4246078739
Opcode ID: cffd0c479571550dfbb47f1f441a4d381bb9a812244800fdcc8b6801c52f4990
Instruction ID: d4948d60a76845cd8bd3c6e269babd35156e8d684ca59321b74df19c2bf6ecb3
Opcode Fuzzy Hash: cffd0c479571550dfbb47f1f441a4d381bb9a812244800fdcc8b6801c52f4990
Instruction Fuzzy Hash: 5E7164709002449FFB18DF78C948BDEBBB1EF41304F248A1DE056AB7C1D7B9AA808B51

Function 0052519A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,Function_00124FBA,00000000,00000000,?), ref: 005251E3
GetLastError.KERNEL32(?,?,?,00482443,00000000,00000000,00482E30), ref: 005251EF
__dosmaperr.LIBCMT ref: 005251F6

Strings

0.H, xrefs: 005251BD

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID: 0.H
API String ID: 2744730728-2821389324
Opcode ID: 4515d18410b8c3078c1253922647ed3f9311f1af18304199c464f37167bab6df
Instruction ID: f19d7d81382518a890a0972b78546b3870082c3d460e0b2abdef827a3272b9dd
Opcode Fuzzy Hash: 4515d18410b8c3078c1253922647ed3f9311f1af18304199c464f37167bab6df
Instruction Fuzzy Hash: E901803650562AABDB259FA5EC09A9F3F69FFC7360F010424F81583190EA318911DBA0

Function 0046D750 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(shlw,00000000), ref: 0046D807

Strings

dll, xrefs: 0046D775
api., xrefs: 0046D76D
shlw, xrefs: 0046D76A, 0046D774

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: api.$dll$shlw
API String ID: 1029625771-921442103
Opcode ID: 99d09243a56b648d25b8870e10c4bc4a5cf8c0c137dac94e451515f3943836fa
Instruction ID: ccd23ce4d57146f724635aba9b3c628d98da250bf2227c527a8044da74737550
Opcode Fuzzy Hash: 99d09243a56b648d25b8870e10c4bc4a5cf8c0c137dac94e451515f3943836fa
Instruction Fuzzy Hash: A0119AB0401B14DFE720CF56C5A835BBBF4FB04708F508A5DD49A5BA80C7BAA6488FC4

Function 0046D3E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(6C656873,00000000), ref: 0046D46D

Strings

shel, xrefs: 0046D3F3
l32., xrefs: 0046D3FD
dll, xrefs: 0046D405

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: dll$l32.$shel
API String ID: 1029625771-349186106
Opcode ID: e9e5b3dc1a88b5e0a6a469cf70a925ac186adb20abf328a0ab55f4e0be2a613b
Instruction ID: cf51512de9342cc559ce4913b6eaaccded645758c33976cea47ea521c18f3c7d
Opcode Fuzzy Hash: e9e5b3dc1a88b5e0a6a469cf70a925ac186adb20abf328a0ab55f4e0be2a613b
Instruction Fuzzy Hash: B111B0B0501B04DBE720DF55D56835BBBF4FB04708F408A5DD49A9BA80D7BAA6088F94

Function 0046DE10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(686E6977,00000000), ref: 0046DE9D

Strings

dll, xrefs: 0046DE35
winh, xrefs: 0046DE23
ttp., xrefs: 0046DE2D

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: dll$ttp.$winh
API String ID: 1029625771-2570946373
Opcode ID: 316db7fe54206d0258fdf4590e298ddc4021fa858ae2886e09ae1700c93be8de
Instruction ID: fe930234d32c0b02f024c258355a29a5b36cd673cdb749216577abfb0fcd9e84
Opcode Fuzzy Hash: 316db7fe54206d0258fdf4590e298ddc4021fa858ae2886e09ae1700c93be8de
Instruction Fuzzy Hash: B91180B0501B04DBE720DF55D56875BBBF4FB08708F408A5DD49A5BA80D7B9A608CFD4

Function 0046D2C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(75746573,0082A280), ref: 0046D320

Strings

setu, xrefs: 0046D2D3
.dll, xrefs: 0046D2E5
papi, xrefs: 0046D2DD

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll$papi$setu
API String ID: 1029625771-1874082302
Opcode ID: c719f8a96643a9373f2130588afd0a5592ac16caada603d623112d9f62e2a791
Instruction ID: 4d6839999a38c31f5f4f5afa88e561df1decc8bad4ed964ddd8057f2e4932538
Opcode Fuzzy Hash: c719f8a96643a9373f2130588afd0a5592ac16caada603d623112d9f62e2a791
Instruction Fuzzy Hash: E901F2B0901708DBD720DF59D51979BFFF4AB08704F10856DD446A7640D7B5AA08CBE5

Function 004DC650 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004F3190: GetModuleHandleA.KERNEL32(kernel32,75920E50,00000002,004D80FF), ref: 004F319E

GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceA), ref: 004DC68D

Strings

secur32.dll, xrefs: 004DC668
security.dll, xrefs: 004DC66D, 004DC675
InitSecurityInterfaceA, xrefs: 004DC687

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 1646373207-3788156360
Opcode ID: 16e8d8781c7ff577dd6b7da44884a8f9b5961784615c29fe8d56186f66de62df
Instruction ID: fd0076a76264ab3809fc7b518cab3c9b10ceae0d7998c2032d32a449aefa1c50
Opcode Fuzzy Hash: 16e8d8781c7ff577dd6b7da44884a8f9b5961784615c29fe8d56186f66de62df
Instruction Fuzzy Hash: 20F065B07813035AEF215F254D6AB2726945BA0706F56417B6A15D93C1EA7CCC08D619

Function 0046F5AC Relevance: 6.3, APIs: 4, Instructions: 266threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0046F5CB

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 318ad400297d6de76f8597c7c7a0a7a7e36ed837cc79c9cc4dda782083ae38f8
Instruction ID: a849d3d81e9d94c1778f0b5d4ff7ad30b7be293d34ddad40e3edbb662e818b4f
Opcode Fuzzy Hash: 318ad400297d6de76f8597c7c7a0a7a7e36ed837cc79c9cc4dda782083ae38f8
Instruction Fuzzy Hash: 03A1A270E002198FDF24CF68E88479DBBB5AB55304F2481BBD485D7356E7348D8A8F4A

Function 00485EE0 Relevance: 6.1, APIs: 4, Instructions: 121fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00000000,00000000,?,004233AC,?,?,?,?,?,@1_360.exe), ref: 00485F08
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000000,?,004233AC,?,?,?), ref: 00485F37
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,?,?,?,?,@1_360.exe), ref: 00485FC6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,@1_360.exe), ref: 00485FF5

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateHandleRead
String ID:
API String ID: 2880068760-0
Opcode ID: 1c011c1be143bc307ee1ccb1c7d23781e3749e4b655c6097e0f10a991a6186bb
Instruction ID: 748e15a50aadf5fd7a5dd22f0c0e7dfd3a8882a346a5a592648a3421d7208f5c
Opcode Fuzzy Hash: 1c011c1be143bc307ee1ccb1c7d23781e3749e4b655c6097e0f10a991a6186bb
Instruction Fuzzy Hash: 8941D8709002599BEB20EF64DD45BDEB3B5EF05304F1049AAE949BB181E7B45EC8CF54

Function 004552D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597F68), ref: 00455352

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0045536E

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL ref: 00455389
RtlLeaveCriticalSection.NTDLL(00597F68), ref: 004553E1

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: 2b5207b0a1fcf8eccc23bff4bddfb46184cc720cfd7b9a0c489b4d8f79066ff1
Instruction ID: 0c96869bc74de6e15750aba4d486048fc8e2629903977fe9c5d0e346cfa5ee5f
Opcode Fuzzy Hash: 2b5207b0a1fcf8eccc23bff4bddfb46184cc720cfd7b9a0c489b4d8f79066ff1
Instruction Fuzzy Hash: 7931CFB1D187089FDB11DF5899067A9BBB0FB19B24F1042ABE811A33D1E7B15A04CB96

Function 00408050 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597B94), ref: 004080BE

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 004080DA

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597B94), ref: 004080F5
RtlLeaveCriticalSection.NTDLL(00597B94), ref: 0040814B

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: 45c9dcebcb4fcd055e08ea4f1d8aeb9a1e95a558c7fde6db34c192b3eedebc22
Instruction ID: f43bbb6423608e74e977b4177792906e6e3fb0285bda367131f04ad143072228
Opcode Fuzzy Hash: 45c9dcebcb4fcd055e08ea4f1d8aeb9a1e95a558c7fde6db34c192b3eedebc22
Instruction Fuzzy Hash: CD31E835D08609DFDB10DF58DD0679EBBB5FB08B18F10429BE425A73C1EBB51A048B81

Function 00408180 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0040820A

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: c630fa0b7589807be2e33008512972c10cc34a4c8cc7cfe81dddad3a9b598ad9
Instruction ID: f0aaa77cdfe08d682c454385e37022b0c08908178d8291d9ee2094e266bd5c25
Opcode Fuzzy Hash: c630fa0b7589807be2e33008512972c10cc34a4c8cc7cfe81dddad3a9b598ad9
Instruction Fuzzy Hash: 8531E231A48A08DFDB10DF98DD06B9D7BA4FB18B14F1042AFE810A33C1EBB51A048B95

Function 00467AA0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0059806C), ref: 00467B0E

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 00467B2A

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(0059806C), ref: 00467B45
RtlLeaveCriticalSection.NTDLL(0059806C), ref: 00467B99

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: 38d00dfc6dd566cd1b84a85dcdf4aee55c0f5aa354672eb396c045367be88080
Instruction ID: 0c6643e11dc64c83e0cf189ea66258a100bcda4080e26380151bb26afb711d60
Opcode Fuzzy Hash: 38d00dfc6dd566cd1b84a85dcdf4aee55c0f5aa354672eb396c045367be88080
Instruction Fuzzy Hash: 9831B471D44209DFDB00DF68D80A79DBBB0FB59B28F10436BE815A7390EBB55A48CB91

Function 0052510E Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,Function_00124F3B,00000000,00000004,00000000), ref: 0052515A
GetLastError.KERNEL32 ref: 00525166
__dosmaperr.LIBCMT ref: 0052516D
ResumeThread.KERNEL32(00000000), ref: 0052518B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 4faed2b95914eae341e10d3883a5b65310008893017a771d142cac3827333175
Instruction ID: c444432953ebe7e7cd61986f7a66130bb8c5372ded9c9a2013f33e782fa49922
Opcode Fuzzy Hash: 4faed2b95914eae341e10d3883a5b65310008893017a771d142cac3827333175
Instruction Fuzzy Hash: 4E01D236414A25BBE7206BA8EC0DBAF7F68FF83731F100215F924821D0EB718955C7A0

Function 00532D83 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00532D2A,?,00000000,00000000,00000000,?,00533056,00000006,FlsSetValue), ref: 00532DB5
GetLastError.KERNEL32(?,00532D2A,?,00000000,00000000,00000000,?,00533056,00000006,FlsSetValue,00569DE8,FlsSetValue,00000000,00000364,?,005347D5), ref: 00532DC1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00532D2A,?,00000000,00000000,00000000,?,00533056,00000006,FlsSetValue,00569DE8,FlsSetValue,00000000), ref: 00532DCF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6f070ff89470435c7b0e02c0574fb90aaf4e4717e38a2bfc9506e57acc348537
Instruction ID: f9af924201c624cd2ad27dc0d8ddca473f9fad4d642c7b0aa0b403c0303e8667
Opcode Fuzzy Hash: 6f070ff89470435c7b0e02c0574fb90aaf4e4717e38a2bfc9506e57acc348537
Instruction Fuzzy Hash: 6A01F23A625A22ABC7214B6DEC44A967F98FF16BA5F210E20F906D3140CB30D807D7E0

Function 00408EE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 004035B0: std::locale::_Init.LIBCPMT ref: 00403619

std::locale::_Init.LIBCPMT ref: 00408FF1

Part of subcall function 00403470: __CxxThrowException@8.LIBVCRUNTIME ref: 0040349D
Part of subcall function 00403470: __CxxThrowException@8.LIBVCRUNTIME ref: 004034E2

Part of subcall function 0040D0D0: std::_Lockit::_Lockit.LIBCPMT ref: 0040D10C
Part of subcall function 0040D0D0: std::_Lockit::_Lockit.LIBCPMT ref: 0040D12E
Part of subcall function 0040D0D0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040D156
Part of subcall function 0040D0D0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040D2A1

Strings

)@, xrefs: 00408F52
1@, xrefs: 00408FC2

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Exception@8InitLockit::_Lockit::~_Throwstd::locale::_
String ID: )@$1@
API String ID: 3818760586-2840543281
Opcode ID: 05c3d88d774c0601ec1489d5b66244bffc8f810f3dfea1b3fe9467d8304ca25c
Instruction ID: deae8829857c0e56a224919e77ac2c91d45f5c733d29db3c0dde497fb81eccab
Opcode Fuzzy Hash: 05c3d88d774c0601ec1489d5b66244bffc8f810f3dfea1b3fe9467d8304ca25c
Instruction Fuzzy Hash: 7FB1D7B4A00205DFDB10CF59C994B9ABBF4FF09314F1581AAE805AF392D77A9945CF90

Function 0049F670 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(004906C4,?,00000104,75920E50,0041B390,005733F8), ref: 0049F6C6
LoadTypeLib.OLEAUT32(?,?), ref: 0049F6E4
SysFreeString.OLEAUT32(00000000), ref: 0049F838

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: FileFreeLoadModuleNameStringType
String ID:
API String ID: 4083945026-0
Opcode ID: 0be6a6196ee86ef7792afd48c43d55f1b4dd9491417c7649c491e8f39f1a7ee6
Instruction ID: 4dda26bcd544fd14441eb4dfafd73d441e2e82be9e16db2a2d0ac3b5ed7e4b41
Opcode Fuzzy Hash: 0be6a6196ee86ef7792afd48c43d55f1b4dd9491417c7649c491e8f39f1a7ee6
Instruction Fuzzy Hash: 58514D71A012199BDF20EF64CC89BDAB7B8FF48304F1045EAE509E7250D738AA85CF54

Function 004059D0 Relevance: 4.6, APIs: 3, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,?,EFE0703F), ref: 00405AB4
RegQueryValueExW.KERNEL32(00000000,00740053,00000000,00000001,?,00000104), ref: 00405B35
RegCloseKey.ADVAPI32(00000000), ref: 00405B41

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f038b0d0d1d9df09a0f5e827b8835f1d83705937ae371ba6b398fa1805ed6815
Instruction ID: e3be2bc35274d82d92bcf34f10f9c755e652f5340fe98d5d77b14e089490af26
Opcode Fuzzy Hash: f038b0d0d1d9df09a0f5e827b8835f1d83705937ae371ba6b398fa1805ed6815
Instruction Fuzzy Hash: 1E612FB4D01258DFEB60DF90C84CBDEBBB5FB04308F1042A9D519A7291DBB55A88CF94

Function 004717A0 Relevance: 4.6, APIs: 3, Instructions: 111COMMON

Download Yara Rule

APIs

std::locale::facet::facet.LIBCPMTD ref: 00471814
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471844
Concurrency::details::_AsyncTaskCollection::~_AsyncTaskCollection.LIBCONCRTD ref: 004718D9

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AsyncTask$Affinity::operator!=CollectionCollection::~_Concurrency::details::Concurrency::details::_Hardwarestd::locale::facet::facet
String ID:
API String ID: 1231514646-0
Opcode ID: edf22b209188365b0819a156ff723ef45c777f0dbf5a45d6a3f6d2954fbe76f5
Instruction ID: c2c6776b136ad66135f42c80b88a170ea071435d5b95d5d81849948d6e5a690b
Opcode Fuzzy Hash: edf22b209188365b0819a156ff723ef45c777f0dbf5a45d6a3f6d2954fbe76f5
Instruction Fuzzy Hash: BA4120B1D10109DFCB08EF99D951AEFB7B5FF58314F10822EE016A7291DB746A05CBA4

Function 00532017 Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,0051230A,?,00531F35,0051230A,0058C980,0000000C), ref: 0053206D
GetLastError.KERNEL32(?,00531F35,0051230A,0058C980,0000000C), ref: 00532077
__dosmaperr.LIBCMT ref: 005320A2

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 13ae21866eec027287e8fd717e88ae60345f14550dcc7dc748287f6e09b7c525
Instruction ID: 47caa73e1590b659dd4f9663fb2b165c2b97d351a8fc7314c210e6aca6a1a932
Opcode Fuzzy Hash: 13ae21866eec027287e8fd717e88ae60345f14550dcc7dc748287f6e09b7c525
Instruction Fuzzy Hash: F701CE32A099141AE63D1338984DB7D2F49BBCA734F25021AF824C71D2DE619C88C340

Function 0046EE5F Relevance: 4.5, APIs: 3, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,?,?,?,0046F4FE,?,00000000), ref: 0046EE70
VirtualProtect.KERNEL32(00000000,00010000,00000020,?,00000000,?,?,?,0046F4FE,?,00000000), ref: 0046EE90
FlushInstructionCache.KERNEL32(00000000,00000000,00010000,?,?,?,0046F4FE,?,00000000), ref: 0046EE99

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: e42dd9cc3488d5eb93c8c6ae313304d91fa69bfe922df8b7f77ec369c40feb65
Instruction ID: 9c3dcaad3cfe3b9c39b19e3d88d40107698d6e769a75559a83e5dc1fd974a590
Opcode Fuzzy Hash: e42dd9cc3488d5eb93c8c6ae313304d91fa69bfe922df8b7f77ec369c40feb65
Instruction Fuzzy Hash: 28F0B435501218FBD7118B19EC489FF7BACEB5DB64B410059F801A3200DB24AD05D6A5

Function 0048D960 Relevance: 4.5, APIs: 3, Instructions: 34threadCOMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00597AA4,000000FF,00000000), ref: 0048D970
InterlockedExchange.KERNEL32(00597AA4,00000001), ref: 0048D994
SwitchToThread.KERNEL32(?,0048EAE9,?,EFE0703F,00000000,00000000), ref: 0048D9B3

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompareSwitchThread
String ID:
API String ID: 2506754736-0
Opcode ID: 1b6c5e33c27b44e036081366c5a8c5f6940096632c2534a92b8a6942e2615916
Instruction ID: b632a507df4005fee82b027099c33a1518325281227d2c2dbaa3702ee88f6ab3
Opcode Fuzzy Hash: 1b6c5e33c27b44e036081366c5a8c5f6940096632c2534a92b8a6942e2615916
Instruction Fuzzy Hash: 42F046349683099AD7206B1CED01BEE3714AF38314F014173F9081A5B1D6B025D4E754

Function 0052506E Relevance: 4.5, APIs: 3, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00534787: GetLastError.KERNEL32(?,?,?,0051EAA1,005349B8,?,00534731,00000001,00000364,?,00524F60,0058C738,00000010), ref: 0053478C
Part of subcall function 00534787: _free.LIBCMT ref: 005347C1
Part of subcall function 00534787: SetLastError.KERNEL32(00000000), ref: 005347F5

RtlExitUserThread.NTDLL(?,?,?,0052522C,?,?,00524F9A,00000000), ref: 00525080
CloseHandle.KERNEL32(?,?,?,0052522C,?,?,00524F9A,00000000), ref: 005250A8
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0052522C,?,?,00524F9A,00000000), ref: 005250BE

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibraryUser_free
String ID:
API String ID: 1765993807-0
Opcode ID: 5a32ee2575200aba5aaaebdef74a5c03f58d445708c8295311f2c262f9a7823d
Instruction ID: bcf945499e7d90629ba33448647c0ed1273f20173f71fa737dc9f3bf272e0d07
Opcode Fuzzy Hash: 5a32ee2575200aba5aaaebdef74a5c03f58d445708c8295311f2c262f9a7823d
Instruction Fuzzy Hash: 36F05E39400A246BDB315B79EC0CA9A7F98BF03764F094B10B865C25E0F770EC45C6D0

Function 00476120 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004761AB

Strings

A valid JSON document must be either an array or an object value., xrefs: 00476266

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Container_base12Container_base12::~_std::_
String ID: A valid JSON document must be either an array or an object value.
API String ID: 1531518832-2233189945
Opcode ID: 9aec7b928dce5fcd69ec209dff565cab410daa6f4332bad21479271b5520b6dc
Instruction ID: 43c72d64df9972bd3dd0912d48a8fc7266fd4c00a37c3b19c5e9d7bffa1e1317
Opcode Fuzzy Hash: 9aec7b928dce5fcd69ec209dff565cab410daa6f4332bad21479271b5520b6dc
Instruction Fuzzy Hash: 89511F749005499BCB08EFA9D851AEEBBB2BF48304F14C15EE8657B392DB34A905CF64

Function 0C905291 Relevance: 3.4, Strings: 2, Instructions: 868COMMON

Download Yara Rule

Strings

#,, xrefs: 0C9052C2
w, xrefs: 0C90577E

Memory Dump Source

Source File: 00000000.00000002.3294499264.000000000C900000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c900000_nv8401986_110422.jbxd

Similarity

API ID:
String ID: #,$w
API String ID: 0-4160908511
Opcode ID: 1b768c840ab6314882e69f56c7e591d41e32ff1a2e9956a79490e9df2d3788d2
Instruction ID: 78d042ec9ff59e19f952711db9082b96c7db0494886e14f652d043a589372eeb
Opcode Fuzzy Hash: 1b768c840ab6314882e69f56c7e591d41e32ff1a2e9956a79490e9df2d3788d2
Instruction Fuzzy Hash: 4472DF70A40215DFDB20CF85C944BAAB7FAFF85310F22854AEA15AB3D1D774A841CFA5

Function 00471AC0 Relevance: 3.1, APIs: 2, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471B6D
Concurrency::details::_AsyncTaskCollection::~_AsyncTaskCollection.LIBCONCRTD ref: 00471C07

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AsyncTask$Affinity::operator!=CollectionCollection::~_Concurrency::details::Concurrency::details::_Hardware
String ID:
API String ID: 3541056932-0
Opcode ID: a7e15b6bf1fe2b32b2e8af7cd7265f125dbae52be3405325ccf178e397ec0926
Instruction ID: f85fd17d4b2f463e11e139ae07223c83f3fa5c1b858d0a19c26f47913683b5ab
Opcode Fuzzy Hash: a7e15b6bf1fe2b32b2e8af7cd7265f125dbae52be3405325ccf178e397ec0926
Instruction Fuzzy Hash: 78412FB1D00109DFCB08DF99D991AEEB7B5FF58314F20825EE416B72A1EB346A04CB64

Function 004266E0 Relevance: 3.1, APIs: 2, Instructions: 90windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00433370: GetCurrentProcessId.KERNEL32(00000000), ref: 0043341E
Part of subcall function 00433370: PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 00433432

IsWindow.USER32(?), ref: 0042670D
PeekMessageW.USER32(?,00000000,00000000,00000000,00400001), ref: 0042673B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Message$CurrentPeekPostProcessWindow
String ID:
API String ID: 1186865699-0
Opcode ID: 79220a0fbb4791ffa07baf951acdfdd28bfd0668920a3206b5710d26085809a1
Instruction ID: b0f292c0d3f69f449c4ee74118ed7d11651f29880bd9ca03050c111c46d14f41
Opcode Fuzzy Hash: 79220a0fbb4791ffa07baf951acdfdd28bfd0668920a3206b5710d26085809a1
Instruction Fuzzy Hash: 1731A575B002549BDF20EF25E881BD677A4BB40744F4A407AED48AF385E778EC84CBA4

Function 00416FC0 Relevance: 3.1, APIs: 2, Instructions: 72registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00415DC0: RtlInitializeCriticalSection.NTDLL(00597C64), ref: 00415E2E
Part of subcall function 00415DC0: __Init_thread_footer.LIBCMT ref: 00415E4A
Part of subcall function 00415DC0: RtlEnterCriticalSection.NTDLL(00597C64), ref: 00415E65
Part of subcall function 00415DC0: RtlLeaveCriticalSection.NTDLL(00597C64), ref: 00415EBB

GetProcAddress.KERNEL32(?,?), ref: 00417013
RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 00417030

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressEnterInit_thread_footerInitializeLeaveProcQueryValue
String ID:
API String ID: 1845476169-0
Opcode ID: 577a2aa1d182d1bf5596277a2ea1833a6c025b48cdb3e59b88d0fefe25de9a86
Instruction ID: e76a618d51df4b7221a631ce92253d388ab90105f1f54e6fa6f6e847c37af94c
Opcode Fuzzy Hash: 577a2aa1d182d1bf5596277a2ea1833a6c025b48cdb3e59b88d0fefe25de9a86
Instruction Fuzzy Hash: 39211D75A00209DBDB10DFA8D881AEEBBF8FF59300F10416AE505E7250EB35A995CBA0

Function 0046EF5B Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302411478f885b62b6acab54caba617541d94c3c4ff4b13778b21bdc05ee5916
Instruction ID: 407a40439a962be098ac36d4a7c646c3fe859bc0c2ab96f520cadb4ca0bc8b90
Opcode Fuzzy Hash: 302411478f885b62b6acab54caba617541d94c3c4ff4b13778b21bdc05ee5916
Instruction Fuzzy Hash: 4511EB36A00525BBEB28963ADC44BBB76E4FB44700F21013BF505E3284F768DD0592DE

Function 00532CE7 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00532D47
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00532D54

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 84b81e3e6fc1c966432d6ef8c698c41b103cef948f54de034a664f9edbf4f00f
Instruction ID: bb4f655b4263ea8bf92ae4bff62c4bac67f1da175e9f471d848846b139c4fca0
Opcode Fuzzy Hash: 84b81e3e6fc1c966432d6ef8c698c41b103cef948f54de034a664f9edbf4f00f
Instruction Fuzzy Hash: 1B110637A009219B9B269F1CDC4499A7BA5BBC4760F174A21FD15EB258D730EC029BD0

Function 00473210 Relevance: 3.1, APIs: 2, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00472C90: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00472CBB

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00473273
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004732A1

Part of subcall function 00472C20: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00472C4B

Part of subcall function 00472B40: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00472B6B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextIdentityQueueWork$Affinity::operator!=Hardware
String ID:
API String ID: 3741678075-0
Opcode ID: 3b08f9e768f756c6c1d930cdf631a008ba3975517345f31637fe52a38965a98a
Instruction ID: a43a3ceb674119fd95d00cdbea4e4a4f067b9bb6db4a9680626ed97a934c9717
Opcode Fuzzy Hash: 3b08f9e768f756c6c1d930cdf631a008ba3975517345f31637fe52a38965a98a
Instruction Fuzzy Hash: 38113BB1500108ABCB09EF95D992DEE7378AF44305B10816EB54A9B292DB34AF04DBA9

Function 00421F00 Relevance: 3.1, APIs: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00421FAD
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 00421FC1

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: 7e2d0363a127c6e42df539bcc3f27a6db5804d579902a258d33fb4ae42fe076a
Instruction ID: 493319e5ff258d0f09d61a404a3719b6baa831274e6606e9d5ffacd60155867a
Opcode Fuzzy Hash: 7e2d0363a127c6e42df539bcc3f27a6db5804d579902a258d33fb4ae42fe076a
Instruction Fuzzy Hash: 10217CB5D047459FD304CF58C945B56FBE4FB59314F1083AAE8189B381E7B5E984CB90

Function 004082B0 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0040835E
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 00408372

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: 6b2f95533a11668970f677aa42b5cbc2466ee801684c3828ab6885be0139297d
Instruction ID: 9dff137b79050071dea44d474b9b5e5e5ae0054d96e403483a944a00ca0696ad
Opcode Fuzzy Hash: 6b2f95533a11668970f677aa42b5cbc2466ee801684c3828ab6885be0139297d
Instruction Fuzzy Hash: F9217AB5904746AFD304CF58C949B56FBE4FB59314F1083AAE8188B381EBB5A984CB90

Function 0044C6C0 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0044C76E
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 0044C782

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: 018ad8622b7fae9efbc5a8c2a1909b36e76453fd4b5589e2d2efec8dfd6ea0dc
Instruction ID: 5ffbe53203baa98c48a8f6d03b7e7018eefc68c8e72e4bad9524cd93c68763e4
Opcode Fuzzy Hash: 018ad8622b7fae9efbc5a8c2a1909b36e76453fd4b5589e2d2efec8dfd6ea0dc
Instruction Fuzzy Hash: 9E217AB59047469FD304CF58C945B56FBE4FB59314F1087AAE8188B381EBB5E984CBD0

Function 00422E50 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00422EFE
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 00422F12

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: c5343e0bc8a78972eca002ad0e101312df85e500386a162fb9adbf6516394203
Instruction ID: cb6d6c7aec83fe853d787290955b07201360c29766fb29c8a891b98a155123fc
Opcode Fuzzy Hash: c5343e0bc8a78972eca002ad0e101312df85e500386a162fb9adbf6516394203
Instruction Fuzzy Hash: 6B21ACB5D00346AFD304CF18C944B56FBE4FB49314F1087AAE8189B381EBB5AA84CBD0

Function 00411370 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0041141E
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 00411432

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: 66a20f3b0183da1ed033e8371ce4ea211774bd8523529571b9279d1222b949d5
Instruction ID: cb227eb65dd549114a14d0a491f91d91ca0bd8a547f75cd41463d909b90baba2
Opcode Fuzzy Hash: 66a20f3b0183da1ed033e8371ce4ea211774bd8523529571b9279d1222b949d5
Instruction Fuzzy Hash: 0921ACB5D00346AFD304CF18C948B56FBE4FB49314F1083AAE8188B381EBB5A984CBD0

Function 00433370 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0043341E
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 00433432

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: c416d77a3287ae42491025f5a835137afbb8988a3f0f2e03e096b8989e3b3e18
Instruction ID: c37505041123e12c38cfe7212d80e677788822172c97a52a2557222ce818afb3
Opcode Fuzzy Hash: c416d77a3287ae42491025f5a835137afbb8988a3f0f2e03e096b8989e3b3e18
Instruction Fuzzy Hash: CC218CB5D047469FD304CF58C945B56FBE4FB59314F1083AAE8188B381EBB5A984CBD0

Function 0043BE40 Relevance: 3.1, APIs: 2, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0043BECD
PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 0043BEE1

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CurrentMessagePostProcess
String ID:
API String ID: 3746246500-0
Opcode ID: 7f52f2361005956e86439741024540be1bea0c0612572e551007dcac9d56219e
Instruction ID: ec3803969fd76a2d153318d765950a9863157699229a36a10959b82e67e3d4cd
Opcode Fuzzy Hash: 7f52f2361005956e86439741024540be1bea0c0612572e551007dcac9d56219e
Instruction Fuzzy Hash: 30216DB5904746EFD704CF58C944B9AFBF4FB59314F10879AE8189B381D7B5AA80CB80

Function 00524F3B Relevance: 3.0, APIs: 2, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0058C738,00000010), ref: 00524F4E
RtlExitUserThread.NTDLL(00000000), ref: 00524F55

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: 1760aa99205214cc0cbc84dde7c720361cfba70e49fda1c99eddbf060c4b64eb
Instruction ID: 8d843416b46e8028c006474fb708ee0f01f7c30d8ac021810ef29603a0a13213
Opcode Fuzzy Hash: 1760aa99205214cc0cbc84dde7c720361cfba70e49fda1c99eddbf060c4b64eb
Instruction Fuzzy Hash: 90F0AF79A442159FDB01AFB0E94EBAD7F70FF86700F200059F502AB2D2DBB469459BA0

Function 00524FBA Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0058C758,00000010), ref: 00524FCD
RtlExitUserThread.NTDLL(00000000), ref: 00524FD4

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThreadUser
String ID:
API String ID: 1750398979-0
Opcode ID: 3715eeb7f0b305a3b4978c3ad29cbf0b9df5c3daa3be70cbfceebc7f510e8e4d
Instruction ID: fa2f67687b404eb9e07b3fc16445bf670b6ef6b3d6fbd87dd6228ab81ac475f1
Opcode Fuzzy Hash: 3715eeb7f0b305a3b4978c3ad29cbf0b9df5c3daa3be70cbfceebc7f510e8e4d
Instruction Fuzzy Hash: 3AF0AF78940216AFDB01AFB0D94EAAD3F75FF86300F100058F402A72D2DB746945DBA0

Function 0043B250 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 004266E0: IsWindow.USER32(?), ref: 0042670D

Part of subcall function 0043BCD0: RtlInitializeCriticalSection.NTDLL(00598018), ref: 0043BD52
Part of subcall function 0043BCD0: __Init_thread_footer.LIBCMT ref: 0043BD6E
Part of subcall function 0043BCD0: RtlEnterCriticalSection.NTDLL ref: 0043BD89
Part of subcall function 0043BCD0: RtlLeaveCriticalSection.NTDLL(00598018), ref: 0043BE0F

FreeLibrary.KERNEL32(?), ref: 0043B27F
FreeLibrary.KERNEL32(?), ref: 0043B294

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$FreeLibrary$EnterInit_thread_footerInitializeLeaveWindow
String ID:
API String ID: 552026310-0
Opcode ID: 71ce5e20c4c49b136f395b1bf2216a5d5f134c695108b71b8a23c1e5132f5a40
Instruction ID: 4facbffdcf2ef9bc607ffd8ecdd0104c3b147fd379a3cfe6e68b07f77938891c
Opcode Fuzzy Hash: 71ce5e20c4c49b136f395b1bf2216a5d5f134c695108b71b8a23c1e5132f5a40
Instruction Fuzzy Hash: 98F08C702002048BD720AF6DD848B4773D8EB18318F04426DE899D7291DB79E844CBE8

Function 0048D9E0 Relevance: 2.9, APIs: 2, Instructions: 421COMMON

Download Yara Rule

APIs

Part of subcall function 0048FC70: GetVersionExW.KERNEL32(00000114,00000000,00000000), ref: 0048FCB4

Part of subcall function 0048CC10: _Smanip.LIBCPMT ref: 0048CCA2

Part of subcall function 0048CE20: GetProcAddress.KERNEL32(?,?), ref: 0048CEBF

CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,?,?,00000000), ref: 0048E064

Part of subcall function 0048D030: GetProcAddress.KERNEL32(00000003,00000000), ref: 0048D0E2
Part of subcall function 0048D030: GetProcAddress.KERNEL32(00000003,00000000), ref: 0048D135
Part of subcall function 0048D030: GetProcAddress.KERNEL32(00000003,00000000), ref: 0048D188

CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 0048DD3F

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc$CloseHandle$SmanipVersion
String ID:
API String ID: 3547271121-0
Opcode ID: 8536385639c61c069b7032ae136035ad8fe04625cef40a3b0fb14e395b9001a7
Instruction ID: a0b3c337c60282dbc97f4e9ae1ff50e7de5d898d5da4cc5e22ee954b6bceaaae
Opcode Fuzzy Hash: 8536385639c61c069b7032ae136035ad8fe04625cef40a3b0fb14e395b9001a7
Instruction Fuzzy Hash: 05126F70C052989AEB21EB64CD45BDEBBB4AF15308F0441EED44973282EB745F88DF66

Function 0EC8A000 Relevance: 2.3, Strings: 1, Instructions: 1014COMMON

Download Yara Rule

Strings

Ak, xrefs: 0EC8A6B4

Memory Dump Source

Source File: 00000000.00000002.3304984035.000000000EC80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0EC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec80000_nv8401986_110422.jbxd

Similarity

API ID:
String ID: Ak
API String ID: 0-1927009387
Opcode ID: baeab52ff20b606d9d5181e31515228b1b172ba8fb55112be2eead9d7027f536
Instruction ID: 9df8a95dfde42ab476b0e1e5bd448081eba8d0ce0165135b1aef33c98f282965
Opcode Fuzzy Hash: baeab52ff20b606d9d5181e31515228b1b172ba8fb55112be2eead9d7027f536
Instruction Fuzzy Hash: DC820070600200DFEB64DF45CB95F69B3A5FB84318F15854AE846AF386DB76EC82CB61

Function 0048E6A0 Relevance: 1.9, APIs: 1, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d384a54105181594b79476044d6aa024a063f870c2683b07cb67268f3f96c040
Instruction ID: 9a5173b79dcf5fcee6b3bef16d22e07dec158004a622286db5c0485b33b4da56
Opcode Fuzzy Hash: d384a54105181594b79476044d6aa024a063f870c2683b07cb67268f3f96c040
Instruction Fuzzy Hash: C2E1DF71900218DEDB24EF65CC55BEEB7B9AF94304F0045EEE409A3181EB756B98CFA4

Function 0B9C43AE Relevance: 1.8, Strings: 1, Instructions: 595COMMON

Download Yara Rule

Strings

"m, xrefs: 0B9C46D2

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID: "m
API String ID: 0-3580381498
Opcode ID: 110f1322153cc7939888e69fb36a51f2623d4c02e811b066511ea35c378b8632
Instruction ID: 7eb57b8fa9c336614d234ed37a42e148c88de4321efe888d5166abe29851bbb2
Opcode Fuzzy Hash: 110f1322153cc7939888e69fb36a51f2623d4c02e811b066511ea35c378b8632
Instruction Fuzzy Hash: 4F32AA70E40314DFEB20CF84C9A8BAABBE5FB44714F15854AE9256B392C774AD41CF62

Function 004343E0 Relevance: 1.8, APIs: 1, Instructions: 289windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,000004C9,00000000,00000000), ref: 004347D2

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 12a20019a821f82eb247c8438ef66c88040f8590510c5a3561366ca4b23a8708
Instruction ID: e9ea37627c4d635df0377ed9a0194fd3503de496be764e11cb72b02e3d1adf17
Opcode Fuzzy Hash: 12a20019a821f82eb247c8438ef66c88040f8590510c5a3561366ca4b23a8708
Instruction Fuzzy Hash: 5AB10271500A409BE728DF38CD587EFBBE5EB85314F148A1DE0A68B7D0D779BA448B84

Function 0047D780 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3f9c59d712aed5ce851ea2227e667eee930213931a4cf3fd21720c8f36780c
Instruction ID: 78b60159e5e5ea34db5dde7ebfc99d8067667f457a194975a13af87b165f6d1b
Opcode Fuzzy Hash: 7f3f9c59d712aed5ce851ea2227e667eee930213931a4cf3fd21720c8f36780c
Instruction Fuzzy Hash: 3D5175B4D00209EFDB04DF95D891AEEBBB5FF48304F14812EE9156B391DB38AA05CB95

Function 00481F30 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000), ref: 00481F69

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ClientRect
String ID:
API String ID: 846599473-0
Opcode ID: 88ec38587882752675255fd295883e8f47300495b378e8a4d17cfdbfefb5db08
Instruction ID: 54c4ab39923ec3a21dd1a0ca03ad16e45a7416c17a46c27eb8a9ab73405eb760
Opcode Fuzzy Hash: 88ec38587882752675255fd295883e8f47300495b378e8a4d17cfdbfefb5db08
Instruction Fuzzy Hash: A5415C70700205AFDB08DF68C894BAE7BA8EF4A304F10459EE906DF296D779ED44CB94

Function 0048EA60 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 0048D960: InterlockedCompareExchange.KERNEL32(00597AA4,000000FF,00000000), ref: 0048D970
Part of subcall function 0048D960: InterlockedExchange.KERNEL32(00597AA4,00000001), ref: 0048D994

_Smanip.LIBCPMT ref: 0048EB31

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompareSmanip
String ID:
API String ID: 2033401057-0
Opcode ID: 307831225377cf16af826ced24a3c2f1491a57b5d2b5f68c10f9d3bdd64363bc
Instruction ID: 8979d730f6f689733cf1e6aecc76e1f12f10f0e43a7ab11387706ed53f59f6ed
Opcode Fuzzy Hash: 307831225377cf16af826ced24a3c2f1491a57b5d2b5f68c10f9d3bdd64363bc
Instruction Fuzzy Hash: 7131AAB1D01218AAEB10EB55DC46FEDF7BCAB54704F4045AFF809B3282EB745A488B65

Function 0051A1D0 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 0051A298

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID:
API String ID: 4062629308-0
Opcode ID: 4a244fbe3033f5dffa8c5b6d10f8c3621f5383b1e98ff1b43659d20e5ffa6478
Instruction ID: dede04c96bba394e56bd36ef60f03b63697670d26d7c8b798c5a6462bf491d70
Opcode Fuzzy Hash: 4a244fbe3033f5dffa8c5b6d10f8c3621f5383b1e98ff1b43659d20e5ffa6478
Instruction Fuzzy Hash: F22167B9A125125BFB1A6B789C0A3ED3F417F85330F244309E4319A1D1DB358AC28703

Function 00470CA0 Relevance: 1.6, APIs: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCPMTD ref: 00470D24

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: shared_ptr
String ID:
API String ID: 2025160788-0
Opcode ID: ad1d84adbe62c2a3fc6594ffc7629b53e481e42f8abe7adb84b7335e57babe46
Instruction ID: ec2113fe658bf09cafd9da037ea84c02bdd17992014a3213e00027296830378b
Opcode Fuzzy Hash: ad1d84adbe62c2a3fc6594ffc7629b53e481e42f8abe7adb84b7335e57babe46
Instruction Fuzzy Hash: FE31F274D01209CFCB28CF99D845BEEBBB0BB48304F10892AD41AA7394D739A941CBA5

Function 0048FC70 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(00000114,00000000,00000000), ref: 0048FCB4

Part of subcall function 0048F380: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048F410
Part of subcall function 0048F380: DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 0048F459

Part of subcall function 0048FA50: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048FAE0
Part of subcall function 0048FA50: DeviceIoControl.KERNEL32(00000000,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 0048FB7F

Part of subcall function 0048F7E0: CreateFileW.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048F85D
Part of subcall function 0048F7E0: DeviceIoControl.KERNEL32(00000000,002D1400,00000000,0000000C,?,00000800,00000000,00000000), ref: 0048F8D0

Part of subcall function 0048F5E0: CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0048F665
Part of subcall function 0048F5E0: DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 0048F6AE
Part of subcall function 0048F5E0: DeviceIoControl.KERNEL32(00000000,0007C088,00000000,00000021,00000000,00000221,?,00000000), ref: 0048F6F9

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ControlDevice$CreateFile$Version
String ID:
API String ID: 393535756-0
Opcode ID: aa1b7f3f8d8e864e31ca7c91456754dc403ceb99789d541ac3d68d4f6994d251
Instruction ID: 3c107b6878ab20a9f70ddca5955e85d060b8005f8bb4886d576cb75bd39d5404
Opcode Fuzzy Hash: aa1b7f3f8d8e864e31ca7c91456754dc403ceb99789d541ac3d68d4f6994d251
Instruction Fuzzy Hash: 4F110871F0010897DF14AE15BC426EFF799AB99304F5004BBE90A93243EE359E5D87A5

Function 00474650 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00475100: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00475132
Part of subcall function 00475100: allocator.LIBCONCRTD ref: 0047513F
Part of subcall function 00475100: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0047514A
Part of subcall function 00475100: construct.LIBCPMTD ref: 0047516E
Part of subcall function 00475100: construct.LIBCPMTD ref: 0047518E
Part of subcall function 00475100: construct.LIBCPMTD ref: 004751AE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004746BF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkconstruct$allocator
String ID:
API String ID: 2348496747-0
Opcode ID: ad00bc9e5e6a7a30b6593de30325a655e17fdf1f4205cd0013a42deedd7eea69
Instruction ID: cef0ee04b16104f76dedcec972761b581f2b215b8f3eb225cf5d0f24c2684c61
Opcode Fuzzy Hash: ad00bc9e5e6a7a30b6593de30325a655e17fdf1f4205cd0013a42deedd7eea69
Instruction Fuzzy Hash: A11177B5D04148DFC700DF59D945BAFBBF8EB45724F10852AF409A7381D739AA048BA6

Function 00519C18 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b57dc140fb26d489f0c7e9b4b836a323a0bc9584ddb89b6dac71a1f73f069be
Instruction ID: 6e5a0b0a9206c404654d1a1c9ddaf3ecc1e4dd3f4e34e595202059790e1b8037
Opcode Fuzzy Hash: 7b57dc140fb26d489f0c7e9b4b836a323a0bc9584ddb89b6dac71a1f73f069be
Instruction Fuzzy Hash: 81F0F432900A1516FB313A298C09ADA3FD8BFC2338F100715F4A1931C1DB74DE8296E1

Function 00472B40 Relevance: 1.5, APIs: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00472B6B

Part of subcall function 00473190: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004731CC

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork
String ID:
API String ID: 2086788075-0
Opcode ID: 2cdbee402b95a86fd5a257ed2ba41af80f984cd9f89bdf09cdeabb6a3630f0f6
Instruction ID: 27ab0d6948dbd3aedf058718eef0b44c8b8e0698d4b3bb5e349a3e7e9eedd6a1
Opcode Fuzzy Hash: 2cdbee402b95a86fd5a257ed2ba41af80f984cd9f89bdf09cdeabb6a3630f0f6
Instruction Fuzzy Hash: 911115B0A04149CFCB08DF95C891AAFBBB5FF88704F10866EE419A73A0DB346D00CB95

Function 00473190 Relevance: 1.5, APIs: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork
String ID:
API String ID: 2086788075-0
Opcode ID: 779fa4ab396a2ce75c8994fd98d2866afa9630acd4306063568da9dffb571c78
Instruction ID: 97ea65f5ad0ef7a040eae288a3ba562da4a804a96c34be4ebe53f7d40c0d9ce6
Opcode Fuzzy Hash: 779fa4ab396a2ce75c8994fd98d2866afa9630acd4306063568da9dffb571c78
Instruction Fuzzy Hash: 91014474E04108EBCB04DF94D8818EEB7B5AF88305B10C1AEF90957306D6349F51EB95

Function 00533FE1 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00534B51: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00534B83

_free.LIBCMT ref: 00534001

Part of subcall function 005335AF: RtlFreeHeap.NTDLL(00000000,00000000,?,0053BA6B,?,00000000,?,00000000,?,0053BD0F,?,00000007,?,?,0053C0BE,?), ref: 005335C5
Part of subcall function 005335AF: GetLastError.KERNEL32(?,?,0053BA6B,?,00000000,?,00000000,?,0053BD0F,?,00000007,?,?,0053C0BE,?,?), ref: 005335D7

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: bcbf921a974124c1a804fa3d6967e16930b2a0212c92ebbdf7da04c9d64abdad
Instruction ID: 1118b06e0d16837dcd849723365bb1a11a6542baf66879665c8401d6cb01e242
Opcode Fuzzy Hash: bcbf921a974124c1a804fa3d6967e16930b2a0212c92ebbdf7da04c9d64abdad
Instruction Fuzzy Hash: E1F062B11057048FD7349F50D885752BBE8FF44715F10882EE69A8BA92CB75F4448B94

Function 00534B51 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00534B83

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 101f1b506b6ac216ab63973f43994e34ff92fbd4033edf98cf224f6c8c02a3cf
Instruction ID: 8a92054c7a01f70fbb1b1d4cba13d748780dfb86929477dcde6f5393a3e5c90d
Opcode Fuzzy Hash: 101f1b506b6ac216ab63973f43994e34ff92fbd4033edf98cf224f6c8c02a3cf
Instruction Fuzzy Hash: FDE0E52110022196DE212A699C24BAFBF5CBF827B0F050121EC05D61D0CB30EC404AA4

Function 00513AC7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00514EBE

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 3655e9e70a6fdb6fc328b61fc3a9aded612cd26590e03d56311362d4d5cf2bd9
Instruction ID: efdf070e853203b805f60ea3b3b17bd2b3b1c4a214f469ae50335340e4fbd715
Opcode Fuzzy Hash: 3655e9e70a6fdb6fc328b61fc3a9aded612cd26590e03d56311362d4d5cf2bd9
Instruction Fuzzy Hash: A7E0923450020FBAAF04F6B4EC1A4EE7F6C7E40360F244635B85A944E1EF70DAD6C591

Function 004909A0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004909AE

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 866d95a0b0d76f61a06cbc8fd01d2a4a772116b61059f3aae98403638a59fbb4
Instruction ID: 7a95f740de69eba1d6098e9b2e90b5f96e620c0a5e3f90eca49aad889956d987
Opcode Fuzzy Hash: 866d95a0b0d76f61a06cbc8fd01d2a4a772116b61059f3aae98403638a59fbb4
Instruction Fuzzy Hash: 61E04FB2602128EF9F209F94E804EEB7B58EF14761704842AF80987211C735E850DB94

Function 0C9053DB Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

w, xrefs: 0C90577E

Memory Dump Source

Source File: 00000000.00000002.3294499264.000000000C900000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c900000_nv8401986_110422.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-4266656565
Opcode ID: 9caf477a5df280b1f853b09abd2b5cd03a95b97393d52faefe5797923229ceb5
Instruction ID: 44f967858591b9d0b87f7521678a152e4fe6bd332e55f77024153a1e29db8d9f
Opcode Fuzzy Hash: 9caf477a5df280b1f853b09abd2b5cd03a95b97393d52faefe5797923229ceb5
Instruction Fuzzy Hash: E5B12671E002189FDB20CF85C5807AEB7FAEF48310F26855AD958AB391D375AC41CF95

Function 00473B10 Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00473C80: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00473CB2
Part of subcall function 00473C80: allocator.LIBCONCRTD ref: 00473CBF
Part of subcall function 00473C80: construct.LIBCPMTD ref: 00473CE3
Part of subcall function 00473C80: construct.LIBCPMTD ref: 00473D03
Part of subcall function 00473C80: construct.LIBCPMTD ref: 00473D23

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00473B25

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: construct$Base::Concurrency::details::ContextIdentityQueueWork$allocator
String ID:
API String ID: 1129248848-0
Opcode ID: 414794af40cd2e84f53808964091c8b90f65fa88ea0d11ec097da96620b40797
Instruction ID: 25e5cb8ddf3b898c3aefcc260fe0e82ae78402d5cdd61d12b0a077c4a3834811
Opcode Fuzzy Hash: 414794af40cd2e84f53808964091c8b90f65fa88ea0d11ec097da96620b40797
Instruction Fuzzy Hash: 2ED0A931901128AF8704EF99D8028EEB3ECEB05215B0001EEE808A3300DA712F00A7D5

Function 00472D90 Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00472DA0

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AllocatorDebugHeap
String ID:
API String ID: 571936431-0
Opcode ID: f5aaaa96274242fbbc52f909823332099c1dc1219f608bee4f65e3f420248663
Instruction ID: e0129dbc86464733245815c66f35600bb4f9256e7d64f116b6f0fe878cda7025
Opcode Fuzzy Hash: f5aaaa96274242fbbc52f909823332099c1dc1219f608bee4f65e3f420248663
Instruction Fuzzy Hash: C6C01235D0410C6B8B00EED4D8418DDBB7C9B44201F0041EAD80863341D6316A598791

Function 00474260 Relevance: 1.5, APIs: 1, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

error_info_injector.LIBCPMTD ref: 00474268

Part of subcall function 004743B0: Concurrency::details::_AsyncTaskCollection::~_AsyncTaskCollection.LIBCONCRTD ref: 004743BA

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AsyncTask$CollectionCollection::~_Concurrency::details::_error_info_injector
String ID:
API String ID: 3071161433-0
Opcode ID: d41d7edb70eb5f44063bc42364feadc2cbf5b0486bacc2602836522385678d0f
Instruction ID: bde561f789f1771c315e42a7d24049891e325617161e6eedde900708f8020cb0
Opcode Fuzzy Hash: d41d7edb70eb5f44063bc42364feadc2cbf5b0486bacc2602836522385678d0f
Instruction Fuzzy Hash: 44B0122024020C63C6006542F812F65335C4780624E008015FE0C0E281CA6268008188

Function 0C9056C9 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

w, xrefs: 0C90577E

Memory Dump Source

Source File: 00000000.00000002.3294499264.000000000C900000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c900000_nv8401986_110422.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-4266656565
Opcode ID: 5e674b8ddc7c3af3e6b0b7fc9d1ae4ece824b37fd7729debff351359abb9dd95
Instruction ID: d62138bcd9bc89bc0e78f8ec0ac93424b9887144008c94e3e26b06891808de36
Opcode Fuzzy Hash: 5e674b8ddc7c3af3e6b0b7fc9d1ae4ece824b37fd7729debff351359abb9dd95
Instruction Fuzzy Hash: DE715A71E002288FEB20CF45C5907AAF7F6EF49350F21855AEA59AB381D375AC51CF91

Function 00490850 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00490862

Part of subcall function 004A1170: GetModuleHandleW.KERNEL32(00000000), ref: 004A119B
Part of subcall function 004A1170: LoadCursorW.USER32(00000000,00007F00), ref: 004A11B2
Part of subcall function 004A1170: RegisterClassExW.USER32(00000030), ref: 004A11DB

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ClassCursorHandleInitializeLoadModuleRegister
String ID:
API String ID: 2545979264-0
Opcode ID: 6f1de584a0442eb931bc5fd94114eb8930ee64fad1af7d8ddd016493829eaab7
Instruction ID: 987412843863b279937be66f5a409af9068820eff1730741965c17c19396f41b
Opcode Fuzzy Hash: 6f1de584a0442eb931bc5fd94114eb8930ee64fad1af7d8ddd016493829eaab7
Instruction Fuzzy Hash: CFF027327002286EDF1076E89C09B9B7A849F20791F048033FE88D92A0C979C954C7D8

Function 0B9CB550 Relevance: .8, Instructions: 778COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8274e8c591281b398ec6d186a58511239557e5231fe303ded7ce58fe4e520c1e
Instruction ID: 1a9e480666f562c253df747b3c6cae20b4814e74e5eebd0ad0207e9e72b0294b
Opcode Fuzzy Hash: 8274e8c591281b398ec6d186a58511239557e5231fe303ded7ce58fe4e520c1e
Instruction Fuzzy Hash: B162BC70A40204DBDB24CF94CA45BABBBF5EF85754F11854DE919AB282C771AC41CFA3

Function 0B9C6141 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685fa46a66f5f6872f11340b53faf5f951da0e6768a73738b97467401234fecc
Instruction ID: b9a640f09803ffe75729143104be4310e6265158efbbd87473c7712d695083ff
Opcode Fuzzy Hash: 685fa46a66f5f6872f11340b53faf5f951da0e6768a73738b97467401234fecc
Instruction Fuzzy Hash: 2C32DF30E403059BDB248F94CA80BABB7B9EF89710F11945ED915AB292D775E841CBA3

Function 0CF04000 Relevance: .5, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298606801.000000000CF00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf00000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8bbb5fcbed417c4ac615396b0a474b58737ab42e44c16a5f810ea5315af8cd
Instruction ID: bf81fdb144666ea51482b0ff9b92bc8c833eb095c96ff0248043f1ea6b732ec9
Opcode Fuzzy Hash: de8bbb5fcbed417c4ac615396b0a474b58737ab42e44c16a5f810ea5315af8cd
Instruction Fuzzy Hash: E312D330B002059FDB24CF45C984BBABBE2EF85B14F258259EA05AB3D1D770ED41DB92

Function 0EC86800 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304984035.000000000EC80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0EC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec80000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ddb913ca03903adcc98d080926a04d83a0c6dcf0a44d3983f5a6294ce3e398
Instruction ID: cbde9ad9e7deaa6e4303fc0f7f516719b47801dfd5879f16f1054c8d74acd7f6
Opcode Fuzzy Hash: e8ddb913ca03903adcc98d080926a04d83a0c6dcf0a44d3983f5a6294ce3e398
Instruction Fuzzy Hash: 50021570B003009FEB24EF55CB95FAAB7E5EB44718F104529E946AB386CBB5ED40CB61

Function 0BEF4C7E Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3291206257.000000000BEF1000.00000010.00000800.00020000.00000000.sdmp, Offset: 0BEF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bef1000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc3dc8cd6b23a45495fa39982c1606cb3510af4bcd8d9b5417f563d52e6924c
Instruction ID: 2752f285f1ae2fd1bce514052252ad80bc09cb0a764d4025d1cd23013fd732fd
Opcode Fuzzy Hash: adc3dc8cd6b23a45495fa39982c1606cb3510af4bcd8d9b5417f563d52e6924c
Instruction Fuzzy Hash: 38F1FB31E042429FEB24CFA4C980BAEBBB2BF84704F15A159D7556B3C6DB74E881CB51

Function 0B9C2302 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34dae97d294e92ab4a6d9945cc99468806c025bda60fae47e3ec7ab29e15a44
Instruction ID: 0f631a0fdcef789f42aeefd8f9a83454a55cb4dca072290973697cc6598ef6c9
Opcode Fuzzy Hash: f34dae97d294e92ab4a6d9945cc99468806c025bda60fae47e3ec7ab29e15a44
Instruction Fuzzy Hash: AE417D70E042098FDB18CF44C5517AABBE5FF89364F10815EE954AB391D770E942CFA6

Function 0CF03FB2 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298606801.000000000CF00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf00000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed9b5a8c1aaa69a3a1991b863968c81169068eb8f65aa96d54eef79c4352393
Instruction ID: 36f6a47e391b26f25d9d55d9f810c12ed152d60793cd97f09b95d20356f63e1a
Opcode Fuzzy Hash: 0ed9b5a8c1aaa69a3a1991b863968c81169068eb8f65aa96d54eef79c4352393
Instruction Fuzzy Hash: F4E16B74B002098FDB14CF49C590BAABBF2FF89714F258299DA459B391D731EC42DB92

Function 0EC867F8 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304984035.000000000EC80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0EC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec80000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d4e93ca0467bbd7342a14114d79df49c3b9cb7171dfb163bc12883bf7063c7
Instruction ID: 243513a85b41a9ba2ece98a017d872a9870afb9bed1e47cf5262006bd3d39aaa
Opcode Fuzzy Hash: e9d4e93ca0467bbd7342a14114d79df49c3b9cb7171dfb163bc12883bf7063c7
Instruction Fuzzy Hash: 12C12570B003009FEB24DF58CB95BAAB7E5EB88718F10452DE955AB385CBB6ED41CB50

Function 0CF03FF2 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298606801.000000000CF00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf00000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3866dd0fda45680ff6530f293dc985c661a1bf0029b0177937ed603b474a5840
Instruction ID: 7546c2b6eb6de4f43909be372a033cad5a7258af7213537804bd1236d5b59628
Opcode Fuzzy Hash: 3866dd0fda45680ff6530f293dc985c661a1bf0029b0177937ed603b474a5840
Instruction Fuzzy Hash: 8DE15A74B002098FDB14CF49C590BAABBF2FF89714F258259DA459B3A1D731EC42DB92

Function 0B9C22B0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6a39733559e59e5cf4981e24d6c3c9b289bbfa9396b69b60a055c4c91b8de1
Instruction ID: db59719aa62257e4eb1157f4b5e7df314de2f72a774343e6cf80bfc240273ebc
Opcode Fuzzy Hash: eb6a39733559e59e5cf4981e24d6c3c9b289bbfa9396b69b60a055c4c91b8de1
Instruction Fuzzy Hash: AC419170E042098FDB18CF44C5517AABBE5FF49364F14815DD918AB392D770D942CFA6

Function 0ACD30C7 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43347ccadd2d6d8c84ba0877b313a53e5dfa2b8eaf4714b14dc8462365e37232
Instruction ID: fadd45a646dd419ab657a65f8b487806b514135ca535f8d051d4b7a9bcb6a656
Opcode Fuzzy Hash: 43347ccadd2d6d8c84ba0877b313a53e5dfa2b8eaf4714b14dc8462365e37232
Instruction Fuzzy Hash: 45C1D074A04354AFEB20CF04CA45B6AB7A0FB44324F168559EA557F391CBB8ED81CF92

Function 0CF041DE Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298606801.000000000CF00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf00000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ca76cdb65df35fd65b36e930a2efd10e64e711f6f96da663bd342e4f5b0605
Instruction ID: 74b8dc83f8d2e0f1ce60f591c45dae3d0320a7110fb533972e2d06939a8619aa
Opcode Fuzzy Hash: a3ca76cdb65df35fd65b36e930a2efd10e64e711f6f96da663bd342e4f5b0605
Instruction Fuzzy Hash: 42D13974B002098FEB14CF49C590B6ABBF2FF89714F258299DA459B395D731EC42DB82

Function 0B9C7006 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3895a6d40277a6e437d5226bcb1dd7b85676802bb83f0b5e68863b1ef36ea1f
Instruction ID: e7a040b494c11d222c3e74d0b54e3ec2703cd4cfba30f12f4640434376b5ca09
Opcode Fuzzy Hash: e3895a6d40277a6e437d5226bcb1dd7b85676802bb83f0b5e68863b1ef36ea1f
Instruction Fuzzy Hash: D4A11330A042419FD724CF94C981B6BBBE6EF85714F14815DEA156B2D2CB79AC81CFA3

Function 0B9C004C Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d917e82e885a536b4d050adf88ef641d6bbec08121841fdbe22eb2515958eae
Instruction ID: c885fbc61332e79682b822bb4d9ae852073a61b1cc790829a9361275d0e661af
Opcode Fuzzy Hash: 6d917e82e885a536b4d050adf88ef641d6bbec08121841fdbe22eb2515958eae
Instruction Fuzzy Hash: EAA12370A40300DFE724CF54C985BABBBE6EB85714F15854EE505A73C2CBB5AC80CB62

Function 0C90154B Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294499264.000000000C900000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c900000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c903441a5d6847e9897fa094462c89fea5e90ba4d1c822af483930c24b4e1d1
Instruction ID: 6767b94e2cdb7f3a6a8327adacd6a61468bea004de6c05569bc8578531d5a6b4
Opcode Fuzzy Hash: 0c903441a5d6847e9897fa094462c89fea5e90ba4d1c822af483930c24b4e1d1
Instruction Fuzzy Hash: 27811231B04240DFEB288B95C944BBEB7EAEF81305F39855AE406972D1CB75EC81CB61

Function 0B9C618A Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27cd772fe69b26fe26eda907a2ba802597fd1fa760f716c2cb1121d94ff0784
Instruction ID: 5485afc50bb481a4624de3a98fc93c6e689762966a2e3253693d67ed73551d12
Opcode Fuzzy Hash: a27cd772fe69b26fe26eda907a2ba802597fd1fa760f716c2cb1121d94ff0784
Instruction Fuzzy Hash: CD81BE31E042018FCB24CF58C590AAAB7F5FF89710F1A955ED919AB352D771EC81CB92

Function 0C91C459 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294559654.000000000C91A000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C91A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c91a000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e629e58f55f3bb6da79177993fab1adb6476e5b2d44ce6d9e0cbb3578deef77c
Instruction ID: 4c9d072366d69ebd06f3f3502770f134c817d91aa9aec270d8aa2eb3b7a0d60e
Opcode Fuzzy Hash: e629e58f55f3bb6da79177993fab1adb6476e5b2d44ce6d9e0cbb3578deef77c
Instruction Fuzzy Hash: 3071E070780219AFC720CF0AC592A76BBE6FF45764B15954AEC466B381C771FC81CBA1

Function 0ACD1A0B Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba90212a655ec5c76a95d2b37b5c1666a90afede4b01e7c12ae0ed3a4c843973
Instruction ID: a10a9c62da591904fed3052af60a95195029314f66dde9321fd56f3430d060b3
Opcode Fuzzy Hash: ba90212a655ec5c76a95d2b37b5c1666a90afede4b01e7c12ae0ed3a4c843973
Instruction Fuzzy Hash: BE5169B1604304AFDB24CF58C941BA9B7E4EF44320F1A0A89FA49DB3A1E774DD41CB52

Function 0B9C6283 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81827e60a640b9fa513ec368db69f7ade4019944fcc3e8d4027223cd8209cfa3
Instruction ID: 657217df75c21536514e41d340ab239ee295aac618cf8e51f5fe2cac0d323c67
Opcode Fuzzy Hash: 81827e60a640b9fa513ec368db69f7ade4019944fcc3e8d4027223cd8209cfa3
Instruction Fuzzy Hash: 7E719F31E042058FCB24CF48C590AAAB7F6FF89310F29855ED815AB352D771EC81CB92

Function 0B9C7921 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec504252b52a0ccc54ae9ab43c1970c234f74cbb47a702dbc5a0b19f59223a08
Instruction ID: 023485b7e37535b8f677cbc53eb1bb7e9da2e84859c3c40af6829785b51d302c
Opcode Fuzzy Hash: ec504252b52a0ccc54ae9ab43c1970c234f74cbb47a702dbc5a0b19f59223a08
Instruction Fuzzy Hash: D7512B70E413019BEB305AE4CA85BABB79CEF44644F15145EE906A7382DB78AD818F73

Function 0D7EF800 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3301515219.000000000D7E0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0D7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d7e0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c18e8382b56bac31d45af90fa96777bd6c9c07f2af543a12105d6b1249094ba
Instruction ID: 54534c9f09b4425351900be7b021696217e71aa6b08bc8cb750c9c507ba73761
Opcode Fuzzy Hash: 0c18e8382b56bac31d45af90fa96777bd6c9c07f2af543a12105d6b1249094ba
Instruction Fuzzy Hash: 5D513231A442009FD724CF48C840BBAF3A9FF8A374F11815ED9699BB81CB70E941CB92

Function 0B9C2400 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596120e80950320db801b94056d482b7038136bf96931d30c9d5b54d6ae34bf0
Instruction ID: 1278537cc3b37d41b6cc8010d9a36bf930e698060edda0a900b09a68b2167a5e
Opcode Fuzzy Hash: 596120e80950320db801b94056d482b7038136bf96931d30c9d5b54d6ae34bf0
Instruction Fuzzy Hash: AC51E170A042058FDB28CF54C954BAABBE5EB45324F10815EE515AB381DB74ED41CFA3

Function 0BF07C04 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3291235020.000000000BF01000.00000010.00000800.00020000.00000000.sdmp, Offset: 0BF01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf01000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c795ef340e705be34417198efb4784cac360c729acd29159f153e75162a3829
Instruction ID: 0f8f8ffe541f230b3b5e002f86ae57b077f67857c029afd77a91fa76e75c7c8a
Opcode Fuzzy Hash: 2c795ef340e705be34417198efb4784cac360c729acd29159f153e75162a3829
Instruction Fuzzy Hash: 2741CE33E662016FDB21AA108D91FBE7396EF82210F15809AE511A72E1DF70FC41D3B1

Function 0EC810AD Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304984035.000000000EC80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0EC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec80000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb0ffab4721b8af039f7c080d0405dd2b4e72252dab8e04e3d91344fc13108f
Instruction ID: f64b15ff5180c30fe3317311a677731f739a696dd7f47aeaede77ca02c201cc7
Opcode Fuzzy Hash: 3bb0ffab4721b8af039f7c080d0405dd2b4e72252dab8e04e3d91344fc13108f
Instruction Fuzzy Hash: B141AF7160A300AFEB15AB51CF55BBDBBE19F4131CF18048AF4429B283DB76AC42C752

Function 0CF002C1 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298606801.000000000CF00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf00000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54db456766416da1142317ed5c45b148c5f1921ecd48ce0000367ca276df0d7e
Instruction ID: 28de76cc3b459163546a35e2cf34dc314ea02557b4d4620d8f4c51c502d9dcb6
Opcode Fuzzy Hash: 54db456766416da1142317ed5c45b148c5f1921ecd48ce0000367ca276df0d7e
Instruction Fuzzy Hash: 21410470B443049FE7309F44C984BAAB7A1EF45B14F30815AEA456B2C2DFB1E881DB63

Function 0ACD04C9 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4831eeb884d6dbd30401803c2ec07cb7bfacfeeb21834451a129716c7997e000
Instruction ID: be0e7e32bd2f296f3c263c7140b2cc06324efb688402923987cd99168d5b51b5
Opcode Fuzzy Hash: 4831eeb884d6dbd30401803c2ec07cb7bfacfeeb21834451a129716c7997e000
Instruction Fuzzy Hash: C941AF74A043119FDB24CF08C590A6ABBB1FF84314F16898AD9866B362E774ED81CFD5

Function 0B9C1200 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05eb0794e421475c6fd0425842977cce76d10bd0e0c26e3e45c6e0c215dec8a0
Instruction ID: ea2be00a9c524e847ad3e088463938f3a627896f27ac1c28e2d83f8acf98ac4b
Opcode Fuzzy Hash: 05eb0794e421475c6fd0425842977cce76d10bd0e0c26e3e45c6e0c215dec8a0
Instruction Fuzzy Hash: FA317730E002259BDB248F50C9047AFBBA9EF4132CF00915ED465772C2DB75A901CBEB

Function 0C902800 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294499264.000000000C900000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c900000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87424b9f255175b6450088c39cc3a8443e98135433329893459fe511ac769dd1
Instruction ID: 3be210277aa13d2360c36a268a4bd960739e6eb6c6107c74f13f05d0de1d8122
Opcode Fuzzy Hash: 87424b9f255175b6450088c39cc3a8443e98135433329893459fe511ac769dd1
Instruction Fuzzy Hash: 3E313339B04A058FDB18CF45C9497A9B39AFF85320F348199EE64573C1D771E851CB82

Function 0EC810DC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304984035.000000000EC80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0EC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec80000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32dd150bb711991e59152287230e95d5fb079e78b0843e5814b31e24cabe18bd
Instruction ID: 799f87d0f3ba3259afaceaa74642b170b5c1c8904423e8cf2a05ca02bf87bf11
Opcode Fuzzy Hash: 32dd150bb711991e59152287230e95d5fb079e78b0843e5814b31e24cabe18bd
Instruction Fuzzy Hash: 2E214C7061A3019FDB199B64CB95A7AFBF0DF41318F08445AE8869B282CB769C46C752

Function 0EC81613 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304984035.000000000EC80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0EC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec80000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282351b166a5202a37a085e3cb716c38d6272e409cdf92033b29b50c02a68609
Instruction ID: 346e664d99cf466b155aefaad10f9edebda270bf542c7b8ccb5af2122ee5ec27
Opcode Fuzzy Hash: 282351b166a5202a37a085e3cb716c38d6272e409cdf92033b29b50c02a68609
Instruction Fuzzy Hash: D03104745093419FEB11CF58CA91A99BBF0FF45324F19449EE8D98B293C334A865CF12

Function 0CF19A00 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298606801.000000000CF00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0CF00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cf00000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77809894b1816012d063519a579feee37c176930b62f7a34448591c85786a17b
Instruction ID: 4342d446c991a6d585322ba129152d792bfa4869f8fe624cfc6958cbd3e6648d
Opcode Fuzzy Hash: 77809894b1816012d063519a579feee37c176930b62f7a34448591c85786a17b
Instruction Fuzzy Hash: A7210831A402196FCB18CE55CC95AABBBA8EF09624F040659F91497382DBB0AA51CBD1

Function 0ACD0C00 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7b081c53bb9efd11418b4c2446e03a1a571e44a378787911f18c36ac2e0235
Instruction ID: 17bf4fd21353bdf577bfc646eae774bf985478687cdfee2a02d694fbe2f48928
Opcode Fuzzy Hash: 6d7b081c53bb9efd11418b4c2446e03a1a571e44a378787911f18c36ac2e0235
Instruction Fuzzy Hash: E311EB32714205ABDB20CB988D46FDAB7D4EB85720F010555FB9697391DBA09960C793

Function 0B9C0A00 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b41a907587a8e34c38187f262bb9b05b57345ede7cf53a8eb5f9f4c6e88051
Instruction ID: dabc4df9e79cd9c3a696e3b517ecb63951c1ffaae0425f02c067c1ad88d6f150
Opcode Fuzzy Hash: f9b41a907587a8e34c38187f262bb9b05b57345ede7cf53a8eb5f9f4c6e88051
Instruction Fuzzy Hash: 37F0A23174011567C21045680E46BAB368DCB02514F422259FB29FB2C2FD50990087F7

Function 0C90228F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294499264.000000000C900000.00000010.00000800.00020000.00000000.sdmp, Offset: 0C900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c900000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48172535528b47b4659be5c2453fa197a7f76daaf6a8a32d8ef603b8790ad640
Instruction ID: 1630cae7aad6525af4afc0c38750430852827c3b81c66466dec58c4a6e955568
Opcode Fuzzy Hash: 48172535528b47b4659be5c2453fa197a7f76daaf6a8a32d8ef603b8790ad640
Instruction Fuzzy Hash: 4C01AD30A4AB889FCA381BA449EC79E339C9F42660F31284BC90187696D771C581C623

Function 0B9C1893 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4ec7aba9ec638479cc9d56a0991264bf5ef336c37968f254d5c3d6b7e222aa
Instruction ID: 8eabf742ff3965f42db6f3bca20dcc6f8c5112b602c44efd46f00bca7670d354
Opcode Fuzzy Hash: fd4ec7aba9ec638479cc9d56a0991264bf5ef336c37968f254d5c3d6b7e222aa
Instruction Fuzzy Hash: A8012830E493285BDF3417505AA47EF379DDF41650F21184BD801A7253D330C682C62F

Function 0B9C32E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc3760ae31022d7ced07178e64f477c6093f538c379f2b3bd47483fc9b912cb
Instruction ID: 6bc1738b3c0698702dea9c9c77101603a2bf8e5211f5cdb439aa7657d3b83c87
Opcode Fuzzy Hash: 1cc3760ae31022d7ced07178e64f477c6093f538c379f2b3bd47483fc9b912cb
Instruction Fuzzy Hash: 12E01A31A052058FC701CB98D8898D9FBB0EF56230B14429ADC699B262DA3199139B91

Function 0B9C8A35 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b7b06225432d6af1d72b84483c84e9696029cf555b041cb198a184d8961d12
Instruction ID: ec5802112a190148109b4fea95bfd3ea422f3743074da68f4b9a8e58ae0a8bd7
Opcode Fuzzy Hash: f2b7b06225432d6af1d72b84483c84e9696029cf555b041cb198a184d8961d12
Instruction Fuzzy Hash: 2DD0A73370D1515FC701CBD8AC508E3FB98DE890717194BD7EA09C7222D5029D1183D2

Function 0ACD4332 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c345d20aa9180e92b9aa300726518eda131f0e13b269a09015eec6f6b7b72361
Instruction ID: 11e2b662acf88aa7b7a23a5405923d5f6a465d68c6bff26101e9573295aafbd3
Opcode Fuzzy Hash: c345d20aa9180e92b9aa300726518eda131f0e13b269a09015eec6f6b7b72361
Instruction Fuzzy Hash: 2CD0A773A082048FC711CF4DE880685FBB4FB60220F014283E918CB231D325C9148BD2

Function 0B9C8A87 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3289071754.000000000B9C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B9C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9c0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49373adc0c5176f1c7a4997ec33bf671fdb7335f995e20833ce767dc7eaf37e6
Instruction ID: 2d66594351de67538b903a232025e9f135584be18d82bcde106f77eea11ca2b1
Opcode Fuzzy Hash: 49373adc0c5176f1c7a4997ec33bf671fdb7335f995e20833ce767dc7eaf37e6
Instruction Fuzzy Hash: 34D0C9337091104F8711CA9CAC80896F7D8EA5517170542E3E908C7222D5119E2487E1

Function 0ACD5A0E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4717dd9fd25c545b75fc1d0a614d023c1cc12069026028d0a722f9790a7be8dc
Instruction ID: 067f009a093e65a7b2ca9034a58300c6ebd2d4a2d3ca064f28200948c0ec8fc0
Opcode Fuzzy Hash: 4717dd9fd25c545b75fc1d0a614d023c1cc12069026028d0a722f9790a7be8dc
Instruction Fuzzy Hash: C9C0802234E3951FD311199478434F8FF54DD4302430311D7D54999553CF0549264263

Function 0ACD9304 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e501a7768defdaa8aa69d0ed5d105a221c3fd1f679d4b6734913ecf53af33ebb
Instruction ID: fe1f32b513d0fbff4e19044b4e5fef08c1208fad3b06df5356232038c2307e12
Opcode Fuzzy Hash: e501a7768defdaa8aa69d0ed5d105a221c3fd1f679d4b6734913ecf53af33ebb
Instruction Fuzzy Hash: 26D0C972A052188BD710CF8DE884BCAF3F4EF44224F00865AE928A7210D77A98248FD5

Function 0ACD6C52 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3284841493.000000000ACD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ACD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194e5eeec6768417384e311585a37ae8b769f02c718f16c81029d17974f79ed6
Instruction ID: 9598b2b20e668643a00efe38d010cbe28d56c3f2311308f598941ab6d1aa3a32
Opcode Fuzzy Hash: 194e5eeec6768417384e311585a37ae8b769f02c718f16c81029d17974f79ed6
Instruction Fuzzy Hash: 16D012326052144BC710CF8DF880A8AF3F4EF44224F004657F928D7210D76598244BC1

Function 0ECA0FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2161863266.000000000ECA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0ECA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_eca0000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9ce593b8061fe11d005a8fadf4466c64fb9f615bec526e67dbe7247faadaf0
Instruction ID: c37aa17633d827c572a21c50c8d185da28d1d4d6a9c45d37cb46a301537ed111
Opcode Fuzzy Hash: 1a9ce593b8061fe11d005a8fadf4466c64fb9f615bec526e67dbe7247faadaf0
Instruction Fuzzy Hash:

Function 06980E97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980697 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980E8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980E87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069806BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980EBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069806B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069806AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069806CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069806C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980EF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069806EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980EE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980E0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980E27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980677 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698066F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06980F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980787 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980F87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981FB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06980FB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06981FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06980FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 069807FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069807F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06981F0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06980F3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698073F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980F37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980737 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980F5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981F57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06981F4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06981F47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 0698077F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981F7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06981F77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 06980777 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06981F6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction ID: fef0eff815a38ba47a1ca579c295eab3922f9f4d0058a0d94eae293d7c026427
Opcode Fuzzy Hash: cdcdf4f5b538d7bb9e3b9453bdd95530608f5813ccce421a7ac41bc9376e01ce
Instruction Fuzzy Hash:

Function 0698076F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980767 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698048F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069804A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980CA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980CD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069804FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980CFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069804F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980C6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069805B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069805F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980DE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698051F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980517 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698050F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980507 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980557 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698054F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980547 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698056F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980567 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980D67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980297 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698028F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980ABF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069802B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980AB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980AAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069802C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980AFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980AF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980A07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698022F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980A27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980A77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980BE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698031F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980317 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698030F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980307 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698036F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980B67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980897 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069808BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069808B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069808AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069808FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069808F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069808EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980807 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698002F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698082F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980827 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980027 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698085F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980857 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698084F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980847 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698019F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698099F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069809BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069801BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069801A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069809CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069801CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069801C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 069809E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980907 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698095F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980957 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698094F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980947 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698097F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980977 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698016F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0698096F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980167 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 06980967 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3280314783.0000000006980000.00000010.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction ID: be54485fc59352f20f6f4ce12a496ede628c2e64fd65a856fd8d5c0b5115126c
Opcode Fuzzy Hash: 1d815e66ca4223b933f3157b74db50dc9005f230267508c2d6a1286f72732b60
Instruction Fuzzy Hash:

Function 0B636B6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636B77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630B7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636BA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630B87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630B8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630B97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636B9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630A67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630A7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B632A47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B630A57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630A5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630A27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B632A2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B632A37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B630A3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636A07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636A0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B634A1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636A1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636AEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636AF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630AC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634AD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636AD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630AAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630AB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B632ABF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B63495F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636907 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B634907 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63690F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63090F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63491F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6369EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6369F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6329F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B6349CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6349D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6349A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6349AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6349B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6349BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630877 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63087F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630847 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630827 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63081F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6348E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6308E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6368EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6368FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6348FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6368C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6368CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6368D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6368DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630897 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630F67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636F77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B632F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B634F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B634F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634E67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634E6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630E77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630E7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630E47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630E57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636E5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B634E27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630E27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634EE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634EF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634EC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630EC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630EAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630EB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630E8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634D67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634D6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634D5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630D3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630DA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630D87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630D8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630D97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634C47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634C57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634CEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634CFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634CD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634CAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636C87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B632C87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B634C87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636C8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B634C9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636C9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B634347 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634317 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6363E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6343E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6303C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6363C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6363CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6363D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6343D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6343DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6363A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6343BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63639F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63239F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B634257 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63025F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63422F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630217 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6342E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6342EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6322C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B6322CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B6322D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B6322DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B6342A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6342AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63429F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63214F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B632157 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B634127 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63213F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B634107 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63410F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634117 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6341A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B632047 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B63204F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B63004F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B630027 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63203F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B630017 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63401F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63001F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6340E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6300EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6340EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634777 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63477F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63674F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63075F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63675F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630727 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B632707 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B630707 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63270F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B630717 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63071F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6307F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634787 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63478F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63678F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636797 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63679F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636677 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636607 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B6326FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B630687 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63068F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63469F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B630567 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63657F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630557 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B632557 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B63055F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634527 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63253F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B63453F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63450F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634517 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63451F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63251F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction ID: 857ef70bcebc15e82368fe9d2f48c1d0b376cef26b63353a5762eaf6e807df7e
Opcode Fuzzy Hash: c3e71f8f9171e78e45f5ae199d08d71c595b7edd9fc4d0b2f3edf5c53d5b2310
Instruction Fuzzy Hash:

Function 0B6305C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B6365A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630587 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B634587 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B63658F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B630597 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63659F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B636477 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63647F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63442F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B634437 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636437 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63040F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63041F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B63441F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B6304CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction ID: 6596a83b727b290f53ce6779d1059106ed54c932b563e1703c9d99a1af7778a9
Opcode Fuzzy Hash: be434e7e80fff7497e7b35bac62e52e4d903bae5010464fc13329355e0eae8bb
Instruction Fuzzy Hash:

Function 0B636487 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63648F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63448F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B636497 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction ID: 9aacbfd3df52ee9e8b25963f3f254631bc310b75d74d518d6748a3c1ca5936ec
Opcode Fuzzy Hash: 78831167a2a0565ea4a04b901d112778ba267222797e7761aa1439d5fd9e7dac
Instruction Fuzzy Hash:

Function 0B63449F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction ID: 45c8fd3856958b64ac983a2ecbb876113b144686e8c52b2f93095404fa41207a
Opcode Fuzzy Hash: 7b8b0a4c632b3a0f965d4dbe7616f6c0a29f70dad4950a2d3d782ca00fc65c10
Instruction Fuzzy Hash:

Function 0B631B67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633B6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635B77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635B7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B633B47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631B47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631B57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633B5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635B27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631B2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635B2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631B37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635B37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631B3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635B1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631BE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631BFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635BAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635BB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635B87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631A4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635ACF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635AB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635ABF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635A9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63196F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635927 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631937 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63193F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631907 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63591F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6339EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6319C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6319CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6339D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6319A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6339A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6319BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633987 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631827 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633827 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B63182F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63382F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631807 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63180F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631817 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63181F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6318E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6318F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6358A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6318AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6358B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631887 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63189F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635F6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635F77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631F7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633F47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633F4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633F57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633F37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633F3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633F0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631F17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631E67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631E7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631E47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631E4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631E5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633E07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633E0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633EF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633EAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631D6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631D7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631D47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631D37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631D3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633D3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631D07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631D0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631D17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633DFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633DD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635DA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635DAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635DB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631C47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631C4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631C5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631C07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631C0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633CF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635CCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635327 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B633337 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635337 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63533F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6353EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6333EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6353D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6333A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6333AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635387 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63538F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63339F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633247 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B63323F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6352C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6352CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635167 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B633177 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635147 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63514F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635157 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B633117 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B63311F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6311C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6351AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631067 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635047 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B633047 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B63104F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63504F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631057 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633027 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B63303F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635017 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63301F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6350DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635767 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63576F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63575F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63173F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63570F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631717 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6337F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6337FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6317FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6317C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6337AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6317BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B633797 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B631797 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63379F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B635657 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63162F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635637 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631637 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63563F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631607 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6316E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6316C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6316DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635567 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63157F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B631547 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635557 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63555F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631527 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63552F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63550F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631517 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B63151F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6355C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B6315D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B6355A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B631587 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635477 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63347F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633427 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B633437 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B63543F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B635407 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B633417 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6334E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6334EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Function 0B6314D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction ID: c1765d83557327d14e69bb53c374c01942a1576d8409d5e2117e56dc28e46c4f
Opcode Fuzzy Hash: 130793feb2d7a19d24d509355a51cfdb931754b3f4ebac2a6d812b8b63bcc8ab
Instruction Fuzzy Hash:

Function 0B635487 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction ID: 247773a329db44f457dc8539cb9e3233ebbab0fa012ece22c5db105e98603722
Opcode Fuzzy Hash: 1c06715c5d2b1217f55ea1d5bd54248150642d40f625711e49e368b4ee8a96ea
Instruction Fuzzy Hash:

Function 0B63348F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286014231.000000000B630000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b630000_nv8401986_110422.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction ID: 924f2406c5575dd430c412869953e39048321f496b9924ae61f61d38cc9c7187
Opcode Fuzzy Hash: bc9f7fcad917f804a4cb638df0614e6a56020e0bb46d1f55b358342282b53f78
Instruction Fuzzy Hash:

Non-executed Functions

Function 00462370 Relevance: 53.3, APIs: 7, Strings: 23, Instructions: 777windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BF60: RtlInitializeCriticalSection.NTDLL(00597D08), ref: 0041BFCE
Part of subcall function 0041BF60: __Init_thread_footer.LIBCMT ref: 0041BFEA
Part of subcall function 0041BF60: RtlEnterCriticalSection.NTDLL(00597D08), ref: 0041C005
Part of subcall function 0041BF60: RtlLeaveCriticalSection.NTDLL(00597D08), ref: 0041C115

Part of subcall function 004717A0: std::locale::facet::facet.LIBCPMTD ref: 00471814
Part of subcall function 004717A0: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00471844

ShowWindow.USER32(?,00000000,?,0000000F), ref: 00462B83
PostQuitMessage.USER32(00000000), ref: 00462B8B
PostQuitMessage.USER32(00000000), ref: 00462BFD
ShowWindow.USER32(?,00000000), ref: 00462C0A

Part of subcall function 00455FD0: RtlInitializeCriticalSection.NTDLL(00597E94), ref: 0045603E
Part of subcall function 00455FD0: __Init_thread_footer.LIBCMT ref: 0045605A
Part of subcall function 00455FD0: RtlEnterCriticalSection.NTDLL ref: 00456075

KillTimer.USER32(?,00000550,0000000F), ref: 00462C5D

Strings

%ds, xrefs: 00462CEE
TBY, xrefs: 00462E11
type, xrefs: 0046267D
uid, xrefs: 0046247F
pid, xrefs: 00462547
click, xrefs: 00462603
sid, xrefs: 00462435
avs, xrefs: 004624C0
down, xrefs: 004626BC
avlt, xrefs: 00462863
close, xrefs: 00462642
item, xrefs: 00462775
tid, xrefs: 00462585
js=, xrefs: 00462896
appid, xrefs: 004623F4
countdown_text1, xrefs: 00462D3B
btn_Close, xrefs: 00462DA7
P}A, xrefs: 00462A5C
install, xrefs: 004626FB
/qy/pp, xrefs: 004629B2
countdown_text2, xrefs: 00462CC5, 00462D71
menu, xrefs: 0046273A
rnd, xrefs: 004627B0

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInit_thread_footerInitializeMessagePostQuitShowWindow$Affinity::operator!=Concurrency::details::HardwareKillLeaveTimerstd::locale::facet::facet
String ID: %ds$/qy/pp$P}A$TBY$appid$avlt$avs$btn_Close$click$close$countdown_text1$countdown_text2$down$install$item$js=$menu$pid$rnd$sid$tid$type$uid
API String ID: 3681526160-3787827338
Opcode ID: 0fb39c0d51a6938a7f6555bcb8cca7d40535ef37f5b2e9bbfd682352fc7445de
Instruction ID: ed17486b76200998b7f1adbb282c11307a059de2f7680e70323ee0329921b126
Opcode Fuzzy Hash: 0fb39c0d51a6938a7f6555bcb8cca7d40535ef37f5b2e9bbfd682352fc7445de
Instruction Fuzzy Hash: B362D430911248EFDB24EF64CD45BEEBBB5BF50304F1084AEF049A7192DB786A44DB96

Function 00436530 Relevance: 29.6, APIs: 3, Strings: 13, Instructions: 1581COMMON

Download Yara Rule

APIs

Part of subcall function 0041BF60: RtlInitializeCriticalSection.NTDLL(00597D08), ref: 0041BFCE
Part of subcall function 0041BF60: __Init_thread_footer.LIBCMT ref: 0041BFEA
Part of subcall function 0041BF60: RtlEnterCriticalSection.NTDLL(00597D08), ref: 0041C005
Part of subcall function 0041BF60: RtlLeaveCriticalSection.NTDLL(00597D08), ref: 0041C115

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,EFE0703F,?,00000000), ref: 004365AC
WaitForMultipleObjects.KERNEL32(00000000,?,00000001,000000FF,?,?,?,00000000), ref: 00436658
CloseHandle.KERNEL32(?,?,?,?,00000000), ref: 0043666A

Part of subcall function 0043BE40: GetCurrentProcessId.KERNEL32(00000000), ref: 0043BECD
Part of subcall function 0043BE40: PostMessageW.USER32(00000000,000007EA,-6A94B199), ref: 0043BEE1

Part of subcall function 00483970: GetProcAddress.KERNEL32 ref: 004839FF
Part of subcall function 00483970: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00483A15
Part of subcall function 00483970: Process32FirstW.KERNEL32(00000000,?), ref: 00483A24
Part of subcall function 00483970: Process32NextW.KERNEL32(00000000,?), ref: 00483A4C
Part of subcall function 00483970: CloseHandle.KERNEL32(00000000), ref: 00483A53

Strings

firefox.exe, xrefs: 00436CE9, 00436D10, 00437827, 0043784E
360se.exe, xrefs: 004367D5, 004367FF, 0043742D, 00437457
SLBrowser.exe, xrefs: 00437126, 0043714D, 00437B79, 00437BA0
2345Explorer.exe, xrefs: 00436B3C, 00436B63, 004376D8, 004376FF
chrome.exe, xrefs: 00436A63, 00436A8A, 0043762E, 00437655
UCBrowser.exe, xrefs: 00436DC2, 00436DE9, 004378D1, 004378F8
sogouexplorer.exe, xrefs: 0043698A, 004369B1, 00437584, 004375AB
msedge.exe, xrefs: 0043704D, 00437074, 00437ACF, 00437AF6
InsLnk.xml, xrefs: 0043674A, 00436780
Maxthon.exe, xrefs: 00436E9B, 00436EC2, 0043797B, 004379A2
iexplore.exe, xrefs: 00436F74, 00436F9B, 00437A25, 00437A4C
QQBrowser.exe, xrefs: 00436C37, 004377A4
360chrome.exe, xrefs: 004368B1, 004368D8, 004374DA, 00437501

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseCreateHandleProcess32$AddressCurrentEnterEventFirstInit_thread_footerInitializeLeaveMessageMultipleNextObjectsPostProcProcessSnapshotToolhelp32Wait
String ID: 2345Explorer.exe$360chrome.exe$360se.exe$InsLnk.xml$Maxthon.exe$QQBrowser.exe$SLBrowser.exe$UCBrowser.exe$chrome.exe$firefox.exe$iexplore.exe$msedge.exe$sogouexplorer.exe
API String ID: 208262335-949901600
Opcode ID: 6c3f18b88190fae4ccd2eb9adb9a1bd77c4126660fac841e6ae9cf4e3b814cec
Instruction ID: 6458ee337c35b555381e9a9a956d28feeed5d9ff87ac979860b992d9eed53f7e
Opcode Fuzzy Hash: 6c3f18b88190fae4ccd2eb9adb9a1bd77c4126660fac841e6ae9cf4e3b814cec
Instruction Fuzzy Hash: 4BE2C270A002499BEF14DFA4C9497DEBBF0BF48318F20955DE044B72D1D779AA84CBA9

Function 0048E0D0 Relevance: 16.6, APIs: 11, Instructions: 132fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048E3D0: GetProcAddress.KERNEL32(?,?), ref: 0048E477

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,EFE0703F,00000000), ref: 0048E12B
FindFirstFileW.KERNEL32(?,?), ref: 0048E163
FindClose.KERNEL32(00000000), ref: 0048E16B
FindFirstFileW.KERNEL32(?,?), ref: 0048E186
FindClose.KERNEL32(00000000), ref: 0048E18E
CopyFileW.KERNEL32(?,?,00000000), ref: 0048E1AE
DeleteFileW.KERNEL32(?), ref: 0048E1C4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0048E1E5
GetFileSize.KERNEL32(00000000,00000000), ref: 0048E201
ReadFile.KERNEL32(00000000,00597A94,00000010,0048E01B,00000000), ref: 0048E221
CloseHandle.KERNEL32(00000000), ref: 0048E23B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: File$Find$Close$CreateFirst$AddressCopyDeleteHandleProcReadSize
String ID:
API String ID: 3568010720-0
Opcode ID: 1bcc698940b050a87a3460eb661652275ec14e984550a024991a6b27c8852973
Instruction ID: 2254858a8e7ea8ba69ba115cdd798485c29968c93dc362b28c87a447cb02ec91
Opcode Fuzzy Hash: 1bcc698940b050a87a3460eb661652275ec14e984550a024991a6b27c8852973
Instruction Fuzzy Hash: D0515B30A00208EBDF10DFA9DC89FEEB7B8AF15715F500529F512A21D0D778AA49CB94

Function 004AA100 Relevance: 10.6, APIs: 7, Instructions: 53clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00002002,?), ref: 004AA134
GlobalLock.KERNEL32(00000000), ref: 004AA13D
GlobalUnlock.KERNEL32(00000000), ref: 004AA166
OpenClipboard.USER32(?), ref: 004AA175
EmptyClipboard.USER32 ref: 004AA17B
SetClipboardData.USER32(0000000D,00000000), ref: 004AA184
CloseClipboard.USER32 ref: 004AA18A

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
String ID:
API String ID: 1677084743-0
Opcode ID: 7e6d951e6f4ecf3f2143712e6c98a060afa0d87735fdf84fe4fa1db045409ecf
Instruction ID: 1647e85f9f82e15e28d7ff5b51ab08a8df37cd059c9dc8d6b448e44361d9f090
Opcode Fuzzy Hash: 7e6d951e6f4ecf3f2143712e6c98a060afa0d87735fdf84fe4fa1db045409ecf
Instruction Fuzzy Hash: BD118E7A200104EFC7049B6CEC4DDEAB7E9EF99319B01407AF905C3261DE716D55DBA0

Function 004E60D0 Relevance: 7.8, APIs: 5, Instructions: 304networkCOMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,00000000), ref: 004E6384
WSAGetLastError.WS2_32 ref: 004E6393
__WSAFDIsSet.WS2_32(?,?), ref: 004E646D
__WSAFDIsSet.WS2_32(?,?), ref: 004E6484
__WSAFDIsSet.WS2_32(?,?), ref: 004E649B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ErrorLastselect
String ID:
API String ID: 215497628-0
Opcode ID: 0594a2ba5b3b075db490b6cc339492106e3470f784b45f8ef1857d275e62f01e
Instruction ID: cb12d01848e67e8695e53949726a8b445c0ef83839fa103a8f55cf472563cd01
Opcode Fuzzy Hash: 0594a2ba5b3b075db490b6cc339492106e3470f784b45f8ef1857d275e62f01e
Instruction Fuzzy Hash: A7C1A170A002598BCF25DF1AC8847EAB7B9EFA8351F1145EED859D3241DB349F808F58

Function 0052E24E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0052E224,00000003,0058C878,0000000C,0052E37B,00000003,00000002,00000000,?,0052DBEB,00000003), ref: 0052E26F
TerminateProcess.KERNEL32(00000000,?,0052E224,00000003,0058C878,0000000C,0052E37B,00000003,00000002,00000000,?,0052DBEB,00000003), ref: 0052E276
ExitProcess.KERNEL32 ref: 0052E288

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cfaea127e8a4d635fc17d4b6892199e49b5bb71ec14c1f5bab0d1a56e5d5a11f
Instruction ID: bb4af38821257ac5eb18e4c3d4b7169c6755c4d774b94cbfca06548bcaece3cf
Opcode Fuzzy Hash: cfaea127e8a4d635fc17d4b6892199e49b5bb71ec14c1f5bab0d1a56e5d5a11f
Instruction Fuzzy Hash: E6E04639000218EBCF116F68ED0EAC93F29FF9A385F000420F9068A172CB35DD82DB90

Function 0048C060 Relevance: .7, Instructions: 689COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbd4bc03c2f98ab6b08e74557608eeff6a804ea3af12b96a96b93698a18d79f
Instruction ID: 7325c14cabff80c909aba46fb5bbc2b4f25a0acf6f5370f46a76909437fb4aa4
Opcode Fuzzy Hash: 2cbd4bc03c2f98ab6b08e74557608eeff6a804ea3af12b96a96b93698a18d79f
Instruction Fuzzy Hash: 2E320BB3F512188BC744CEADCC817CDB7E3BF98218B1E8539D818E7705E679E9064A84

Function 005404C0 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7688787b532c6dce88ffd6ada8292673a884a1ae1366bdf36143754700c8199
Instruction ID: 08d0822a38c0c6751f338ecb999079686fca21416788d3447352c01b68f303fe
Opcode Fuzzy Hash: b7688787b532c6dce88ffd6ada8292673a884a1ae1366bdf36143754700c8199
Instruction Fuzzy Hash: 3E321331D69F014DD7239638D862379A658BFB33C8F24E737E91AB59A6EB3884C35100

Function 00492070 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9992add13bc3bd07cf6dc0898450bfb70dc87b1a3b87cfe70b8ca72476def30f
Instruction ID: 5c1e43c76f56f2af1683a6878a67d761d79f10928772b2e770fbabc8dddbff88
Opcode Fuzzy Hash: 9992add13bc3bd07cf6dc0898450bfb70dc87b1a3b87cfe70b8ca72476def30f
Instruction Fuzzy Hash: 60F11931E011298FDF24CF18CA90BEDBBB1BB98314F1581EAD90DA7341DA74AE858F54

Function 00494420 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a87d76c79b2e81b899c93e3d72fae80859dcf44d894491618ebacf60d612e22
Instruction ID: f6ee02d2a1d49515d4794013b4413ae37ce8a737e3a576a755a4ab475cf2a53a
Opcode Fuzzy Hash: 7a87d76c79b2e81b899c93e3d72fae80859dcf44d894491618ebacf60d612e22
Instruction Fuzzy Hash: FE2171705301B5078B0C8B3AE8F4536BFE0DB8629334B426FE486DA485D939D575A7A4

Function 00466210 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 267registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00466275
RegisterClassExW.USER32 ref: 00466290
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000030), ref: 0046629A
CreateWindowExW.USER32(00000000,ZCNMNBVCXZTP,00000000,86CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004662B7
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,00000030), ref: 004662DF
GetModuleHandleW.KERNEL32(00000000,0000006B,?,?,?,?,?,?,?,00000030), ref: 00466306
LoadIconW.USER32(00000000), ref: 00466309
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000030), ref: 00466333

Strings

0, xrefs: 0046626B
tp%I64d.ico, xrefs: 0046636B
ZCNMNBVCXZTP, xrefs: 00466280, 004662B0, 004664B3

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: HandleModule$Window$ClassCreateIconLoadPathRegisterShowTemp
String ID: 0$ZCNMNBVCXZTP$tp%I64d.ico
API String ID: 244549989-2830416069
Opcode ID: 97698d29cbca3f3fe1d604c142f1b1d138738d512f44c8785b852b61c3c597a7
Instruction ID: 044d5cf413f88435dded9a6980bf418663109767c9ab0a1025430e0beb0798e5
Opcode Fuzzy Hash: 97698d29cbca3f3fe1d604c142f1b1d138738d512f44c8785b852b61c3c597a7
Instruction Fuzzy Hash: E7A190B1644701BBE710DF64DC0AF97BBA8BB44714F00462AF618D72D0EBB4E418DBA6

Function 004F0550 Relevance: 47.5, APIs: 19, Strings: 8, Instructions: 204COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 004F057A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F05A3
___swprintf_l.LIBCMT ref: 004F05B5
__allrem.LIBCMT ref: 004F05DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F05E8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F05F8
___swprintf_l.LIBCMT ref: 004F060A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F0630
___swprintf_l.LIBCMT ref: 004F0642
__allrem.LIBCMT ref: 004F0664
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F0672
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F0682
___swprintf_l.LIBCMT ref: 004F0694
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F06B9
___swprintf_l.LIBCMT ref: 004F06CB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F06F0
___swprintf_l.LIBCMT ref: 004F0702
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F0719
___swprintf_l.LIBCMT ref: 004F072B

Strings

%4I64dk, xrefs: 004F05AD
%4I64dP, xrefs: 004F0723
%2I64d.%0I64dG, xrefs: 004F068C
%5I64d, xrefs: 004F0572
%4I64dT, xrefs: 004F06FA
%2I64d.%0I64dM, xrefs: 004F0602
%4I64dM, xrefs: 004F063A
%4I64dG, xrefs: 004F06C3

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$___swprintf_l$__allrem
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 2797256748-2102732564
Opcode ID: c6d3d449d67c3002d3a794e9e66a2ed74b1253b5b53f65126e8a2ffe1f1697bc
Instruction ID: 5907b350e5f34a5239e610d513d85865ace62e288f1c0ef2e41ca8e5cfc663e5
Opcode Fuzzy Hash: c6d3d449d67c3002d3a794e9e66a2ed74b1253b5b53f65126e8a2ffe1f1697bc
Instruction Fuzzy Hash: 8F4194B6B812A83AF92065496C06FBF161CEBD1F59F05042BFB04F718292996D2146FD

Function 004AA300 Relevance: 24.4, APIs: 16, Instructions: 409memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000), ref: 004AA313
lstrlenW.KERNEL32(?), ref: 004AA32B
LocalReAlloc.KERNEL32(?,?,00000042,00000001,?), ref: 004AA3EB
LocalSize.KERNEL32(00000000), ref: 004AA3FC
GetProcessHeap.KERNEL32(00000000,?,?), ref: 004AA434
RtlAllocateHeap.NTDLL(00000000), ref: 004AA43B
lstrcpyW.KERNEL32(?,?), ref: 004AA48A
lstrlenW.KERNEL32(?,?), ref: 004AA4B9
CharUpperBuffW.USER32(?,?,?), ref: 004AA53A
CharLowerBuffW.USER32(?,?,?), ref: 004AA549
lstrcpyW.KERNEL32(?,?), ref: 004AA5A9
lstrlenW.KERNEL32(?,?), ref: 004AA5F9
GetProcessHeap.KERNEL32(00000008,?,00000000), ref: 004AA702
RtlReAllocateHeap.NTDLL(00000000), ref: 004AA709
GetProcessHeap.KERNEL32(00000000,00000000,?), ref: 004AA7C5
HeapFree.KERNEL32(00000000), ref: 004AA7CC

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Heap$lstrlen$Process$AllocateBuffCharLocallstrcpy$AllocFreeLowerSizeUpper
String ID:
API String ID: 2363362608-0
Opcode ID: 0c9e0c2a2f9c2ea6b6de53bbe505b7f6adf009389cd9fcd2c9bd35fd9a6466e4
Instruction ID: b77b7fba4193eb915ddbb04b553bfc9438d7aefd2ad355a859e9a6762c1ccc13
Opcode Fuzzy Hash: 0c9e0c2a2f9c2ea6b6de53bbe505b7f6adf009389cd9fcd2c9bd35fd9a6466e4
Instruction Fuzzy Hash: 08F1C274B00606AFCB18DF78C544BAEB7B1FF55304F04462AE819A7390DB74AD64CB95

Function 00450310 Relevance: 19.8, APIs: 13, Instructions: 299windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 00450383
ShowWindow.USER32(?,00000000,?,?,00000001), ref: 004503E1
ShowWindow.USER32(?,00000000,?,?,00000003), ref: 004505EF
PostQuitMessage.USER32(00000000), ref: 00450690
ShowWindow.USER32(?,00000000,?,?,00000003), ref: 004506B8
PostQuitMessage.USER32(00000000), ref: 004506D1

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: MessagePostQuitShowWindow
String ID:
API String ID: 3232434430-0
Opcode ID: e1306742cea122a22e55211ffafa4b6e5c468b2b17600fbe6ff437d5d8fe3e75
Instruction ID: 88e679e9d980c86c5fc973ad448f642b26991a64aed8ca518197629f86466142
Opcode Fuzzy Hash: e1306742cea122a22e55211ffafa4b6e5c468b2b17600fbe6ff437d5d8fe3e75
Instruction Fuzzy Hash: CEC10C74500609BBEB20DF20CC85BD9B774FF15304F10425AEA05A61D2EB75AADCCF99

Function 00450080 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 178synchronizationtimewindowCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?), ref: 004500B1

Part of subcall function 00486C50: GetProcAddress.KERNEL32 ref: 00486D80

ShowWindow.USER32(?,00000000), ref: 00450168
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 0045020E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00450230
CloseHandle.KERNEL32(00000000), ref: 00450237
PostQuitMessage.USER32(00000000), ref: 00450247
ShowWindow.USER32(?,00000000,00000003), ref: 0045028A
GetTickCount.KERNEL32 ref: 00450297
ShowWindow.USER32(?,00000000,00000003), ref: 004502B8
GetTickCount.KERNEL32 ref: 004502C5

Strings

%I64d%d, xrefs: 0045010E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ShowWindow$CountTick$AddressCloseCreateEventHandleLocalMessageObjectPostProcQuitSingleTimeWait
String ID: %I64d%d
API String ID: 676864848-2489624171
Opcode ID: 8a6503bf306ac5752a3bd76bb386aa833bd4ffe01a4f8f383f133f6f9918c645
Instruction ID: 30c08b5a3f4c3981425fc546ecf8c2decd1fede29d8afc949dfff43dea9be047
Opcode Fuzzy Hash: 8a6503bf306ac5752a3bd76bb386aa833bd4ffe01a4f8f383f133f6f9918c645
Instruction Fuzzy Hash: 98614734600605EBD728DF24DC4DBEBB7A4FF14306F04026AF91997292CB78A958CB95

Function 00460130 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 177timeCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005), ref: 00460190
UpdateWindow.USER32(?), ref: 00460199
SetTimer.USER32(?,0000080D,000003E8,00000000), ref: 00460280
GetWindowRect.USER32(?,?), ref: 004602F0
SetWindowPos.USER32(?,000000FF,?,?,?,?,00000201), ref: 00460314
SetForegroundWindow.USER32(?), ref: 0046031D
ShowWindow.USER32(?,00000005), ref: 00460328

Strings

%ds, xrefs: 00460230
btn_Close, xrefs: 004601AF
countdown_text1, xrefs: 004601DB, 00460288
countdown_text2, xrefs: 00460209, 004602B4

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Window$Show$ForegroundRectTimerUpdate
String ID: %ds$btn_Close$countdown_text1$countdown_text2
API String ID: 4221458010-784026027
Opcode ID: 1abd414938b5ce665989faa68cde5959edfef2d74d7e4ff1e3c71eb97e7710cc
Instruction ID: 3d372f7cc53981a324d6fc06ef82bcc375389a8d1f37053bac6b4e6cc6f61986
Opcode Fuzzy Hash: 1abd414938b5ce665989faa68cde5959edfef2d74d7e4ff1e3c71eb97e7710cc
Instruction Fuzzy Hash: C951D630640705BBDB11AB64CD8AFBF7BB6AF45B04F20012EF506A6191EF69AC419B19

Function 00490410 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 95libraryloaderCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0059810C), ref: 00490481

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0049049D

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(0059810C), ref: 004904B8
LoadLibraryA.KERNEL32(?), ref: 0049052F
GetProcAddress.KERNEL32(00000000,?), ref: 0049054F
RtlLeaveCriticalSection.NTDLL(0059810C), ref: 00490571

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Strings

Netb, xrefs: 0049053F
ios, xrefs: 00490548
.dll, xrefs: 00490524
neta, xrefs: 00490516
pi32, xrefs: 0049051D

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AddressInit_thread_footerInitializeLibraryLoadProc__onexit
String ID: .dll$Netb$ios$neta$pi32
API String ID: 1978383653-4097919194
Opcode ID: 39bf99fd5d6cd78a678ee80769376aa58461de3a7febfbfe88c52aa785441fcf
Instruction ID: 21459527ff49951f05daf93ff5aeb0cc61a27a30a2da296593a39ef35cc5910a
Opcode Fuzzy Hash: 39bf99fd5d6cd78a678ee80769376aa58461de3a7febfbfe88c52aa785441fcf
Instruction Fuzzy Hash: 46419BB090420ADFDB10CFA8DD4979EBFF0BB19724F10826AE415A7390DBB49A44DF54

Function 004A0320 Relevance: 15.1, APIs: 10, Instructions: 128filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 004A03B4
GetFileSize.KERNEL32(00000000,00000000), ref: 004A03D0
GlobalAlloc.KERNEL32(00000000,00000000), ref: 004A03E3
CloseHandle.KERNEL32(00000000), ref: 004A0401
GlobalFree.KERNEL32(?), ref: 004A047F

Part of subcall function 004A0690: _wcschr.LIBVCRUNTIME ref: 004A06FB
Part of subcall function 004A0690: _wcschr.LIBVCRUNTIME ref: 004A0732
Part of subcall function 004A0690: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004A07DE

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Global$AllocFile_wcschr$CloseCreateFreeHandleSize
String ID:
API String ID: 1013191568-0
Opcode ID: f4398dc885939a87f1c59180b5c09518a1318a474fd14ba2b6e287f30e7e1cb0
Instruction ID: f6bacdbdc957fc5a9fe16b2a7bb7d1b17d671d9b5eddc1b40fb8306b4d774199
Opcode Fuzzy Hash: f4398dc885939a87f1c59180b5c09518a1318a474fd14ba2b6e287f30e7e1cb0
Instruction Fuzzy Hash: 8341F575600208EFEB209F64DC49FEA77B8FF6A710F10046AFA05E7291DB749944DB60

Function 0044C0C0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 405COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0044C21A

Part of subcall function 00483DB0: GetProcAddress.KERNEL32 ref: 00483E2F
Part of subcall function 00483DB0: Process32First.KERNEL32(00000000,?), ref: 00483E54
Part of subcall function 00483DB0: Process32Next.KERNEL32(00000000,?), ref: 00483E7C
Part of subcall function 00483DB0: CloseHandle.KERNEL32(00000000), ref: 00483E83

Strings

path, xrefs: 0044C399, 0044C3CB
type, xrefs: 0044C388
wow64, xrefs: 0044C555
listmime, xrefs: 0044C18E
reg, xrefs: 0044C27D
proc, xrefs: 0044C1B5
name, xrefs: 0044C47A, 0044C4A6

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Process32$AddressCloseFirstHandleNextProc___from_strstr_to_strchr
String ID: listmime$name$path$proc$reg$type$wow64
API String ID: 4217873175-1851501374
Opcode ID: 12272433b729f585193bdce10a4cbf64b8ab51b642fdefb4fd51f0ffb3b619f3
Instruction ID: 173a2630b8b5dfa9e6b936aa3ec7cb8159a19292642e96cda69c262f89bf9208
Opcode Fuzzy Hash: 12272433b729f585193bdce10a4cbf64b8ab51b642fdefb4fd51f0ffb3b619f3
Instruction Fuzzy Hash: 9EE1F8B09012149BEF64EB24CD95BEDB775AF81304F0481DEE509672C2DB789F85CB98

Function 0046A100 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 178memorysynchronizationCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0046A1FF
RtlAllocateHeap.NTDLL(00000000), ref: 0046A206
GetCurrentProcess.KERNEL32(?,?), ref: 0046A264
CloseHandle.KERNEL32(?), ref: 0046A2CE
GetCurrentProcessId.KERNEL32 ref: 0046A2D4
OpenProcess.KERNEL32(0000043A,00000000,00000000), ref: 0046A2E2
WaitForSingleObject.KERNEL32(00000000,000000FF,?), ref: 0046A302

Strings

SeDebugPrivilege, xrefs: 0046A28C

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$AllocateCloseHandleObjectOpenSingleWait
String ID: SeDebugPrivilege
API String ID: 1295659927-2896544425
Opcode ID: af362d12ca51ad1a4b4da40bd24647d643dd596e2fca7000bc9c6ce35382601d
Instruction ID: 6f20c2ddf9e607eec226d21a4c850be73cad63304627c84e4198316711b44ed4
Opcode Fuzzy Hash: af362d12ca51ad1a4b4da40bd24647d643dd596e2fca7000bc9c6ce35382601d
Instruction Fuzzy Hash: C1515C70914B0157E721AF349D06BBBB798AF96308F44472AFC45E2241FB34E994C797

Function 004360F0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176comCOMMON

Download Yara Rule

APIs

_wcsstr.LIBVCRUNTIME ref: 00436115
CoInitialize.OLE32(00000000), ref: 00436127
CoCreateInstance.COMBASE(005648F0,00000000,00000001,00564900,?), ref: 00436164
CoUninitialize.COMBASE ref: 0043620F
CoCreateInstance.COMBASE(00564920,00000000,00000001,005648E0,?), ref: 00436243

Strings

?p, xrefs: 00436108
LNK, xrefs: 004361D5
.url, xrefs: 0043610C

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CreateInstance$InitializeUninitialize_wcsstr
String ID: .url$?p$LNK
API String ID: 2533273046-3544018273
Opcode ID: 82a5ef31420450d929419d106448eccaa23333d11550efcd8255a27ff2fc7492
Instruction ID: d3f37d63530f3a25251d587c66f2cce99b07636d1ab527733b3ada5f76862bcc
Opcode Fuzzy Hash: 82a5ef31420450d929419d106448eccaa23333d11550efcd8255a27ff2fc7492
Instruction Fuzzy Hash: 43512975A00219AFCB10DF98D888FAEBBB8BF49715F114199F905EB290CB71A904CB60

Function 004981F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0049821D
GetDesktopWindow.USER32 ref: 00498225
GetModuleHandleW.KERNEL32(00000000), ref: 00498263
SendMessageW.USER32(?,00000411,00000000,0000002C), ref: 00498286
SendMessageW.USER32(?,00000433,00000000,0000002C), ref: 00498295
GetModuleHandleW.KERNEL32(00000000), ref: 004982DB
SendMessageW.USER32(?,00000433,00000000,0000002C), ref: 004982F8

Strings

,, xrefs: 004982C3

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: MessageSend$HandleModule$DesktopParentWindow
String ID: ,
API String ID: 3111795765-3772416878
Opcode ID: f3d1cc485e85a0bd6be8a46e9fdf924ff3358afce327145a664a617941d18095
Instruction ID: 4513cb7a96d43f8e1d4454285632cde748bd3002f6849a7d12320632e4c138d5
Opcode Fuzzy Hash: f3d1cc485e85a0bd6be8a46e9fdf924ff3358afce327145a664a617941d18095
Instruction Fuzzy Hash: 5E313875D01209ABDB00DFA4DD04BEEBBB5FF99318F10126AF501B6290DBB11A848F94

Function 004840F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00484181
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00484197
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 004841AF

Strings

-, xrefs: 0048414B
, xrefs: 0048415F
_, xrefs: 00484150
~, xrefs: 0048415A
., xrefs: 00484155

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_context
String ID: $-$.$_$~
API String ID: 2914748677-1535613121
Opcode ID: 35760dffdc4fa7de238cc774249b3fd331e70eee086b4e023761f6ce5640bff6
Instruction ID: 10ac112a0551a7d84930f047cb1cee5c0e1a72d512ff4e08fd23859abb1faaac
Opcode Fuzzy Hash: 35760dffdc4fa7de238cc774249b3fd331e70eee086b4e023761f6ce5640bff6
Instruction Fuzzy Hash: 42217C31E442198EDB00EFA98C0D6FE77B06FA9300F08096FE44567282CE2C49C1D795

Function 00438010 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 62libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00413A40: RtlInitializeCriticalSection.NTDLL(00597C18), ref: 00413AAE
Part of subcall function 00413A40: __Init_thread_footer.LIBCMT ref: 00413ACA
Part of subcall function 00413A40: RtlEnterCriticalSection.NTDLL(00597C18), ref: 00413AE5
Part of subcall function 00413A40: RtlLeaveCriticalSection.NTDLL(00597C18), ref: 00413B41

GetProcAddress.KERNEL32(?,?), ref: 00438062
WaitForSingleObject.KERNEL32(?,00000000), ref: 00438095
CloseHandle.KERNEL32(?), ref: 004380A4
CloseHandle.KERNEL32(?), ref: 004380A9

Strings

oces, xrefs: 00438051
sA, xrefs: 00438058
Crea, xrefs: 00438041
tePr, xrefs: 0043804A

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseHandle$AddressEnterInit_thread_footerInitializeLeaveObjectProcSingleWait
String ID: Crea$oces$sA$tePr
API String ID: 161278594-524377044
Opcode ID: 3fbf7bea019f379f32c62ff8c6c1f32f524e1882701429b34ae0f07772972aac
Instruction ID: d0ccd7e3aac2de8c47f5c27a7e95cd3a8b4b386cea1219e15722d381bdd0137f
Opcode Fuzzy Hash: 3fbf7bea019f379f32c62ff8c6c1f32f524e1882701429b34ae0f07772972aac
Instruction Fuzzy Hash: D0118B35A00208ABCB10DFA9CC44BEFBBF8EF59660F155129F504B7250DB30AA84CBA0

Function 00486570 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 468libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00486C50: GetProcAddress.KERNEL32(?,?), ref: 0048732E
Part of subcall function 00486C50: GetProcAddress.KERNEL32(?,?), ref: 004873E2

GetProcAddress.KERNEL32 ref: 00486692

Strings

Item, xrefs: 004868FD, 00486936, 0048693B
labelid, xrefs: 004869DE
erPa, xrefs: 00486684
xml version="1.0" encoding="UTF-8", xrefs: 004867B7, 004867C6, 004867D3, 004867DF
InsLog, xrefs: 0048685A

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: InsLog$Item$erPa$labelid$xml version="1.0" encoding="UTF-8"
API String ID: 190572456-2764935047
Opcode ID: f7ac147004c2e197bc8b527109ee1ae22d58027ffb02cc7cba63ead177b1b591
Instruction ID: 31467695ff51873745818196bd3a6fff3c52aedbaddba9a9abc6e057d1bce80e
Opcode Fuzzy Hash: f7ac147004c2e197bc8b527109ee1ae22d58027ffb02cc7cba63ead177b1b591
Instruction Fuzzy Hash: E2128FB09002198FDB64EF14C988BDEBBB4BF44304F1545EED449AB281DBB99AC5CF94

Function 004401E0 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 350COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(000003A8,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00440472
MultiByteToWideChar.KERNEL32(000003A8,00000000,?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004404DD

Strings

page2_check_lk_%d, xrefs: 0044027E
page2_bottom_check_group%d, xrefs: 004405E6
page2_check_lk_text_%d, xrefs: 00440329
page2_check_hk_text_%d, xrefs: 004404EF
page2_check_hk_%d, xrefs: 004403CA

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID: page2_bottom_check_group%d$page2_check_hk_%d$page2_check_hk_text_%d$page2_check_lk_%d$page2_check_lk_text_%d
API String ID: 626452242-169679372
Opcode ID: 406c1469c60aa1b0cfed930fdf73f4c3bbb80f238e5a0c5282f1cec0c4adec47
Instruction ID: d06ddd16359877ff06ef5ccb26d4523b776113a213bef8885153a17b03bd206d
Opcode Fuzzy Hash: 406c1469c60aa1b0cfed930fdf73f4c3bbb80f238e5a0c5282f1cec0c4adec47
Instruction Fuzzy Hash: B1D1C770901215AFEB20DB64CC8DFAABBB8EF48304F1441E9E50DA7282D775AE94CF54

Function 004564F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597E68), ref: 0045655E

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0045657A

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL ref: 00456595
RtlLeaveCriticalSection.NTDLL(00597E68), ref: 004566DA

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Strings

hh~Y, xrefs: 00456564
h~Y, xrefs: 00456587

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID: hh~Y$h~Y
API String ID: 916978925-281131063
Opcode ID: 4ea2316aa3b1e24c9bcabe1bc25cbcf1e9a24ee90582f10ab52e85fa5bd8347f
Instruction ID: 0fd103464ce6ad472cfb0f9f17efa321cc6ce69c1eee7d3c7e6b10f62d289a95
Opcode Fuzzy Hash: 4ea2316aa3b1e24c9bcabe1bc25cbcf1e9a24ee90582f10ab52e85fa5bd8347f
Instruction Fuzzy Hash: 70515B70815B88DFE720CF68D50978ABFF0FB18718F108A5ED49A97781D7B96608CB85

Function 004083A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597B74), ref: 0040840F

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0040842B

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597B74), ref: 00408446
RtlLeaveCriticalSection.NTDLL(00597B74), ref: 00408517

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Strings

t{Y, xrefs: 00408438
ht{Y, xrefs: 00408415

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID: ht{Y$t{Y
API String ID: 916978925-2285465967
Opcode ID: ecfe80339bbb72631f42857859d98e6dd34d3a0e63a98b519c52c83b49425721
Instruction ID: dcf3a41d64c0706bf5efad368af1ded3e6e7c937e7379ded07362a9f70e5c64f
Opcode Fuzzy Hash: ecfe80339bbb72631f42857859d98e6dd34d3a0e63a98b519c52c83b49425721
Instruction Fuzzy Hash: 3941A970A0864AEBDB10DF68D90978EFBE4FB94714F10429BE418A73D0EBB52604CB91

Function 0046E2C0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,EFE0703F,00000000), ref: 0046E325
GetProcAddress.KERNEL32(00000000,?), ref: 0046E348

Strings

elp., xrefs: 0046E317
dbgh, xrefs: 0046E310
pF, xrefs: 0046E2FC
dll, xrefs: 0046E31E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: dbgh$dll$elp.$pF
API String ID: 2574300362-3995350128
Opcode ID: 04596cd7c4bebc8a8eec01d93673bd1038051d8ff990083c116c79df0d8d6966
Instruction ID: ab8c29164d7639cdc1ae5bcddf31798c7744adad730962cbd2eee6e0ac756f2f
Opcode Fuzzy Hash: 04596cd7c4bebc8a8eec01d93673bd1038051d8ff990083c116c79df0d8d6966
Instruction Fuzzy Hash: 631158B0C04619DFDB14CF98E845BAEBBF8FF08704F00862EE815A3640EB74A544CB94

Function 00530045 Relevance: 9.3, APIs: 6, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00534703: GetLastError.KERNEL32(?,?,00524F60,0058C738,00000010), ref: 00534707
Part of subcall function 00534703: _free.LIBCMT ref: 0053473A
Part of subcall function 00534703: SetLastError.KERNEL32(00000000), ref: 0053477B
Part of subcall function 00534703: _abort.LIBCMT ref: 00534781

_memcmp.LIBVCRUNTIME ref: 005302EF
_free.LIBCMT ref: 00530360
_free.LIBCMT ref: 00530379
_free.LIBCMT ref: 005303AB
_free.LIBCMT ref: 005303B4
_free.LIBCMT ref: 005303C0

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID:
API String ID: 1679612858-0
Opcode ID: 7c28300d30a2e01f8a24e8018a5ee38dbd121ccc91ba690453be9c10156dc588
Instruction ID: 7ac775a9220d468c373f7f1dfbd03a58822fafefdf22d3025bc52b1fca9c98a9
Opcode Fuzzy Hash: 7c28300d30a2e01f8a24e8018a5ee38dbd121ccc91ba690453be9c10156dc588
Instruction Fuzzy Hash: 10B10975A0131ADFDB24DF18C899AADBBB4FF48304F5045AAE849A7390D771AE90CF40

Function 004803C0 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 352COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 004804E7
_Mpunct.LIBCPMTD ref: 0048052D
std::ios_base::width.LIBCPMT ref: 00480793

Strings

@, xrefs: 00480628
?p, xrefs: 00480734, 0048073A

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Mpunctctypestd::ios_base::width
String ID: ?p$@
API String ID: 3537416286-91208078
Opcode ID: 6c688737dc7317669eaf57710734688416a199bed6c3cae06b86dd0d44e4d75d
Instruction ID: 043d6d44f0a8152379de08877663cdff38541a1f6531e52b31651c7c046dfbf0
Opcode Fuzzy Hash: 6c688737dc7317669eaf57710734688416a199bed6c3cae06b86dd0d44e4d75d
Instruction Fuzzy Hash: B1E13E71A10148DFCB04EF98C991AEEBBB5BF48304F14855EF909AB291D738AE45CF94

Function 0043A500 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

"%s%s" %s, xrefs: 0043AB53
feirar, xrefs: 0043A9AC, 0043ABF8
"%s%s", xrefs: 0043AB2E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AttributesFile$AddressByteCharMultiProcWide
String ID: "%s%s"$"%s%s" %s$feirar
API String ID: 793792645-3199780743
Opcode ID: 8b8609be7a185562f73ad3219647ffe7627bcc46f96add53f677c349dd5e59c2
Instruction ID: 0c80a1f9fbdb3b4982757e3e4d378dad1e4a91e7e90a7f80602a8525095b87a1
Opcode Fuzzy Hash: 8b8609be7a185562f73ad3219647ffe7627bcc46f96add53f677c349dd5e59c2
Instruction Fuzzy Hash: B1C11770640204ABDB25DF24C889BDAF7A5FF09304F0451ABE8599B2C1D7786EE4CB97

Function 004681F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 290COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00468283
___from_strstr_to_strchr.LIBCMT ref: 00468299
___from_strstr_to_strchr.LIBCMT ref: 004682E2

Strings

in_disk, xrefs: 004683D9
%02X, xrefs: 004685BD

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: %02X$in_disk
API String ID: 601868998-2956902724
Opcode ID: 52d3c2e3424f10aac8d941eebdd74e73d3cdc05850819a237190403e763b83e8
Instruction ID: 1989c8043e0b72275f30128f3445b6a3fb688df9cebe7e95dd5a1952a8af302c
Opcode Fuzzy Hash: 52d3c2e3424f10aac8d941eebdd74e73d3cdc05850819a237190403e763b83e8
Instruction Fuzzy Hash: FCB126716083429BD730DB24CC45BABBBE8BF85304F044A7EF9C997642EB7495488B93

Function 0045A170 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 286synchronizationCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0045A3BD
WaitForSingleObject.KERNEL32(?,00000000,00000000,?), ref: 0045A4D3
CloseHandle.KERNEL32(?), ref: 0045A4E5
CloseHandle.KERNEL32(?), ref: 0045A4ED

Part of subcall function 00415DC0: RtlInitializeCriticalSection.NTDLL(00597C64), ref: 00415E2E
Part of subcall function 00415DC0: __Init_thread_footer.LIBCMT ref: 00415E4A
Part of subcall function 00415DC0: RtlEnterCriticalSection.NTDLL(00597C64), ref: 00415E65
Part of subcall function 00415DC0: RtlLeaveCriticalSection.NTDLL(00597C64), ref: 00415EBB

Part of subcall function 0046BB40: GetProcAddress.KERNEL32(?,?), ref: 0046BB78

Strings

D, xrefs: 0045A453

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseHandle$AddressEnterInit_thread_footerInitializeLeaveObjectProcSingleWait_strrchr
String ID: D
API String ID: 1861692331-2746444292
Opcode ID: c0519f0561d1263de137dad28d34114e192e9bb1ddd60408e0866fa429f1522f
Instruction ID: 2042a746c37683b5fe93729a1af4a6326984fea1b396c7364fbc35c38a601fa4
Opcode Fuzzy Hash: c0519f0561d1263de137dad28d34114e192e9bb1ddd60408e0866fa429f1522f
Instruction Fuzzy Hash: 96A10AB1E0020C5ADF209A209C45BEF7768AB51309F5446DFFD0A97242E739DED8CB5A

Function 004160B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00401330: GetProcessHeap.KERNEL32 ref: 0040139A
Part of subcall function 00401330: __Init_thread_footer.LIBCMT ref: 004013CC
Part of subcall function 00401330: __Init_thread_footer.LIBCMT ref: 00401457

Part of subcall function 005136D8: RtlEnterCriticalSection.NTDLL(00596DF8), ref: 005136E3
Part of subcall function 005136D8: RtlLeaveCriticalSection.NTDLL(00596DF8), ref: 0051370F

FindResourceExW.KERNEL32(00000000,00000006,00000001,00000000,00000000), ref: 0041613D
FindResourceW.KERNEL32(00000000,00000006,00000006), ref: 00416189

Strings

mY, xrefs: 00416161
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004160FD, 00416128, 00416147, 00416197, 0041620D
mY, xrefs: 0041610F

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalFindInit_thread_footerResourceSection$EnterHeapLeaveProcess
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$mY$mY
API String ID: 3785588035-1709015650
Opcode ID: 5a2f1d6ba2502c82c6f869b35698a59d3d0892a62e3169168e37d918391b1c5f
Instruction ID: 270e102bd065b118de348aa4f1063a528aec08687396fef78cbaffba3b9d4602
Opcode Fuzzy Hash: 5a2f1d6ba2502c82c6f869b35698a59d3d0892a62e3169168e37d918391b1c5f
Instruction Fuzzy Hash: 6C411671B00520ABD714ABA9DC45BBF76E4EF84714F01416EF806DB381DB38DD419BA9

Function 0048E3D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 105libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00408180: RtlInitializeCriticalSection.NTDLL(00597BBC), ref: 004081EE
Part of subcall function 00408180: __Init_thread_footer.LIBCMT ref: 0040820A
Part of subcall function 00408180: RtlEnterCriticalSection.NTDLL(00597BBC), ref: 00408225
Part of subcall function 00408180: RtlLeaveCriticalSection.NTDLL(00597BBC), ref: 0040827B

GetProcAddress.KERNEL32(?,?), ref: 0048E477

Strings

\PHX\DU, xrefs: 0048E4E3
\Global.db, xrefs: 0048E508
erPa, xrefs: 0048E469
\PHX\DT, xrefs: 0048E4EA

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressEnterInit_thread_footerInitializeLeaveProc
String ID: \Global.db$\PHX\DT$\PHX\DU$erPa
API String ID: 3908199253-2618851521
Opcode ID: fb2f0a007127aa59ba6e9c80fa2dee8f4970b50855c1a864e8e1cc14d9be671a
Instruction ID: 22bd3ae536f36315dd3df5167b6fc734e0aae32db2466f701b3d24d96dad6565
Opcode Fuzzy Hash: fb2f0a007127aa59ba6e9c80fa2dee8f4970b50855c1a864e8e1cc14d9be671a
Instruction Fuzzy Hash: 3B31C671B00208AFDB14EF95C955BEEBBB4FB48704F00056EF409A72C1DB789A44CBA9

Function 0046C0E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,EFE0703F,00809318), ref: 0046C149
GetProcAddress.KERNEL32(00000000,?), ref: 0046C166

Strings

papi, xrefs: 0046C137
.dll, xrefs: 0046C13E
iphl, xrefs: 0046C130

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$iphl$papi
API String ID: 2574300362-3203080450
Opcode ID: ed094ef179a710b71aacfa941f0bec4ed73de9946578c154e8a21e69b724d243
Instruction ID: 8f22f3a2ea63b0015d9947428c80e2858e96284ac2e6a20a641d7bb55d587829
Opcode Fuzzy Hash: ed094ef179a710b71aacfa941f0bec4ed73de9946578c154e8a21e69b724d243
Instruction Fuzzy Hash: 0C116DB1904619DFDB10CF98D955BEEBBF8FB08704F10821EE415A7650EB749644CB90

Function 0052E2D3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0052E284,00000003,?,0052E224,00000003,0058C878,0000000C,0052E37B,00000003,00000002), ref: 0052E2F3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0052E306
FreeLibrary.KERNEL32(00000000,?,?,?,0052E284,00000003,?,0052E224,00000003,0058C878,0000000C,0052E37B,00000003,00000002,00000000), ref: 0052E329

Strings

CorExitProcess, xrefs: 0052E2FE
mscoree.dll, xrefs: 0052E2EC

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b53ac596755930d52a6fadaac9d62fa639fc5f029d460c5187e126a61092a100
Instruction ID: 34cf3210dd55c905d628812567bb2e8a1e3267d31045eddd7af0ad4527f2ccef
Opcode Fuzzy Hash: b53ac596755930d52a6fadaac9d62fa639fc5f029d460c5187e126a61092a100
Instruction Fuzzy Hash: F9F03138A00118BBCB159B95DC09BDEBFA8FF59716F014168F805A61A0DB749E45DB90

Function 004321F0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 307COMMON

Download Yara Rule

Strings

?p, xrefs: 00432361, 004323E2
reschk, xrefs: 00432275, 00432296
resmd, xrefs: 004322DB, 004322F6
setres, xrefs: 00432228, 0043224D

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID: ?p$reschk$resmd$setres
API String ID: 0-1727112364
Opcode ID: 48672ed122b0bddd77802af3c119839ac589ff094414b07231c4035a80841895
Instruction ID: b6887b571b79c76cb28713bcc6fd15bb5ca461b69fd2106e21546973d5c59f29
Opcode Fuzzy Hash: 48672ed122b0bddd77802af3c119839ac589ff094414b07231c4035a80841895
Instruction Fuzzy Hash: A5C1F7709002189BEF24DF78CE597DEBBB2EF45304F10859DD409AB292DBB95A84CF94

Function 00480010 Relevance: 7.7, APIs: 5, Instructions: 186COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 004800E0
shared_ptr.LIBCMTD ref: 004800EF

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Mpunctshared_ptr
String ID:
API String ID: 3707918647-0
Opcode ID: 601647dedc0e83b46b017e71f2f6c13c673d6cdc09bc1aebfcd4b4d2f6811210
Instruction ID: 4703a93ca3bd832a26a3e965ba87b43e346b3b553fa57dd4b036ba99fe8237c4
Opcode Fuzzy Hash: 601647dedc0e83b46b017e71f2f6c13c673d6cdc09bc1aebfcd4b4d2f6811210
Instruction Fuzzy Hash: FD7140719002089FCB14EF99DC51AEEBBB4BF48314F00852EF919AB292DB34AD45CF94

Function 004380C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 339COMMON

Download Yara Rule

Strings

Rar, xrefs: 004382EB
http, xrefs: 0043842D
https, xrefs: 00438400

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID:
String ID: Rar$http$https
API String ID: 0-4117486229
Opcode ID: 255565b93451528d23ec41ae5f6bf0822215824fc7c09c239e6dc08b13a5c307
Instruction ID: c01b96a2c8d596e19198a45bce2ee704d57ce5b15ad785e0aa1ae4eebdbe892f
Opcode Fuzzy Hash: 255565b93451528d23ec41ae5f6bf0822215824fc7c09c239e6dc08b13a5c307
Instruction Fuzzy Hash: ECD17771900709AADF11DF60CC85FEBB7BDBB48304F04447EFA49AB181EB7996858B64

Function 0046C210 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 0046C79D

Strings

el32, xrefs: 0046C78B
.dll, xrefs: 0046C792
kern, xrefs: 0046C784

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: .dll$el32$kern
API String ID: 4139908857-1222553051
Opcode ID: 53f38229f50880b1b653f986198bb602e07a5350933c01f6b1930548bb1454ba
Instruction ID: b9de17128df73029d24797684e8ef86495bbb94d637a75dc8c5a48db0e3826a6
Opcode Fuzzy Hash: 53f38229f50880b1b653f986198bb602e07a5350933c01f6b1930548bb1454ba
Instruction Fuzzy Hash: 77C1BDB0046B458FE3618F62C5AD7C7BBE0BB05708F108A0CC5EA1A691C7BA6148CFD5

Function 0046E3F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole3,?), ref: 0046E491

Strings

ole3, xrefs: 0046E40A, 0046E414
l, xrefs: 0046E415
2.dl, xrefs: 0046E40D

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: 2.dl$l$ole3
API String ID: 4139908857-965305729
Opcode ID: 7ef31d3b7f8581d3f5aadb8365892335739c6bfbdbf294003ced9e53ee97cd10
Instruction ID: 8f2bf91bf3d2448bd789ce78fb5efe9d13357ca76df204067599bd65d04d3c40
Opcode Fuzzy Hash: 7ef31d3b7f8581d3f5aadb8365892335739c6bfbdbf294003ced9e53ee97cd10
Instruction Fuzzy Hash: A411D9B0401B08CFE320CF55C56835BBBF4FB08708F409A5CD49A5BB80D7BAAA088F84

Function 00456260 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597F80), ref: 004562CE

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 004562EA

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL ref: 00456305
RtlLeaveCriticalSection.NTDLL(00597F80), ref: 004564B8

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: 0a37b37312c0aad0674c2d2167d0b8a09b0a71af4ce73e95722668c8892f0a82
Instruction ID: 153ca7a3c2cfea5ed95ec46b7b976fee5050ccb7cc731806f3dea98a796c13f2
Opcode Fuzzy Hash: 0a37b37312c0aad0674c2d2167d0b8a09b0a71af4ce73e95722668c8892f0a82
Instruction Fuzzy Hash: A76158B0805B85CFD761CF68C5057CABFF0BB19304F1089AED0AA97782D7B96648DB91

Function 00538129 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00520705,?,00000000,00000000,00000001,00000000,?,00000001,00520705,00000003), ref: 00538176
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005381FF
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0051F4B6,?), ref: 00538211
__freea.LIBCMT ref: 0053821A

Part of subcall function 00534B51: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00534B83

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 0739b6d3b0aa51662c7102ee3fdea465fbdbfead664a83b5fbe3e6ab306feee7
Instruction ID: 68c0ed9caf9be31bee086ba84f96ee76031a3cc1e3c90aa238bd672ad312f9f1
Opcode Fuzzy Hash: 0739b6d3b0aa51662c7102ee3fdea465fbdbfead664a83b5fbe3e6ab306feee7
Instruction Fuzzy Hash: 8C31A936A0020AABDB288F65DC89DFF7FA5EB40310F154129FC0597250EB35DD95CBA0

Function 00446140 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597D88), ref: 004461AF

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 004461CB

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597D88), ref: 004461E6
RtlLeaveCriticalSection.NTDLL(00597D88), ref: 0044627D

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: caa77ec5b49612b5673c168ead499d84065c5d174e9d5e189b540c952119de36
Instruction ID: 4283bbc0da10fafe2ed3447f10d9f0859ebea693bd00dc1e685b078856472080
Opcode Fuzzy Hash: caa77ec5b49612b5673c168ead499d84065c5d174e9d5e189b540c952119de36
Instruction Fuzzy Hash: 6A31AB70A04709EBDB04DF58D9097AEBBF4FF99724F20025BE418A7381D7B82A049B85

Function 0048E270 Relevance: 6.1, APIs: 4, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048E3D0: GetProcAddress.KERNEL32(?,?), ref: 0048E477

CreateFileW.KERNEL32(EFE0703F,40000000,00000001,00000000,00000002,00000000,00000000,EFE0703F,00000000), ref: 0048E2C8
CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0048E2FE
WriteFile.KERNEL32(00000000,00597A94,00000010,?,00000000), ref: 0048E324
CloseHandle.KERNEL32(00000000), ref: 0048E33E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: File$Create$AddressCloseHandleProcWrite
String ID:
API String ID: 2894970915-0
Opcode ID: 2f4382049ca2a752f84ed54e7643d14688204e1f1246283fdc424cff93cbb240
Instruction ID: 55e22696e4cdb543d992f818e317bf2f8fad95eeb2f4fe8dfbbcc67412793603
Opcode Fuzzy Hash: 2f4382049ca2a752f84ed54e7643d14688204e1f1246283fdc424cff93cbb240
Instruction Fuzzy Hash: A431C331A41208EFDB10DBA4DC46FDEBBB4EB15B14F50052AF911B72C0DB746A48CB94

Function 0041C140 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00597C84), ref: 0041C1AE

Part of subcall function 00513D5F: __onexit.LIBCMT ref: 00513D65

__Init_thread_footer.LIBCMT ref: 0041C1CA

Part of subcall function 00513989: RtlEnterCriticalSection.NTDLL(00596E38), ref: 00513993
Part of subcall function 00513989: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 005139C6

RtlEnterCriticalSection.NTDLL(00597C84), ref: 0041C1E5
RtlLeaveCriticalSection.NTDLL(00597C84), ref: 0041C246

Part of subcall function 005139D3: RtlEnterCriticalSection.NTDLL(00596E38), ref: 005139DE
Part of subcall function 005139D3: RtlLeaveCriticalSection.NTDLL(00596E38), ref: 00513A1B

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitialize__onexit
String ID:
API String ID: 916978925-0
Opcode ID: a006bf084aaf4b5e101dc5f2a51e9c07270f9802790f3c0861aa6c33e20d5ae5
Instruction ID: e4ff037c1e074eaef1e462576e27eb7f9e701e57f15d395cb24d58d2077de5ab
Opcode Fuzzy Hash: a006bf084aaf4b5e101dc5f2a51e9c07270f9802790f3c0861aa6c33e20d5ae5
Instruction Fuzzy Hash: CC31DE70958249DBCB21CFA8DD097D9BFF4FB18724F10829BE815A7380D7B51A449B81

Function 0049C1E0 Relevance: 6.0, APIs: 4, Instructions: 27timeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0049C1EB
GetCaretBlinkTime.USER32(00000000), ref: 0049C209
SetTimer.USER32(?,?,00000000), ref: 0049C216
ShowCaret.USER32(?), ref: 0049C226

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Caret$BlinkShowTimeTimerWindow
String ID:
API String ID: 669903483-0
Opcode ID: ab45ce15f426f730a8d74a4f1f16a0c4c9778292bc8ccc5b3fbc602e68351fc4
Instruction ID: 99db7e4a554883cef2b953eaab7c5161214fad1baa6cdc75bbd3fb7278538406
Opcode Fuzzy Hash: ab45ce15f426f730a8d74a4f1f16a0c4c9778292bc8ccc5b3fbc602e68351fc4
Instruction Fuzzy Hash: 55F015366046109BDE202F6DFC48BD73AACEB29326B000A79B442D21B1CB25D889AB50

Function 00422460 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 00422590: CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 00422671
Part of subcall function 00422590: CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 00422705

CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 0042250D
SetEvent.KERNEL32(00000000), ref: 00422514

Strings

dllquery, xrefs: 004224A1

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: Event$Create
String ID: dllquery
API String ID: 1287507382-3762084462
Opcode ID: 844db3ba58ae8aa231536162d5408f5bd4ffb248e7e307de069a5294f40f383b
Instruction ID: a63fc1301ba6287be8cfae0cfd820a5b2089b576439e38f84b321128d0625f5d
Opcode Fuzzy Hash: 844db3ba58ae8aa231536162d5408f5bd4ffb248e7e307de069a5294f40f383b
Instruction Fuzzy Hash: 48313771A00108ABEB04EFA8EE49BEDBB71FF45314F608629F401A72C1DB795A84CB55

Function 0046E240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,EFE0703F,?,?,0054B140,000000FF), ref: 0046E281

Strings

@F, xrefs: 0046E26F
0F, xrefs: 0046E292

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: 0F$@F
API String ID: 3664257935-854975247
Opcode ID: e60468d8558ab10ed23c37b5807159761484d6180806933727f095259a2dadcb
Instruction ID: 71f482a42453dca0316d7d1724b4bafe9a8805fb4aae109ca3ec81d8c884bcfa
Opcode Fuzzy Hash: e60468d8558ab10ed23c37b5807159761484d6180806933727f095259a2dadcb
Instruction Fuzzy Hash: 16018175504708ABE3118F08D905B9ABBE8FB09714F00866AEC5597780E7B99904CB90

Function 0046E160 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0046E19F

Strings

se, xrefs: 0046E195
spon, xrefs: 0046E18E

Memory Dump Source

Source File: 00000000.00000002.3273618691.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3273561569.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273618691.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273920657.00000000005A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3273964293.00000000005A5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nv8401986_110422.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: se$spon
API String ID: 190572456-1233149680
Opcode ID: a18cd38359c5d619c84d42f346176a8ecf3405a003b961118e237ec072f871c9
Instruction ID: b09cfb9e6fa65308120aff59ceb31b5997679d01bd5d3a0a7ffbfa3232e5ab9b
Opcode Fuzzy Hash: a18cd38359c5d619c84d42f346176a8ecf3405a003b961118e237ec072f871c9
Instruction Fuzzy Hash: 7BF0A435E04248EFD700DFA9C8057AEF7F8EF59210F00815DE845A7250EB70AA459BA5

Source: http://w.nanweng.cn:80/qy/rq	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn:80/qy/png	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn/bqd	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn/qy/gl1	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn/qy/glf	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn:80/qy/pngsersd	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn/qy/gl	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn/qy/rqh	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn/qy/png	Avira URL Cloud: Label: malware
Source: http://w.nanweng.cn:80/qy/lqnrps0sid360softtm1689880905type20uid102e1490f0604c078f675cf9899bc6e6ver6	Avira URL Cloud: Label: malware

Source: global traffic	HTTP traffic detected: POST /qy/ov HTTP/1.1Host: w.nanweng.cn Content-Length: 186 Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencodedData Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636
Source: global traffic	HTTP traffic detected: POST /qy/ov HTTP/1.1Host: w.nanweng.cn Content-Length: 186 Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencodedData Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636
Source: global traffic	HTTP traffic detected: POST /qy/ov HTTP/1.1Host: w.nanweng.cn Content-Length: 186 Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencodedData Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636
Source: global traffic	HTTP traffic detected: POST /qy/ov HTTP/1.1Host: w.nanweng.cn Content-Length: 186 Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencodedData Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 31 30 32 65 31 34 39 30 66 30 36 30 34 63 30 37 38 66 36 37 35 63 66 39 38 39 39 62 63 36 65 36 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 31 26 73 69 64 3d 33 36 30 26 76 65 72 3d 36 2e 30 2e 30 2e 31 31 31 31 26 76 6d 3d 31 31 26 74 6d 3d 31 36 38 39 38 38 30 39 30 35 26 74 79 70 65 3d 32 30 26 73 69 67 3d 34 37 46 32 38 46 30 37 34 41 45 43 32 37 46 35 38 30 34 32 35 45 45 39 33 36 32 30 46 36 33 36 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=102e1490f0604c078f675cf9899bc6e6&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=1&sid=360&ver=6.0.0.1111&vm=11&tm=1689880905&type=20&sig=47F28F074AEC27F580425EE93620F636

Source: Joe Sandbox View	IP Address: 18.244.18.122 18.244.18.122
Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137

Source: global traffic	HTTP traffic detected: GET /jquery-3.6.3.min.js HTTP/1.1Accept: /Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: code.jquery.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /b?rn=1735914359603&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=30919B60838E69BC08808E09822668DF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Accept: /Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: sb.scorecardresearch.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/rq HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 504Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/lq HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 102Host: w.nanweng.cn

Source: global traffic	HTTP traffic detected: GET /jquery-3.6.3.min.js HTTP/1.1Accept: /Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: code.jquery.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /b?rn=1735914359603&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fwww.msn.com%2F%3Focid%3Diehp%26mkt%3Den-us&c8=MSN&c9=&cs_fpid=30919B60838E69BC08808E09822668DF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Accept: /Referer: https://www.msn.com/?ocid=iehpAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: sb.scorecardresearch.comConnection: Keep-Alive

Source: nv8401986_110422.exe	Virustotal: Detection: 87%			Perma Link
Source: nv8401986_110422.exe	ReversingLabs: Detection: 86%

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: w.nanweng.cn
Source: global traffic	DNS traffic detected: DNS query: www.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: 2f928570784a0da6dbd199b018c9f49c.clo.footprintdns.com
Source: global traffic	DNS traffic detected: DNS query: 45295f866ecde2b90fe5d09c77f95c80.clo.footprintdns.com
Source: global traffic	DNS traffic detected: DNS query: 238358d141a1b2850f10e9a50017a441.clo.footprintdns.com

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nv8401986_110422.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\roundinfo.ini

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\UXDTP1YG\www.msn[1].xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\5WG_kDsbFabhsuv_6NwDoh2LdnI.gz[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66dJc2rUgPuuUEbsa_gjcd_o3GE.gz[1].css

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\GJDmKr3_TS3Qpm6KEL9UKUQKUO4[1].jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\J0K33CCW.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\P2A3uGO2O64dixlm8-ndJ5_iyo4[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\SO02eTikN8ZV7bCSXFKur4CKSoQ.gz[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\e1HSyVFyJooWdBqZJqsmOfZmunU.gz[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\f5M90q9eKVXkGU-DAv9Aa4jef2k.gz[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\jk2F-rpLS_Gysk7hn3CVhA9oQhY.gz[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\jquery-3.6.3.min[1].js

Windows Analysis Report
nv8401986_110422.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre